MT.1189 - Groups assigned to Global Secure Access traffic forwarding profiles should not be nested.
Overview
Global Secure Access traffic forwarding profiles (Microsoft 365, Internet, and Private Access) can be scoped to specific users and groups. Microsoft does not support nested group membership for this assignment - a user must be a direct member of the assigned group to receive the profile (and therefore the Global Secure Access client routing). A nested assignment group silently leaves part of the intended population without the profile.
Remediation action:
- Identify the flagged traffic forwarding profile assignment group(s).
- Either flatten the group to direct user membership, or assign the nested group(s) to the profile directly.
- Re-test to confirm that no profile assignment group contains a nested group.
Related links
- Assign users and groups to traffic forwarding profiles
- Global Secure Access traffic forwarding profiles
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1189 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Global Secure Access |
| Area | Access control |
| Resource type | Group |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtGsaForwardingProfileAssignmentNotNested |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
| Lifecycle | Preview |