MT.1192 - Groups assigned to Entra Private Access applications should not be nested

Overview

Microsoft Entra enterprise application assignment grants access to the direct (and dynamic) members of an assigned group only - the assignment does not cascade to nested groups, and nested group membership is not supported for app assignment. Groups assigned to Global Secure Access Private Access applications (and the Quick Access app) must therefore use direct membership, otherwise members of a nested group are silently left without access.

This limitation applies only to app assignment. Conditional Access scoping does honor nested groups, so the MFA and managed-device coverage checks are not affected.

Remediation action:

1. Identify the flagged Private Access / Quick Access application assignment group(s).
2. Either flatten the group to direct (or dynamic) membership, or assign the nested group(s) to the application directly.
3. Re-test to confirm that no assignment group contains a nested group.

Related links

• Assign users and groups to an application
• Use a group to manage access to applications

Test Metadata

Field	Value
Test ID	MT.1192
Severity	Unknown
Suite	Maester
Category	Entra
PowerShell test	Test-MtGsaPrivateAccessAppAssignmentNotNested
Tags	Entra, Maester, MT.1192, Preview

Source

• Pester test: tests/Maester/GlobalSecureAccess/Test-MtGsaPrivateAccessAppAssignmentNotNested.Tests.ps1
• PowerShell source: powershell/public/maester/globalsecureaccess/Test-MtGsaPrivateAccessAppAssignmentNotNested.ps1