MT.1190 - Entra Private Access applications should not use the Default connector group

Overview

Newly installed Microsoft Entra private network connectors automatically join the Default connector group. If an Entra Private Access application is served by the Default group, a freshly installed or misconfigured connector immediately begins handling its traffic - a routing and outage risk. Keep the Default group as an idle / onboarding pool and serve every Private Access application through a dedicated connector group.

Remediation action:

1. Sign in to the Microsoft Entra admin center as at least a Global Secure Access Administrator.
2. Browse to Global Secure Access > Applications > Enterprise applications and open each flagged application.
3. Reassign it from the Default connector group to a dedicated connector group.

Related links

• Microsoft Entra private network connector groups
• Publish Enterprise apps with Global Secure Access

Test Metadata

Field	Value
Test ID	MT.1190
Severity	Unknown
Suite	Maester
Category	Entra
PowerShell test	Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup
Tags	Entra, Maester, MT.1190, Preview

Source

• Pester test: tests/Maester/GlobalSecureAccess/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup.Tests.ps1
• PowerShell source: powershell/public/maester/globalsecureaccess/Test-MtGsaPrivateAccessAppNotOnDefaultConnectorGroup.ps1