MT.1188: Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device.
| ID | MT.1188 |
| Severity | Medium |
| Suite | Mito |
| Product | Entra ID |
| Feature | Global Secure Access |
| Security area | Access control |
| Resource type | ServicePrincipal |
| User impact of fixing | Medium |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:AC-17 Remote Accessnist-800-53-r5:IA-3 Device Identification and Authentication |
| MITRE ATT&CK | T1078.004, T1133 |
| Reads from | Microsoft Graph |
| Licence needed | AAD_PREMIUM |
| Lifecycle | Preview |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Every Entra Private Access (and Quick Access) application should be protected by an enabled Conditional Access policy that requires a managed device - either by targeting the application directly or via All cloud apps. This ensures private applications are only reachable from managed endpoints.
A policy satisfies the requirement when it grants Require device to be marked as compliant (Intune compliant) or Require Microsoft Entra hybrid joined device (domainJoinedDevice).
This check evaluates application coverage only; it does not evaluate whether the policy applies to every user of the app.
Remediation action
Section titled “Remediation action”- Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
- Browse to Entra ID > Conditional Access > Policies.
- Create or edit an enabled policy that targets the listed Private Access applications (or All cloud apps) and, under Grant, requires a compliant or Microsoft Entra hybrid joined device.
- Set Enable policy to On and save.
Related links
Section titled “Related links”Mito check. Author: crmhh. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.