Skip to content
MitoMito Docs

MT.1195: The Quick Access app should not be subject to a sign-in frequency Conditional Access control.
ID MT.1195
Severity Low
Suite Mito
Product Entra ID
Feature Global Secure Access
Security area Authentication
Resource type ConditionalAccessPolicy
User impact of fixing Low
Effort to fix Low
Reads from Microsoft Graph
Licence needed AAD_PREMIUM
Lifecycle Preview

What this checks and how to fix it

Section titled “What this checks and how to fix it”

When Private DNS is hosted on the Quick Access application, the Global Secure Access client’s DNS queries authenticate against the Quick Access app and are evaluated by Conditional Access. A sign-in frequency session control then re-triggers on those frequent DNS lookups, causing unexpected and repeated authentication prompts. Microsoft recommends not applying a sign-in frequency control to Quick Access.

This is an operational / user-experience hygiene check, not a security gap. The fix is to exclude the Quick Access app from the sign-in frequency policy - the MFA grant and the control for everything else stay in place.

An enabled sign-in frequency policy that targets Quick Access is a Fail, unless it falls into a category that does not drive routine DNS prompts, which is surfaced for Review instead:

  • Role-only - scoped only to directory roles (e.g. admins), who typically do not use Private Access.
  • Guest - scoped to guest / external users, who very rarely use Private Access.
  • Risk-gated - has a user- or sign-in-risk condition, so the control only applies under elevated risk.
  • Browser - limited to the browser client app type; Private Access / Quick Access traffic is not browser-based.

Reviewed, accepted exceptions can be allow-listed by policy id or display name via the GsaQuickAccessSignInFrequencyAllowedPolicies global setting in the Mito assessment configuration; those are reported as Accepted and never fail.

Remediation action

Section titled “Remediation action”
  1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
  2. Browse to Entra ID > Conditional Access > Policies and open each Fail policy.
  3. Under Target resources, exclude the Quick Access application (do not remove the sign-in frequency control organization-wide).
Section titled “Related links”

Mito check. Author: crmhh. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.