At least two Private Access connectors are active and healthy per connector group

Overview

Microsoft Entra Private Access uses private network connectors to broker connections from on-premises or cloud-hosted networks to the Global Secure Access service. Each connector group serves as the only access path for the private applications assigned to it. If you deploy only one connector in a group, any failure of that host immediately removes all private application access for users who rely on that group.

Without this protection:

• A single connector failure causes a complete loss of private resource access for all users who rely on that connector group until you manually restore the connector.
• A threat actor who terminates the connector Windows service or blocks its outbound Transport Layer Security (TLS) communication can silently deny access to private applications without triggering identity-layer alerts.
• Automatic updates that target one connector at a time might cause downtime when only one connector exists in a group.
• You can’t apply Conditional Access policies when the connector is unreachable, and users are denied access rather than routed through an alternative enforcement point.

Remediation

• Install and register an additional private network connector on a Windows Server in the affected region.
• Learn about connector group high-availability requirements and best practices.
• Review sizing and resiliency guidance for Microsoft Entra private network connectors, including the minimum two-connector recommendation.
• Review high-availability load-balancing best practices applicable to Private Access connector groups.
• Troubleshoot inactive or malfunctioning private network connectors.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Medium
Pillar	Network
Category	Private Access
Product	Entra ID
Feature	Global Secure Access
Area	Infrastructure hardening
Licence	Entra_Premium_Private_Access
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.