# All Private Access apps have user or group assignments
When Microsoft Entra Private Access applications lack user or group assignments, users can't establish tunnels through the application to reach the…
Source: https://maester.dev/docs/tests/ZTA.25481
## Overview
When Microsoft Entra Private Access applications lack user or group assignments, users can't establish tunnels through the application to reach the configured fully qualified domain names (FQDNs) and IP addresses. This restriction prevents access to protected internal resources. Without assignments, organizations can't enforce Conditional Access policies because these policies require explicit user-to-application relationships to evaluate risk signals, device compliance, and authentication strength requirements.
Without user assignments on Private Access applications:
- Organizations lose the ability to enforce least privilege access controls where users get access only to the specific resources they need.
- Organizations can't apply risk-based access policies that block or challenge authentication based on sign-in risk, user risk, or device compliance.
- Identity protection signals that detect credential compromise, impossible travel, or anonymous IP addresses can't protect private resources.
## Remediation
- [Assign users and groups to Private Access applications](https://learn.microsoft.com/entra/global-secure-access/how-to-configure-per-app-access?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#assign-users-and-groups) to enable Zero Trust access controls and Conditional Access enforcement.
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Medium |
| Pillar | Network |
| Category | Global Secure Access |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Global Secure Access |
| Area | Access control |
| Licence | Entra_Premium_Private_Access, Entra_Private_Access |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.