Skip to content
MitoMito Docs

MT.1193: Entra Private Access application segments should avoid broad or risky destinations.
ID MT.1193
Severity Medium
Suite Mito
Product Entra ID
Feature Global Secure Access
Security area Access control
Resource type ServicePrincipal
User impact of fixing Low
Effort to fix Medium
Framework controls nist-800-53-r5:SC-7 Boundary Protection
nist-800-53-r5:AC-17 Remote Access
MITRE ATT&CK T1021, T1046
Reads from Microsoft Graph
Licence needed AAD_PREMIUM
Lifecycle Preview

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Entra Private Access application segments should target specific destinations. Broad or risky destinations break least-privilege and can cause operational problems:

  • dnsSuffix that is a bare top-level domain (for example com, net, local) - a TLD-wide catch-all. A normal scoped suffix such as contoso.com is the recommended resolution path and is not flagged.
  • Wildcard FQDN (for example *.contoso.com).
  • Single-label FQDN (for example fileserver) - relies on the synthetic Global Secure Access suffix and carries a Kerberos SPN risk.
  • Broad IP ranges (near-default routes). The portal’s broadest selectable mask is /1, so segments broader than /16 are flagged - a /16, common for 10.x networks, still passes. Global Secure Access is IPv4-only, so IPv6 is not evaluated. Finer least-privilege CIDR checks are left to the overlapping ZTA segment check.

servicePrincipalName segments (Kerberos SPNs such as HTTP/*) are a legitimate Private Access construct and are not evaluated.

Remediation action:

Section titled “Remediation action:”
  1. Sign in to the Microsoft Entra admin center as at least a Global Secure Access Administrator.
  2. Browse to Global Secure Access > Applications > Enterprise applications and open each flagged application.
  3. Replace the broad segment with specific FQDNs / IP ranges, and configure the correct Private DNS suffix instead of relying on a dnsSuffix catch-all.
Section titled “Related links”

Mito check. Author: crmhh. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.