Network security with Global Secure Access (GSA)

Global Secure Access (GSA) delivers a consistent, identity-driven network security foundation for Windows 365 for agents. Administrators configure traffic routing profiles in Microsoft Entra to direct internet traffic through GSA. These profiles define how traffic is segmented and secured, enabling organizations to apply unified network policies using familiar identity constructs such as Conditional Access. 

The GSA client can be deployed to Windows 365 for Agents Cloud PCs through Microsoft Intune. After the agent user signs in with its Microsoft Entra identity, the GSA client activates automatically on the device. This ensures that traffic routing and security controls are applied without requiring additional end-user setup, enabling a seamless and consistent experience across environments.

GSA monitors and enforces policy across all outbound traffic from the Cloud PC. The internet traffic flows through the internet access profile. This approach allows organizations to apply web content filtering, URL-based controls, and threat protection policies inline, helping to reduce exposure to malicious destinations and enforce acceptable use policies. 

In addition to traffic control, GSA provides visibility into network activity and helps protect against common risks such as data exfiltration and unsafe access patterns. By integrating traffic signals with identity and device context, GSA enables organizations to extend Zero Trust principles to network traffic for agent workloads, providing both protection and insights without adding operational complexity. 

Get started

1. Set up profiles in GSA for securing internet access for agents: This defines what traffic gets captured from the W365A device and routed to GSA for policy enforcement. Learn more: How to manage the Internet Access profile - Global Secure Access | Microsoft Learn.

2. Create filtering policies: These policies define what traffic is allowed or denied in the network

   • Configure web filtering: How to configure Global Secure Access web content filtering - Global Secure Access | Microsoft Learn 

   • Configure threat intel: How to configure Global Secure Access threat intelligence - Global Secure Access | Microsoft Learn 

   • Configure content filtering: Create content policies for network content filtering - Global Secure Access | Microsoft Learn

3. Install the GSA Client on the W365A device: This is to install the GSA client that lives on the machine and intercepts all agent user traffic for policy enforcement by GSA service: Install the Global Secure Access Client for Windows - Global Secure Access | Microsoft Learn