Skip to main content
Version: 2.1.1-preview

MT.1194 - The baseline Global Secure Access security profile should enforce a threat-intelligence floor

Overview​

The baseline security profile (priority 65000) applies to all Internet Access traffic with no Conditional Access required. Linking an enabled threat-intelligence policy to the baseline provides an always-on malware and phishing floor.

The baseline is the only place that protects non-client / remote-network traffic, the Conditional Access token-propagation gap, and users not matched by any user-aware (CA-linked) profile. Microsoft recommends linking the threat-intelligence policy to the baseline because it applies to all users' traffic.

Remediation action:​

  1. Sign in to the Microsoft Entra admin center as at least a Global Secure Access Administrator.
  2. Browse to Global Secure Access > Secure > Threat intelligence policies and create or enable a policy.
  3. Link the threat-intelligence policy to the baseline security profile.

Test Metadata​

FieldValue
Test IDMT.1194
SeverityUnknown
SuiteMaester
CategoryEntra
PowerShell testTest-MtGsaBaselineThreatIntelligenceEnforced
TagsEntra, Maester, MT.1194, Preview

Source​

  • Pester test: tests/Maester/GlobalSecureAccess/Test-MtGsaBaselineThreatIntelligenceEnforced.Tests.ps1
  • PowerShell source: powershell/public/maester/globalsecureaccess/Test-MtGsaBaselineThreatIntelligenceEnforced.ps1