Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Overview
These sample scripts provide guidance on common Global Secure Access tasks using PowerShell. Most samples require the Microsoft Graph Beta PowerShell module 2.10 or newer, unless otherwise noted.
The samples are grouped by scenario.
Connector setup
| Sample | Description |
|---|---|
| Get token for connector | Get the auth token for registering your Microsoft Entra private network connector through Azure, AWS, or GCP Marketplaces. |
Client deployment
| Sample | Description |
|---|---|
| Install the Global Secure Access Windows client as a proof of concept | Automate installation of the Global Secure Access Windows client and apply essential registry configurations for proof-of-concept deployments. |
Traffic forwarding and bypass
| Sample | Description |
|---|---|
| Add a custom bypass rule to Internet Access | Programmatically add a custom bypass rule to the Microsoft Entra Internet Access forwarding policy to bypass specified domains or IPs. |
| Add Intune device compliance bypasses to Internet Access | Add Intune-related network endpoints to the Internet Access custom bypass policy to mitigate device compliance issues. |
Break glass
| Sample | Description |
|---|---|
| Disable traffic forwarding and Compliant Network policies (break glass) | Quickly disable traffic forwarding profiles and switch Conditional Access policies that use the Compliant Network condition into Report-Only mode during an outage. |
| Restore Compliant Network requirement after break glass | Re-enable the forwarding profiles and Conditional Access policies that were disabled by the break glass script after an outage is resolved. |
TLS inspection certificates
| Sample | Description |
|---|---|
| Create and sign TLS certificates using Active Directory Certificate Services | Generate a certificate signing request through the TLS inspection Graph API, sign it with ADCS, and upload the certificate and chain to TLS inspection settings. |
| Create and sign TLS certificates using OpenSSL | Generate a certificate signing request through the TLS inspection Graph API, sign it with a self-signed root CA created by OpenSSL, and upload the certificate and chain to TLS inspection settings. |
Operations monitoring
| Sample | Description |
|---|---|
| Shared helper functions for operations scripts | Use shared authentication, Log Analytics token, and alert email helper functions for operations automation scripts. |
| Verify configuration backup compliance | Check recent Azure Automation jobs for your Global Secure Access configuration backup runbook and alert when backups fail or miss a scheduled run. |
| Check role assignment reviews | Query Global Secure Access-related role assignments and identify administrator accounts that need quarterly review. |
| Calculate alert noise ratio | Calculate the Microsoft Sentinel alert noise ratio for Global Secure Access detections and identify noisy analytics rules. |
Recovery
| Sample | Description |
|---|---|
| List Microsoft Entra snapshots | List Microsoft Entra Backup and Recovery snapshots for the tenant and identify the latest available snapshot. |
| Preview Microsoft Entra recovery | Create a non-destructive recovery preview job scoped to directory objects that affect Global Secure Access. |
| Run Microsoft Entra recovery | Run a Microsoft Entra recovery job after reviewing and approving the matching preview job. |