Skip to main content
Version: 2.1.0

Test-MtGsaQuickAccessNoSignInFrequency

SYNOPSIS​

Checks that no Conditional Access sign-in frequency control applies to the Global Secure Access Quick Access app.

SYNTAX​

Test-MtGsaQuickAccessNoSignInFrequency [[-AllowedPolicies] <String[]>] [-ProgressAction <ActionPreference>]
 [<CommonParameters>]

DESCRIPTION​

When Private DNS is hosted on the Quick Access application, the Global Secure Access client's DNS queries authenticate against the Quick Access app and are evaluated by Conditional Access. A sign-in frequency session control then re-triggers on those frequent DNS lookups, causing unexpected and repeated authentication prompts. Microsoft therefore recommends not applying a sign-in frequency control to Quick Access.

This is an operational / user-experience hygiene check, not a security gap. An enabled sign-in frequency policy that targets Quick Access is reported as Fail, except when it falls into a category that does not drive routine DNS prompts, which is surfaced for Review instead:

  • Role-only : scoped only to directory roles (e.g. admins), who typically do not use Private Access.
  • Guest : scoped to guest / external users, who very rarely use Private Access.
  • Risk-gated : has a user- or sign-in-risk condition, so the control only applies under elevated risk.
  • Browser : limited to the 'browser' client app type; Private Access traffic is not browser-based.

Reviewed, accepted exceptions can be allow-listed by policy id or display name via the 'GsaQuickAccessSignInFrequencyAllowedPolicies' global setting (maester-config.json); those are reported as Accepted and never fail.

Remediation for a Fail is to exclude the Quick Access app from the sign-in frequency policy - not to remove the control organization-wide.

EXAMPLES​

EXAMPLE 1​

Test-MtGsaQuickAccessNoSignInFrequency

Returns $true if no sign-in frequency policy applies to Quick Access outside the allowed categories.

PARAMETERS​

-AllowedPolicies​

Conditional Access policies (by id or displayName) that are reviewed, accepted exceptions and should never fail this check. Defaults to the 'GsaQuickAccessSignInFrequencyAllowedPolicies' GlobalSetting in maester-config.json.

Type: String[]
Parameter Sets: (All)
Aliases:

Required: False
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

System.Boolean​

NOTES​

https://maester.dev/docs/commands/Test-MtGsaQuickAccessNoSignInFrequency