MT.1189: Groups assigned to Global Secure Access traffic forwarding profiles should not be nested.
| ID | MT.1189 |
| Severity | Medium |
| Suite | Mito |
| Product | Entra ID |
| Feature | Global Secure Access |
| Security area | Access control |
| Resource type | Group |
| User impact of fixing | Low |
| Effort to fix | Low |
| Reads from | Microsoft Graph |
| Licence needed | AAD_PREMIUM |
| Lifecycle | Preview |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Global Secure Access traffic forwarding profiles (Microsoft 365, Internet, and Private Access) can be scoped to specific users and groups. Microsoft does not support nested group membership for this assignment - a user must be a direct member of the assigned group to receive the profile (and therefore the Global Secure Access client routing). A nested assignment group silently leaves part of the intended population without the profile.
Remediation action:
Section titled “Remediation action:”- Identify the flagged traffic forwarding profile assignment group(s).
- Either flatten the group to direct user membership, or assign the nested group(s) to the profile directly.
- Re-test to confirm that no profile assignment group contains a nested group.
Related links
Section titled “Related links”- Assign users and groups to traffic forwarding profiles
- Global Secure Access traffic forwarding profiles
Mito check. Author: crmhh. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.