MT.1193 - Entra Private Access application segments should avoid broad or risky destinations.
Overview
Entra Private Access application segments should target specific destinations. Broad or risky destinations break least-privilege and can cause operational problems:
dnsSuffixthat is a bare top-level domain (for examplecom,net,local) - a TLD-wide catch-all. A normal scoped suffix such ascontoso.comis the recommended resolution path and is not flagged.- Wildcard FQDN (for example
*.contoso.com). - Single-label FQDN (for example
fileserver) - relies on the synthetic Global Secure Access suffix and carries a Kerberos SPN risk. - Broad IP ranges (near-default routes). The portal's broadest selectable mask is
/1, so segments broader than/16are flagged - a/16, common for 10.x networks, still passes. Global Secure Access is IPv4-only, so IPv6 is not evaluated. Finer least-privilege CIDR checks are left to the overlapping ZTA segment check.
servicePrincipalName segments (Kerberos SPNs such as HTTP/*) are a legitimate Private Access construct and are not evaluated.
Remediation action:
- Sign in to the Microsoft Entra admin center as at least a Global Secure Access Administrator.
- Browse to Global Secure Access > Applications > Enterprise applications and open each flagged application.
- Replace the broad segment with specific FQDNs / IP ranges, and configure the correct Private DNS suffix instead of relying on a
dnsSuffixcatch-all.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1193 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Global Secure Access |
| Area | Access control |
| Resource type | ServicePrincipal |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1021 Remote Services, T1046 Network Service Discovery |
| Supports controls | nist-800-53-r5:SC-7, nist-800-53-r5:AC-17 |
| PowerShell test | Test-MtGsaPrivateAccessAppSegmentHygiene |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
| Lifecycle | Preview |