MT.1190: Entra Private Access applications should not use the Default connector group.
| ID | MT.1190 |
| Severity | Low |
| Suite | Mito |
| Product | Entra ID |
| Feature | Global Secure Access |
| Security area | Infrastructure hardening |
| Resource type | ServicePrincipal |
| User impact of fixing | Low |
| Effort to fix | Low |
| Reads from | Microsoft Graph |
| Licence needed | AAD_PREMIUM |
| Lifecycle | Preview |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Newly installed Microsoft Entra private network connectors automatically join the Default connector group. If an Entra Private Access application is served by the Default group, a freshly installed or misconfigured connector immediately begins handling its traffic - a routing and outage risk. Keep the Default group as an idle / onboarding pool and serve every Private Access application through a dedicated connector group.
Remediation action:
Section titled “Remediation action:”- Sign in to the Microsoft Entra admin center as at least a Global Secure Access Administrator.
- Browse to Global Secure Access > Applications > Enterprise applications and open each flagged application.
- Reassign it from the Default connector group to a dedicated connector group.
Related links
Section titled “Related links”Mito check. Author: crmhh. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.