MT.1194 - The baseline Global Secure Access security profile should enforce a threat-intelligence floor.
Overview
The baseline security profile (priority 65000) applies to all Internet Access traffic with no Conditional Access required. Linking an enabled threat-intelligence policy to the baseline provides an always-on malware and phishing floor.
The baseline is the only place that protects non-client / remote-network traffic, the Conditional Access token-propagation gap, and users not matched by any user-aware (CA-linked) profile. Microsoft recommends linking the threat-intelligence policy to the baseline because it applies to all users' traffic.
Remediation action:
- Sign in to the Microsoft Entra admin center as at least a Global Secure Access Administrator.
- Browse to Global Secure Access > Secure > Threat intelligence policies and create or enable a policy.
- Link the threat-intelligence policy to the baseline security profile.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1194 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Global Secure Access |
| Area | Access control |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1204.001 Malicious Link, T1566.002 Spearphishing Link |
| PowerShell test | Test-MtGsaBaselineThreatIntelligenceEnforced |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
| Lifecycle | Preview |