# Global Secure Access deployment logs are populated and reviewed
Global Secure Access deployment logs track the status and progress of configuration changes across the global network.
Source: https://maester.dev/docs/tests/ZTA.25422
## Overview
Global Secure Access deployment logs track the status and progress of configuration changes across the global network. These changes include forwarding profile redistributions, remote network updates, filtering profile changes, and changes to Conditional Access settings. If deployment logs show failed deployments, threat actors can exploit inconsistent security configurations where some edge locations have outdated or misconfigured policies.
If you don't monitor deployment logs:
- Failed deployments can leave security gaps such as outdated forwarding profiles that don't route traffic through security inspection, or filtering profiles that don't block malicious destinations.
- Administrators might remain unaware of outdated configurations, believing that changes are applied uniformly.
- Deployment failures that create exploitable gaps can go undetected.
## Remediation
- Follow the steps in [How to use the Global Secure Access deployment logs](https://learn.microsoft.com/entra/global-secure-access/how-to-view-deployment-logs?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to:
- Access and review deployment logs in the Microsoft Entra admin center to identify failed deployments.
- For failed deployments, examine the error message in the `status.message` field and retry the configuration change that triggered the failure.
- Monitor deployment notifications that appear in the admin center when making configuration changes to catch failures in real-time.
- If deployments consistently fail for remote networks, [review the underlying remote network configuration](https://learn.microsoft.com/entra/global-secure-access/how-to-manage-remote-networks?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) for errors.
- For forwarding profile deployment failures, [verify traffic forwarding configuration](https://learn.microsoft.com/entra/global-secure-access/concept-traffic-forwarding?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Network |
| Category | Global Secure Access |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Global Secure Access |
| Area | Logging and detection |
| Licence | Entra_Premium_Internet_Access, Entra_Premium_Private_Access |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.