MT.1192: Groups assigned to Entra Private Access applications should not be nested.
| ID | MT.1192 |
| Severity | Low |
| Suite | Mito |
| Product | Entra ID |
| Feature | Global Secure Access |
| Security area | Access control |
| Resource type | Group |
| User impact of fixing | Low |
| Effort to fix | Low |
| Reads from | Microsoft Graph |
| Licence needed | AAD_PREMIUM |
| Lifecycle | Preview |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Microsoft Entra enterprise application assignment grants access to the direct (and dynamic) members of an assigned group only - the assignment does not cascade to nested groups, and nested group membership is not supported for app assignment. Groups assigned to Global Secure Access Private Access applications (and the Quick Access app) must therefore use direct membership, otherwise members of a nested group are silently left without access.
This limitation applies only to app assignment. Conditional Access scoping does honor nested groups, so the MFA and managed-device coverage checks are not affected.
Remediation action:
Section titled “Remediation action:”- Identify the flagged Private Access / Quick Access application assignment group(s).
- Either flatten the group to direct (or dynamic) membership, or assign the nested group(s) to the application directly.
- Re-test to confirm that no assignment group contains a nested group.
Related links
Section titled “Related links”Mito check. Author: crmhh. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.