Assign users and devices to traffic forwarding profiles
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 3938e78 · +64 −74 lines · also on GitHub
11
---
2
−title: Assign users and groups to traffic forwarding profiles
3
−description: "Control which users and groups receive traffic forwarding policies, enabling gradual rollout and limiting scope during testing or deployment phases."
2
+title: Assign users and devices to traffic forwarding profiles
3
+description: Assign users, groups, devices, and device platforms to Global Secure Access traffic forwarding profiles.
44
ms.topic: how-to
5
−ms.date: 05/26/2026
5
+ms.date: 09/20/2026
66
ai-usage: ai-assisted
77
---
8
−# How to assign users and groups to traffic forwarding profiles
8
+# Assign users and devices to traffic forwarding profiles
99
1010
## Overview
1111
12
−With the Global Secure Access traffic forwarding features, you can assign specific users and groups to a traffic forwarding profile. User or group assignment limits the scope of the traffic forwarding profile so you have a mechanism to roll out the profile safely and at a controlled pace.
12
+You can assign specific users, groups, devices, and device platforms to a Global Secure Access traffic forwarding profile. Assignments let you deploy a profile gradually and provide different traffic acquisition rules to different users and devices.
1313
14
−This article describes how to assign specific users and groups to a traffic forwarding profile.
14
+This article explains assignments for traffic forwarding profiles, including custom Private Access profiles.
1515
1616
## Prerequisites
1717
18
−To assign a traffic forwarding profile to specific users and groups, you must have:
19
−
20
−- A [Global Secure Access Administrator](../identity/role-based-access-control/permissions-reference.md#global-secure-access-administrator) role in Microsoft Entra ID to view the traffic forwarding profile.
21
−- An [Application Administrator](../identity/role-based-access-control/permissions-reference.md#application-administrator) role to assign the traffic profile to the selected users and groups.
22
−- The product requires licensing. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
23
−- The minimum required Global Secure Access client version is 1.7.376.0. Clients below this version won't receive the traffic forwarding profile when assigned to the user.
18
+To manage assignments, you must have:
2419
25
−## Assign a traffic forwarding profile to specific users and groups
20
+- A [Global Secure Access Administrator](../identity/role-based-access-control/permissions-reference.md#global-secure-access-administrator) role in Microsoft Entra ID to view and manage the traffic forwarding profile.
21
+- The required Global Secure Access product licenses. For details, see [What is Global Secure Access](overview-what-is-global-secure-access.md).
22
+- The latest supported Global Secure Access client on applicable devices. The minimum client version for user and group assignment is 1.7.376.0.
2623
27
−If you already enabled a traffic forwarding profile, the traffic profile is assigned to all users by default. If you haven't yet enabled a traffic forwarding profile, when you enable it the traffic is assigned to zero users. The **User and group assignments** setting lets you roll out the feature in a controlled manner to a specific set of users.
24
+## How assignments are evaluated
2825
29
−The screenshot illustrates the setting. The Microsoft profile is disabled and is assigned to zero users and groups. The Private Access and Internet Access profiles are enabled and are assigned to all users.
26
+A traffic forwarding profile has two assignment conditions:
3027
31
−:::image type="content" source="media/how-to-manage-users-groups-assignment/traffic-profile-user-assignment-comparison.png" alt-text="Screenshot of the traffic forwarding page with user assignments highlighted." lightbox="media/how-to-manage-users-groups-assignment/traffic-profile-user-assignment-comparison-expanded.png":::
28
+- **User and device assignments** determine which users, groups, or individual devices are in scope.
29
+- **Device platform assignments** determine which device platforms are in scope.
3230
33
−You can configure the user and group assignments before or after enabling the traffic profile. You must enable the traffic profile to acquire and forward any traffic. For more information, see [About traffic forwarding profiles](concept-traffic-forwarding.md).
31
+The conditions are evaluated with an `AND`. A device receives a profile only when it matches both conditions.
3432
35
−### Assign users and groups to a traffic profile
33
+If multiple enabled profiles for the same traffic type apply to a user and device, only the applicable profile with the highest priority is used.
3634
37
−1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Secure Access Administrator](../identity/role-based-access-control/permissions-reference.md#global-secure-access-administrator) AND [Application Administrator](../identity/role-based-access-control/permissions-reference.md#application-administrator).
35
+## Assign users, groups, and devices
3836
37
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a Global Secure Access Administrator and Application Administrator.
3938
1. Browse to **Global Secure Access** > **Connect** > **Traffic forwarding**.
40
−
41
−1. Select the **View** link in the **User and group assignments** section.
42
−
43
− 
44
−
45
−1. Select the **0 Users, 0 Groups assigned** link.
46
−
47
− 
48
−
49
−1. Select **Add user/group**.
50
−
51
− 
52
−
53
−1. Select the **None selected** link, select the users and/or groups from the list, and select the **Select** button.
54
− - The **All** list groups users and groups together. Select either the **Users** or **Groups** tab to narrow the list.
55
− - You can also use the Search box to find the user or group directly.
56
−
57
− 
58
−
59
−1. Select the **Assign** button.
60
−
61
−### Change existing user and group assignments
62
−
63
−The process to change the user and group assignments for a traffic profile that's already enabled is very similar except for the following steps.
64
−
65
−1. When you select the **View** link in the **User and group assignments** section, you need to change the **Assign to all users** setting to **No.**
66
−
67
− 
68
−
69
−1. Review the confirmation message, and select the **OK** button.
70
−
71
− 
39
+1. Select the traffic forwarding profile.
40
+1. Select **Assignments**.
41
+1. Next to **User and device assignments**, select **View**.
42
+1. Select one of the following options:
7243
73
−1. Continue with the steps in the previous section.
44
+ - **No users and devices**: The profile isn't assigned through the Global Secure Access client.
45
+ - **All users and devices**: All devices with the Global Secure Access client are in scope, subject to the device-platform assignment.
46
+ - **Selected users and devices**: Select specific users, groups, or devices.
7447
75
−### Automatic assignment through user attributes
48
+ 
7649
77
−You can create and assign a dynamic group of users to the profile who satisfy specific criteria. For more information about automatic assignment using user attributes, see [Create or update a dynamic group in Microsoft Entra ID](../identity/users/groups-create-rule.md).
50
+1. If you selected **Selected users and devices**, select the assignment link, choose the users, groups, and devices, and then select **Select**.
51
+1. Select **Save**.
7852
79
−## Assign the traffic profile to all users
53
+## Assign device platforms
8054
81
−Once you assign a traffic forwarding profile to a specific user or group, you can quickly change the setting to scope the traffic profile to all users. If you change it back again to a specific group, any users and groups initially assigned to that traffic forwarding profile are retained so you don't need to add them again.
55
+1. From the profile's **Assignments** page, select **View** next to **Device platform assignments**.
56
+1. Select the device platforms that should receive the profile.
57
+1. Select **Save**.
8258
83
−1. Browse to **Global Secure Access** > **Connect** > **Traffic forwarding**.
59
+You can combine platform assignment with user and device assignment. For example:
8460
85
−1. Select the **View** link in the **user and group assignments** section.
61
+- Assign **All users and devices** and select **iOS** to apply the profile to all iOS devices with the Global Secure Access client.
62
+- Assign a user group and select **Windows** and **macOS** to apply the profile only to desktop devices used by members of that group.
8663
87
−1. Change the **Assign to all users** toggle to **Yes**, review the confirmation message, and select the **OK** button.
64
+## Assignment evaluation examples
8865
89
− 
66
+| User and device assignments | Device platform assignments | Result |
67
+| --- | --- | --- |
68
+| All users and devices | All device platforms | All devices with the Global Secure Access client receive the profile. |
69
+| All users and devices | Windows and macOS | All Windows and macOS devices with the client receive the profile. |
70
+| All users and devices | None | No devices receive the profile. |
71
+| Five users and two devices | All device platforms | All client devices used by the five users and the two selected devices receive the profile. |
72
+| Five users and two devices | Android | Android client devices used by the five users and the selected devices receive the profile only if those devices are Android devices. |
73
+| No users, groups, or devices | Any platform | No devices receive the profile. |
9074
91
−1. Select the **Done** button.
75
+## Assign a profile to all devices on a platform
9276
93
−### Revert all users assignment back to a specific user or group
77
+To assign a profile to all devices on a specific platform:
9478
95
−You can revert the assignment of all users to a traffic profile. When you toggle off the assignment for all users, you revert to the users and groups that were assigned when you toggled it on.
79
+1. Set **User and device assignments** to **All users and devices**.
80
+1. Under **Device platform assignments**, select only the target platform.
81
+1. Save both assignment settings.
9682
97
−1. Browse to **Global Secure Access** > **Connect** > **Traffic forwarding**.
83
+## Automatic assignment through user attributes
9884
99
−1. Select the **View** link in the **user and group assignments** section.
85
+You can assign a dynamic group whose members satisfy specific user criteria. For more information, see [Create or update a dynamic group in Microsoft Entra ID](../identity/users/groups-create-rule.md).
10086
101
−1. Change the **Assign to all users** toggle to **No**, review the confirmation message, and select the **OK** button.
87
+## Validate the effective profile
10288
103
−1. Select **Done**.
89
+1. Sign in to a registered device as a user included in the assignment.
90
+1. Right-click the Global Secure Access client, and then select **Advanced diagnostics** > **Forwarding profile**.
91
+1. Expand the applicable traffic type, such as **Private Access rules**.
92
+1. Confirm that the expected application segments appear.
10493
105
−## Notes on user identity and group assignment
94
+If more than one profile could apply, confirm that the profile with the highest priority is effective.
10695
107
−Review the following notes to better understand the user and group assignment capabilities.
96
+## Notes about identity, groups, and devices
10897
109
−- Traffic profiles are fetched on behalf of the Microsoft Entra user logged into the device, not the user logged into the client.
110
−- If there's no Microsoft Entra user logged in, the traffic profile is fetched only if it's assigned to all users. For example, if you log into the device as a local admin you're part of the all users.
111
−- Multiple users logging into the same device simultaneously isn't supported.
112
−- Group-based assignment is supported for Security groups and Microsoft 365 groups whose `SecurityEnabled` setting is set to `True`.
113
−- Nested group memberships aren't supported. A user must be a direct member of the group assigned to the profile.
98
+- Traffic profiles are fetched for the Microsoft Entra user signed in to the device, not the user signed in to the client.
99
+- If no Microsoft Entra user is signed in, a profile is fetched only when **All users and devices** is selected.
100
+- Multiple users signed in to the same device simultaneously aren't supported.
101
+- Group assignment supports security groups and nested group membership is supported.
114102
115103
## Next steps
116104
105
+- [Create a Private Access traffic forwarding profile](how-to-create-traffic-forwarding-profile.md)
106
+- [Manage Private Access traffic forwarding profiles](how-to-manage-private-access-profile.md)
117107
- [Learn about Global Secure Access clients](concept-clients.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:06 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.