MT.1190 - Entra Private Access applications should not use the Default connector group.

Contributed by Christopher BrummAll contributors →

Overview

Newly installed Microsoft Entra private network connectors automatically join the Default connector group. If an Entra Private Access application is served by the Default group, a freshly installed or misconfigured connector immediately begins handling its traffic - a routing and outage risk. Keep the Default group as an idle / onboarding pool and serve every Private Access application through a dedicated connector group.

Remediation action:

1. Sign in to the Microsoft Entra admin center as at least a Global Secure Access Administrator.
2. Browse to Global Secure Access > Applications > Enterprise applications and open each flagged application.
3. Reassign it from the Default connector group to a dedicated connector group.

Related links

• Microsoft Entra private network connector groups
• Publish Enterprise apps with Global Secure Access

Test Metadata

Field	Value
Test ID	MT.1190
Severity	Low
Suite	Maester
Product	Entra ID
Feature	Global Secure Access
Area	Infrastructure hardening
Resource type	ServicePrincipal
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
PowerShell test	Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup
Services	Graph
Compatible licenses	AAD_PREMIUM
Lifecycle	Preview

Source

• Test: tests/maester/global-secure-access/Test.MT.1190.ps1
• Documentation: tests/maester/global-secure-access/Test.MT.1190.md