TLS inspection failure rate is below 1%
Overview
Section titled “Overview”By using Transport Layer Security (TLS) inspection, Global Secure Access can decrypt encrypted HTTPS traffic and check it for threats, malicious content, and policy violations. If TLS inspection fails for a connection, that traffic bypasses security controls. Inspection failures can let potential malware delivery, command-and-control communications, or data exfiltration go undetected.
Failure rates above 1% point to systemic problems. These problems include certificate trust issues on endpoints, incompatible applications that use certificate pinning without proper bypass rules, or certificate authority configuration errors. Threat actors can also intentionally create connections that cause TLS inspection failures.
Remediation
Section titled “Remediation”- Configure diagnostic settings to export traffic logs to a Log Analytics workspace. Use these logs to monitor TLS inspection success rates and investigate the root causes of failures.
- Follow the steps in Troubleshoot Global Secure Access Transport Layer Security inspection errors to resolve common inspection failures.
- For destinations with certificate pinning, add TLS bypass rules to reduce failure rates while keeping inspection for other traffic.
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | Network |
| Category | Global Secure Access |
| Product | Entra ID |
| Feature | Global Secure Access |
| Area | Access control |
| ATT&CK | T1573 Encrypted Channel |
| Licence | Entra_Premium_Internet_Access |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.