Skip to main content
Version: 2.1.0

Test-MtGsaPrivateAccessAppSegmentHygiene

SYNOPSIS​

Checks that no Entra Private Access application segment uses a broad or risky destination.

SYNTAX​

Test-MtGsaPrivateAccessAppSegmentHygiene [[-BroadIPv4MaskThreshold] <Int32>]
 [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

Reviews the application segments of Entra Private Access (and Quick Access) applications and flags destinations that break least-privilege or carry operational risk:

  • destinationType 'dnsSuffix' that is a bare top-level domain (single label, e.g. 'com' / 'net' / 'local') - a TLD-wide catch-all. A normal scoped suffix (e.g. 'contoso.com') is the recommended resolution path and is not flagged.
  • Wildcard FQDN (destinationHost contains '*').
  • Single-label FQDN (destinationType 'fqdn' with no dot, e.g. 'fileserver') - relies on the synthetic Global Secure Access suffix and carries a Kerberos SPN risk.
  • servicePrincipalName segments (Kerberos SPNs such as 'HTTP/*') are a legitimate construct and are not evaluated.
  • Broad IP ranges (near-default routes) - the portal's broadest selectable mask is /1, so an exact 0.0.0.0/0 rarely appears; segments broader than /16 are flagged instead, so a /16 - common for 10.x networks - still passes. (Global Secure Access is IPv4-only, so IPv6 segments are not evaluated.) Finer least-privilege CIDR sweeps (e.g. < /24) are intentionally left to the overlapping ZTA segment check this will be merged with.

EXAMPLES​

EXAMPLE 1​

Test-MtGsaPrivateAccessAppSegmentHygiene

Returns $true if no application segment uses a broad or risky destination.

PARAMETERS​

-BroadIPv4MaskThreshold​

A CIDR segment whose prefix length is below this value (broader than /16) is flagged as a broad / near-default route. A /16 - common for 10.x networks - and narrower pass. (GSA is IPv4-only, so IPv6 segments are not evaluated.)

Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: 1
Default value: 16
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

System.Boolean​

NOTES​

https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppSegmentHygiene