MT.1188 - Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device.
Overview
Every Entra Private Access (and Quick Access) application should be protected by an enabled Conditional Access policy that requires a managed device - either by targeting the application directly or via All cloud apps. This ensures private applications are only reachable from managed endpoints.
A policy satisfies the requirement when it grants Require device to be marked as compliant (Intune compliant) or Require Microsoft Entra hybrid joined device (domainJoinedDevice).
This check evaluates application coverage only; it does not evaluate whether the policy applies to every user of the app.
Remediation action
- Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
- Browse to Entra ID > Conditional Access > Policies.
- Create or edit an enabled policy that targets the listed Private Access applications (or All cloud apps) and, under Grant, requires a compliant or Microsoft Entra hybrid joined device.
- Set Enable policy to On and save.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1188 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Global Secure Access |
| Area | Access control |
| Resource type | ServicePrincipal |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1133 External Remote Services |
| Supports controls | nist-800-53-r5:AC-17, nist-800-53-r5:IA-3 |
| PowerShell test | Test-MtGsaPrivateAccessAppCompliantDevice |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
| Lifecycle | Preview |