{"items":[{"href":"./","toc_title":"Global Secure Access documentation"},{"children":[{"href":"overview-what-is-global-secure-access","toc_title":"What is Global Secure Access?"},{"href":"concept-traffic-dashboard","toc_title":"Global Secure Access dashboard"},{"href":"reference-role-based-permissions","toc_title":"Role-based administrator roles"}],"expanded":true,"toc_title":"Overview"},{"children":[{"href":"quickstart-access-admin-center","toc_title":"Access Global Secure Access in the admin center"},{"href":"quickstart-install-client","toc_title":"Install the Windows client to acquire Microsoft traffic"},{"href":"quickstart-remote-network","toc_title":"Create a remote network"},{"href":"quickstart-quick-access","toc_title":"Configure Quick Access to private resources"},{"href":"quickstart-per-app-access","toc_title":"Configure per-app access to private resources"}],"toc_title":"Quickstarts"},{"children":[{"children":[{"href":"tutorial-microsoft-traffic-introduction","toc_title":"Get started"},{"href":"tutorial-microsoft-traffic-enable-profile","toc_title":"Enable the Microsoft traffic profile"},{"href":"tutorial-microsoft-traffic-source-ip-restoration","toc_title":"Enable source IP restoration"},{"href":"tutorial-microsoft-traffic-compliant-network","toc_title":"Enable the compliant network check"},{"href":"tutorial-microsoft-traffic-tenant-restrictions","toc_title":"Configure universal tenant restrictions"}],"toc_title":"Microsoft traffic labs"},{"children":[{"href":"tutorial-internet-access-introduction","toc_title":"Get started"},{"href":"tutorial-internet-access-enable-traffic-forwarding","toc_title":"Enable traffic forwarding"},{"href":"tutorial-internet-access-web-content-filtering","toc_title":"Configure web content filtering"},{"href":"tutorial-internet-access-tls-inspection","toc_title":"Enable TLS inspection"},{"href":"tutorial-internet-access-url-filtering","toc_title":"Configure URL filtering"},{"href":"tutorial-internet-access-threat-intelligence","toc_title":"Configure threat intelligence"},{"href":"tutorial-internet-access-application-discovery","toc_title":"Discover applications"},{"href":"tutorial-internet-access-content-policies","toc_title":"Configure content policies"}],"toc_title":"Internet Access labs"},{"children":[{"href":"tutorial-private-access-introduction","toc_title":"Get started"},{"href":"tutorial-private-access-connector-setup","toc_title":"Set up the connector"},{"href":"tutorial-private-access-enable-traffic-forwarding","toc_title":"Enable traffic forwarding"},{"href":"tutorial-private-access-vpn-replacement","toc_title":"VPN replacement with Quick Access"},{"href":"tutorial-private-access-app-segmentation","toc_title":"Per-app access segmentation"},{"href":"tutorial-private-access-intelligent-local-access","toc_title":"Intelligent Local Access"}],"toc_title":"Private Access labs"}],"toc_title":"Tutorials"},{"children":[{"href":"overview-operations","toc_title":"Operations guide overview"},{"href":"how-to-operations-common","toc_title":"Common operations (RACI, change, metrics)"},{"href":"how-to-security-operations","toc_title":"Security operations for network access"},{"href":"how-to-operate-private-access","toc_title":"Operate Private Access"},{"href":"how-to-operate-internet-access","toc_title":"Operate Internet Access"},{"href":"how-to-operate-microsoft-traffic","toc_title":"Operate Microsoft Traffic"},{"href":"how-to-operate-remote-networks","toc_title":"Operate Remote Networks"},{"children":[{"href":"reference-daily-health-check","toc_title":"Daily health check"},{"href":"reference-private-access-health-check","toc_title":"Private Access health check"},{"href":"reference-change-request-template","toc_title":"Change request template"},{"href":"reference-communication-plan","toc_title":"Communication plan"}],"toc_title":"Templates"}],"toc_title":"Operations"},{"children":[{"href":"powershell-samples","toc_title":"Overview of Global Secure Access samples"},{"href":"scripts/powershell-get-token","toc_title":"Get token for connector"},{"href":"scripts/powershell-break-glass","toc_title":"Restore productivity in a break glass scenario"},{"href":"scripts/powershell-break-glass-recovery","toc_title":"Restore traffic forwarding and compliant network requirement after a break glass operation"},{"href":"scripts/powershell-bypass-script","toc_title":"Bypass internet destinations from the Internet Access profile"},{"href":"scripts/powershell-add-internet-access-device-compliance-bypasses","toc_title":"Bypass Intune endpoints from the Internet Access profile"},{"href":"scripts/powershell-active-directory-certificate-service","toc_title":"Create a TLS certificate using ADCS"},{"href":"scripts/powershell-open-secure-sockets-layer","toc_title":"Create a TLS certificate using OpenSSL"},{"href":"scripts/powershell-windows-client-install-proof-of-concept","toc_title":"Install the Windows client as a proof of concept"},{"children":[{"href":"scripts/powershell-global-secure-access-operations-helpers","toc_title":"Shared helper functions for operations scripts"},{"href":"scripts/powershell-test-backup-compliance","toc_title":"Verify configuration backup compliance"},{"href":"scripts/powershell-test-role-based-access-control-hygiene","toc_title":"Check role assignment reviews"},{"href":"scripts/powershell-test-alert-noise-ratio","toc_title":"Calculate alert noise ratio"}],"toc_title":"Operations monitoring"},{"children":[{"href":"scripts/powershell-get-entra-snapshot","toc_title":"List Microsoft Entra snapshots"},{"href":"scripts/powershell-start-entra-recovery-preview","toc_title":"Preview Microsoft Entra recovery"},{"href":"scripts/powershell-invoke-entra-recovery","toc_title":"Run Microsoft Entra recovery"}],"toc_title":"Recovery"}],"toc_title":"Samples"},{"children":[{"href":"concept-clients","toc_title":"Global Secure Access clients"},{"href":"concept-bring-your-own-device","toc_title":"Bring your own device (BYOD)"},{"href":"concept-connectors","toc_title":"Private network connector"},{"href":"concept-connector-groups","toc_title":"Private network connector groups"},{"href":"concept-private-name-resolution","toc_title":"Understand Private DNS"},{"href":"concept-remote-network-connectivity","toc_title":"Understand remote network connectivity"},{"href":"concept-universal-continuous-access-evaluation","toc_title":"Universal Continuous Access Evaluation"},{"href":"overview-application-usage-analytics","toc_title":"Application Usage Analytics"},{"href":"concept-shadow-ai-discovery","toc_title":"Shadow AI discovery"},{"href":"concept-ai-agent-discovery","toc_title":"AI agent discovery (preview)"},{"href":"concept-generative-ai-insights","toc_title":"Generative AI Insights (preview)"},{"href":"concept-external-user-access","toc_title":"External user access"},{"href":"concept-secure-web-ai-gateway-agents","toc_title":"Secure Web and AI Gateway for Microsoft Copilot Studio agents"},{"href":"concept-web-filtering","toc_title":"Web filtering (V2)"},{"children":[{"href":"concept-explicit-forward-proxy","toc_title":"Understand Explicit Forward Proxy"},{"href":"concept-explicit-forward-proxy-session-management","toc_title":"Explicit Forward Proxy session management"},{"href":"concept-proxy-automatic-configuration-files","toc_title":"Proxy automatic configuration (PAC) files"}],"toc_title":"Explicit Forward Proxy"}],"toc_title":"Concepts"},{"children":[{"children":[{"href":"how-to-install-windows-client","toc_title":"Install the Windows client"},{"href":"how-to-install-macos-client","toc_title":"Install the macOS client"},{"href":"how-to-install-android-client","toc_title":"Install the Android client"},{"href":"how-to-install-ios-client","toc_title":"Install the iOS client"},{"href":"how-to-edr-antivirus-coexistence","toc_title":"Configure antivirus-client coexistence"}],"toc_title":"Install the Global Secure Access client"},{"children":[{"href":"how-to-create-remote-networks","toc_title":"Create a remote network"},{"href":"remote-network-resilience","toc_title":"Enhance remote network resilience"},{"href":"how-to-create-remote-network-custom-ike-policy","toc_title":"Create a remote network with a custom Internet Key Exchange (IKE) policy"},{"href":"how-to-configure-customer-premises-equipment","toc_title":"Configure customer premises equipment"},{"href":"how-to-list-remote-networks","toc_title":"List remote networks"},{"href":"how-to-manage-remote-network-device-links","toc_title":"Update and delete remote network device links"},{"href":"how-to-manage-remote-networks","toc_title":"Update and delete remote networks"},{"href":"how-to-assign-traffic-profile-to-remote-network","toc_title":"Assign a traffic forwarding profile to remote networks"},{"href":"how-to-apply-security-policies-remote-network","toc_title":"Apply security policies to remote network traffic"},{"href":"how-to-create-remote-network-cpe-behind-nat","toc_title":"Connect a remote network when your CPE is behind a NAT device"},{"href":"how-to-simulate-remote-network","toc_title":"Simulate remote network connectivity using Azure Virtual Network Gateway (VNG)"},{"href":"how-to-create-remote-network-vwan","toc_title":"Simulate remote network connectivity using Azure vWAN"}],"toc_title":"Remote networks"},{"children":[{"children":[{"href":"concept-universal-conditional-access","toc_title":"Understand Universal Conditional Access"},{"href":"how-to-target-resource-microsoft-profile","toc_title":"Internet traffic"}],"toc_title":"Universal Conditional Access"},{"href":"how-to-compliant-network","toc_title":"Compliant network check"},{"href":"how-to-target-resource-private-access-apps","toc_title":"Private Access apps"},{"href":"how-to-source-ip-restoration","toc_title":"Source IP restoration"},{"href":"how-to-universal-tenant-restrictions","toc_title":"Universal Tenant Restrictions"}],"toc_title":"Access controls"},{"children":[{"href":"concept-traffic-forwarding","toc_title":"Understand traffic forwarding profiles"},{"href":"concept-microsoft-traffic-profile","toc_title":"Understand the Microsoft traffic profile"},{"href":"how-to-create-traffic-forwarding-profile","toc_title":"Create a Private Access profile"},{"href":"how-to-manage-microsoft-profile","toc_title":"Manage the Microsoft profile"},{"href":"how-to-manage-private-access-profile","toc_title":"Manage Private Access profiles"},{"href":"how-to-manage-internet-access-profile","toc_title":"Manage the Internet Access profile"},{"href":"how-to-manage-users-groups-assignment","toc_title":"Assign users and devices to a profile"},{"href":"how-to-delete-traffic-forwarding-profile","toc_title":"Delete a Private Access profile"}],"toc_title":"Traffic forwarding profiles"},{"children":[{"href":"concept-private-access","toc_title":"Understand Private Access"},{"children":[{"href":"how-to-configure-connectors","toc_title":"Configure connectors"},{"href":"how-to-enable-multi-geo","toc_title":"Enable Multi-Geo capability"},{"href":"how-to-register-connector-powershell","toc_title":"Register connector - silent install"}],"toc_title":"Connectors"},{"children":[{"href":"how-to-configure-per-app-access","toc_title":"Configure per-app access"},{"href":"how-to-configure-quick-access","toc_title":"Configure Quick Access"},{"href":"how-to-application-discovery","toc_title":"Application Discovery"},{"href":"how-to-private-access-segmentation-strategies","toc_title":"Private Access segmentation strategies"},{"href":"how-to-configure-global-access-with-pim","toc_title":"Configure Private Access with Privileged Identity Management (PIM)"}],"toc_title":"Applications"},{"children":[{"href":"enable-intelligent-local-access","toc_title":"Enable Intelligent Local Access (preview)"},{"href":"how-to-configure-kerberos-sso","toc_title":"Kerberos single sign-on (SSO)"},{"href":"source-ip-anchoring","toc_title":"Source IP anchoring"},{"href":"how-to-use-with-azure-sql-service-endpoint","toc_title":"Access Azure SQL with a service endpoint"},{"href":"how-to-use-private-link-with-private-access","toc_title":"Use with Azure Private Link"},{"href":"how-to-configure-domain-controllers","toc_title":"Configure Private Access for domain controllers"},{"href":"how-to-manage-ssh-server-administration","toc_title":"Configure Private Access to enable SSH-based server administration"}],"toc_title":"Networking and SSO"},{"children":[{"href":"how-to-migrate-direct-access-to-private-access","toc_title":"Migrate from DirectAccess to Microsoft Entra Private Access"}],"toc_title":"Migration"}],"toc_title":"Private Access"},{"children":[{"href":"concept-internet-access","toc_title":"Understand Internet Access"},{"children":[{"href":"concept-transport-layer-security","toc_title":"What is Transport Layer Security inspection?"},{"href":"how-to-transport-layer-security-settings-managed-certificate","toc_title":"Configure TLS inspection with a Microsoft-managed certificate (Preview)"},{"href":"how-to-transport-layer-security-settings","toc_title":"Configure TLS inspection with your own certificate"},{"href":"how-to-transport-layer-security","toc_title":"Configure Transport Layer Security inspection policies"},{"href":"faq-transport-layer-security","toc_title":"Transport Layer Security inspection FAQs"}],"toc_title":"Transport Layer Security inspection"},{"href":"how-to-configure-web-content-filtering","toc_title":"Configure web content filtering"},{"href":"how-to-migrate-web-content-filtering-policies","toc_title":"Migrate web content filtering policies to V2"},{"href":"how-to-check-web-content-filtering-categories","toc_title":"Check URL category"},{"href":"how-to-customize-block-page","toc_title":"Customize the block page"},{"href":"how-to-configure-custom-headers","toc_title":"Add custom headers for tenant restrictions in SaaS applications"},{"href":"how-to-configure-threat-intelligence","toc_title":"Configure threat intelligence"},{"href":"how-to-configure-cloud-firewall","toc_title":"Configure cloud firewall"},{"href":"how-to-network-content-filtering","toc_title":"Configure network content filtering"},{"href":"how-to-ai-prompt-injection-protection","toc_title":"Configure the AI Gateway prompt injection protection"},{"href":"how-to-configure-mcp-firewall","toc_title":"Configure MCP firewall (Preview)"},{"href":"how-to-secure-web-ai-gateway-agents","toc_title":"Secure Web and AI Gateway for Microsoft Copilot Studio agents"}],"toc_title":"Internet Access"},{"children":[{"href":"how-to-configure-explicit-forward-proxy","toc_title":"Configure Explicit Forward Proxy"},{"href":"how-to-configure-conditional-access-policy-for-explicit-forward-proxy","toc_title":"Configure a Conditional Access policy for Explicit Forward Proxy"},{"href":"how-to-configure-explicit-forward-proxy-headers","toc_title":"Configure HTTP header session management"},{"href":"how-to-configure-explicit-forward-proxy-intune-policy","toc_title":"Configure Explicit Forward Proxy for Microsoft Edge with Intune mobile application management"},{"href":"how-to-custom-proxy-file-hosting","toc_title":"Configure custom proxy automatic configuration file hosting"}],"toc_title":"Explicit Forward Proxy"},{"children":[{"href":"concept-global-secure-access-logs-monitoring","toc_title":"Understand logs and monitoring"},{"href":"how-to-access-audit-logs","toc_title":"Global Secure Access audit logs"},{"href":"how-to-view-enriched-logs","toc_title":"Enriched Microsoft 365 audit logs"},{"href":"how-to-remote-network-health-logs","toc_title":"Remote network health logs"},{"href":"how-to-view-traffic-logs","toc_title":"Traffic logs"},{"href":"how-to-view-generative-ai-insights-logs","toc_title":"Generative AI Insights logs (preview)"},{"href":"how-to-view-model-context-protocol-logging","toc_title":"MCP traffic logs"},{"href":"how-to-view-deployment-logs","toc_title":"Deployment logs"},{"href":"reference-event-enrichment-logs","toc_title":"Event enrichment in Microsoft 365 enriched logs"},{"href":"how-to-use-workbooks","toc_title":"Use workbooks"},{"href":"how-to-export-connector-logs","toc_title":"Export private network connector logs"},{"href":"how-to-sentinel-integration","toc_title":"Microsoft Sentinel integration"},{"href":"concept-alerts","toc_title":"Global Secure Access alerts"}],"toc_title":"Logs and monitoring"},{"children":[{"href":"../architecture/gsa-deployment-guide-intro?toc=/entra/global-secure-access/toc.json\u0026bc=/entra/global-secure-access/breadcrumb/toc.json","toc_title":"Introduction"},{"href":"../architecture/gsa-deployment-guide-private-access?toc=/entra/global-secure-access/toc.json\u0026bc=/entra/global-secure-access/breadcrumb/toc.json","toc_title":"Deploy for Microsoft Entra Private Access"},{"href":"../architecture/gsa-deployment-guide-internet-access?toc=/entra/global-secure-access/toc.json\u0026bc=/entra/global-secure-access/breadcrumb/toc.json","toc_title":"Deploy for Microsoft Entra Internet Access"},{"href":"../architecture/gsa-deployment-guide-microsoft-traffic?toc=/entra/global-secure-access/toc.json\u0026bc=/entra/global-secure-access/breadcrumb/toc.json","toc_title":"Deploy for Microsoft traffic"},{"href":"../architecture/gsa-poc-guidance-intro?toc=/entra/global-secure-access/toc.json\u0026bc=/entra/global-secure-access/breadcrumb/toc.json","toc_title":"Proof-of-concept guidance"}],"toc_title":"Deployment guides"},{"children":[{"children":[{"href":"troubleshoot-global-secure-access-client-advanced-diagnostics","toc_title":"Troubleshoot the Windows client: Advanced diagnostics"},{"href":"troubleshoot-global-secure-access-client-diagnostics-health-check","toc_title":"Troubleshoot the Windows client: Health check tab"},{"href":"troubleshoot-global-secure-access-client-disabled","toc_title":"Troubleshoot the Windows client: Disabled by your organization"},{"href":"troubleshoot-global-secure-access-client-macos-health-check","toc_title":"Troubleshoot the macOS client: Health check tab"},{"href":"troubleshoot-global-secure-access-mobile-client-health-check-utility","toc_title":"Troubleshoot the Global Secure Access mobile client: Health check utility"},{"href":"troubleshoot-global-secure-access-mobile-client-advanced-diagnostics","toc_title":"Troubleshoot the Global Secure Access mobile client: Advanced diagnostics"}],"toc_title":"Troubleshoot the Global Secure Access client"},{"href":"troubleshoot-connectors","toc_title":"Troubleshoot connectors"},{"href":"troubleshoot-prompt-injection-protection","toc_title":"Troubleshoot prompt injection protection"},{"href":"troubleshoot-app-access","toc_title":"Troubleshoot application access"},{"href":"troubleshoot-distributed-file-system","toc_title":"Troubleshoot Distributed File System (DFS) issues"},{"href":"troubleshoot-transport-layer-security","toc_title":"Troubleshoot Transport Layer Security (TLS) inspection issues"}],"toc_title":"Troubleshoot"},{"children":[{"href":"partner-ecosystems-overview","toc_title":"Partner ecosystem overview"},{"children":[{"href":"concept-netskope-integration","toc_title":"Integration with Netskope"},{"href":"how-to-full-data-loss-protection","toc_title":"Create a custom Data Loss Prevention (DLP) profile"}],"toc_title":"Partner integrations"},{"children":[{"href":"how-to-cisco-coexistence","toc_title":"Coexistence with Cisco Umbrella"},{"href":"how-to-cisco-secure-access-coexistence","toc_title":"Coexistence with Cisco Secure Access"},{"href":"how-to-cisco-vpn-coexistence","toc_title":"Coexistence with Cisco VPNs"},{"href":"how-to-palo-alto-coexistence","toc_title":"Coexistence with Palo Alto Networks"},{"href":"how-to-zscaler-coexistence","toc_title":"Coexistence with Zscaler"},{"href":"how-to-netskope-coexistence","toc_title":"Coexistence with Netskope"}],"toc_title":"Coexistence with partners"},{"href":"how-to-find-microsoft-services-partners","toc_title":"Find a Microsoft services partner"}],"toc_title":"Partner ecosystem"}],"expanded":true,"toc_title":"How-to guides"},{"children":[{"href":"reference-remote-network-configurations","toc_title":"Remote network valid configurations"},{"href":"reference-ip-addresses-advertised-by-remote-network-connectivity","toc_title":"IP addresses advertised over BGP by remote network connectivity"},{"href":"reference-current-known-limitations","toc_title":"Known limitations for Global Secure Access"},{"href":"reference-points-of-presence","toc_title":"Points of presence and service addresses"},{"href":"reference-egress-ip-ranges","toc_title":"Egress IP ranges"},{"href":"reference-data-storage-and-privacy","toc_title":"Data storage and privacy"},{"href":"reference-web-content-filtering-categories","toc_title":"Web content filtering categories"},{"href":"reference-threat-intelligence-threat-types","toc_title":"Threat intelligence threat types"},{"href":"reference-microsoft-defender-cloud-apps-coexistence","toc_title":"Microsoft Defender for Cloud Apps coexistence"},{"href":"/graph/api/resources/networkaccess-global-secure-access-api-overview","toc_title":"Microsoft Graph APIs"},{"href":"reference-ciphers","toc_title":"Ciphers for Microsoft Entra Private Access"},{"href":"resource-faq","toc_title":"Global Secure Access FAQs"},{"href":"reference-version-history","toc_title":"Connector version history"},{"href":"reference-private-access-sensor-release-history","toc_title":"Private Access Sensor version history"},{"href":"reference-windows-client-release-history","toc_title":"Windows client version history"},{"href":"reference-macos-client-release-history","toc_title":"macOS client version history"},{"href":"reference-global-secure-access-certifications","toc_title":"Global Secure Access certifications"},{"href":"reference-china-user-support","toc_title":"Global Secure Access in China"},{"href":"reference-licensing-guest-users","toc_title":"Licensing for guest users"}],"toc_title":"Reference"}],"metadata":{"author":"HULKsmashGithub","brand":"entra","breadcrumb_path":"/entra/breadcrumb/toc.json","count_of_node_with_href":200,"extendBreadcrumb":false,"feedback_github_repo":"MicrosoftDocs/entra-docs","feedback_product_url":"https://feedback.azure.com/d365community/forum/79b1327d-d925-ec11-b6e6-000d3a4f06a4","feedback_system":"Standard","manager":"dougeby","ms.author":"jayrusso","ms.service":"global-secure-access","open_to_public_contributors":true,"searchScope":["Microsoft Entra"],"titleSuffix":"Global Secure Access","uhfHeaderId":"MSDocsHeader-Entra"}}