MT.1194: The baseline Global Secure Access security profile should enforce a threat-intelligence floor.
| ID | MT.1194 |
| Severity | Medium |
| Suite | Mito |
| Product | Entra ID |
| Feature | Global Secure Access |
| Security area | Access control |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| MITRE ATT&CK | T1204.001, T1566.002 |
| Reads from | Microsoft Graph |
| Licence needed | AAD_PREMIUM |
| Lifecycle | Preview |
What this checks and how to fix it
Section titled “What this checks and how to fix it”The baseline security profile (priority 65000) applies to all Internet Access traffic with no Conditional Access required. Linking an enabled threat-intelligence policy to the baseline provides an always-on malware and phishing floor.
The baseline is the only place that protects non-client / remote-network traffic, the Conditional Access token-propagation gap, and users not matched by any user-aware (CA-linked) profile. Microsoft recommends linking the threat-intelligence policy to the baseline because it applies to all users’ traffic.
Remediation action:
Section titled “Remediation action:”- Sign in to the Microsoft Entra admin center as at least a Global Secure Access Administrator.
- Browse to Global Secure Access > Secure > Threat intelligence policies and create or enable a policy.
- Link the threat-intelligence policy to the baseline security profile.
Related links
Section titled “Related links”Mito check. Author: crmhh. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.