ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 22:55 UTC Customize Public modeDiscuss ChangeIntel on Discord

Coexistence with Cisco Secure Access

This page's changes and edits · All guidance changes

Microsoft's edit ·

Fixes blocking issues from pre-review.

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 2b9c53f · +66 −66 lines · also on GitHub

⋯ 4 unchanged lines
55 ms.author: kenwith
66 manager: dougeby
77 ms.topic: conceptual
8 −ms.date: 08/26/2025
8 +ms.date: 10/03/2025
99 ms.service: global-secure-access
1010 ms.subservice: entra-private-access
1111 ms.reviewer: shkhalid
⋯ 150 unchanged lines
162162
163163 ### 1. Microsoft Entra Private Access with Cisco Secure Internet Access
164164
165 −#### Steps
166165
167166
167 +
168168 **Global Secure Access configuration**
169169
170 −- Enable Private Access forwarding profile.
171 −- Install a private network connector.
172 −- Configure Quick Access and private DNS.
173 −- Install and configure the Global Secure Access client for Windows or macOS.
170 +1. Enable Private Access forwarding profile.
171 +1. Install a private network connector.
172 +1. Configure Quick Access and private DNS.
173 +1. Install and configure the Global Secure Access client for Windows or macOS.
174174
175175 **Cisco Secure Access configuration**
176176
177 −- Configure required destinations to bypass Internet Security. For instructions, see [Bypass Global Secure Access IP's and FQDN's in Cisco Secure Access / Umbrella](#bypass-global-secure-access-ips-and-fqdns-in-cisco-secure-accessumbrella) and select the tab for **Cisco Secure Access portal** or **Umbrella portal**.
178 −- Deploy and configure Cisco Secure Client with Umbrella module.
177 +1. Configure required destinations to bypass Internet Security. For instructions, see [Bypass Global Secure Access IPs and FQDNs in Cisco Secure Access / Umbrella](#bypass-global-secure-access-ips-and-fqdns-in-cisco-secure-accessumbrella) and select the tab for **Cisco Secure Access portal** or **Umbrella portal**.
178 +1. Deploy and configure Cisco Secure Client with Umbrella module.
179179
180180 **Validation**
181 − - Ensure both clients are enabled and the Umbrella profile is `Active`.
182 − - To verify rules are applied and health checks pass, use Advanced Diagnostics in the Global Secure Access client.
183 − - Test traffic flow by accessing various sites and validating traffic logs in both platforms.
181 + 1. Ensure both clients are enabled and the Umbrella profile is `Active`.
182 + 1. To verify rules are applied and health checks pass, use Advanced Diagnostics in the Global Secure Access client.
183 + 1. Test traffic flow by accessing various sites and validating traffic logs in both platforms.
184184 1. In the system tray, right-click Global Secure Access Client > Advanced Diagnostics > Traffic tab > Start collecting.
185185 2. Access `bing.com`, `salesforce.com`, `outlook.office365.com` in browsers.
186186 3. Verify Global Secure Access client **isn't** capturing traffic for these sites.
⋯ 8 unchanged lines
195195 ### 2. Microsoft Entra Private Access with Cisco Secure Internet Access and Cisco Secure Private Access
196196
197197
198 −#### Steps
199198
199 +
200200 **Global Secure Access configuration**
201201
202 −- Enable Private Access forwarding profile.
203 −- Install a private network connector.
204 −- Configure Quick Access and private DNS.
205 −- Install and configure the Global Secure Access client for Windows or macOS.
202 +1. Enable Private Access forwarding profile.
203 +1. Install a private network connector.
204 +1. Configure Quick Access and private DNS.
205 +1. Install and configure the Global Secure Access client for Windows or macOS.
206206
207207 **Cisco Secure Access configuration**
208208
209 −- Configure required destinations to bypass Internet Security. For instructions, see [Bypass Global Secure Access IP's and FQDN's in Cisco Secure Access / Umbrella](#bypass-global-secure-access-ips-and-fqdns-in-cisco-secure-accessumbrella) and select the tab for **Cisco Secure Access portal** or **Umbrella portal**.
210 −- Deploy and configure Cisco Secure Client with Zero Trust Access and Umbrella modules.
211 −- Add private resources and create access policies.
209 +1. Configure required destinations to bypass Internet Security. For instructions, see [Bypass Global Secure Access IPs and FQDNs in Cisco Secure Access / Umbrella](#bypass-global-secure-access-ips-and-fqdns-in-cisco-secure-accessumbrella) and select the tab for **Cisco Secure Access portal** or **Umbrella portal**.
210 +1. Deploy and configure Cisco Secure Client with Zero Trust Access and Umbrella modules.
211 +1. Add private resources and create access policies.
212212
213213 **Validation**
214 − - Ensure both clients are enabled and the Umbrella profile is `Active`.
215 − - To verify rules are applied and health checks pass, use Advanced Diagnostics in the Global Secure Access client.
216 − - Test traffic flow by accessing various sites and validating traffic logs in both platforms.
217 − 1. In the system tray, right-click Global Secure Access Client > Advanced Diagnostics > Traffic tab > Start collecting.
218 − 2. Access `bing.com`, `salesforce.com`, `outlook.office365.com` in browsers.
219 − 3. Verify Global Secure Access client **isn't** capturing traffic for these sites.
220 − 4. In the Cisco Secure Access portal, validate traffic to these sites **is** captured.
221 − 5. Access private applications via Global Secure Access (for example, SMB file share).
222 − 6. Access private resources via Cisco Secure Private Access (for example, RDP session).
223 − 7. Validate the SMB file share traffic is captured in Global Secure Access logs and isn't shown in Cisco logs.
224 − 8. Validate the RDP traffic is captured in Cisco logs and isn't shown in Global Secure Access logs.
225 − 9. Stop collecting traffic and confirm correct traffic handling.
214 +1. Ensure both clients are enabled and the Umbrella profile is `Active`.
215 +1. To verify rules are applied and health checks pass, use Advanced Diagnostics in the Global Secure Access client.
216 +1. Test traffic flow by accessing various sites and validating traffic logs in both platforms.
217 + 1. In the system tray, right-click Global Secure Access Client > Advanced Diagnostics > Traffic tab > Start collecting.
218 + 2. Access `bing.com`, `salesforce.com`, `outlook.office365.com` in browsers.
219 + 3. Verify Global Secure Access client **isn't** capturing traffic for these sites.
220 + 4. In the Cisco Secure Access portal, validate traffic to these sites **is** captured.
221 + 5. Access private applications via Global Secure Access (for example, SMB file share).
222 + 6. Access private resources via Cisco Secure Private Access (for example, RDP session).
223 + 7. Validate the SMB file share traffic is captured in Global Secure Access logs and isn't shown in Cisco logs.
224 + 8. Validate the RDP traffic is captured in Cisco logs and isn't shown in Global Secure Access logs.
225 + 9. Stop collecting traffic and confirm correct traffic handling.
226226
227227 ---
228228
⋯ 1 unchanged line
230230 ### 3. Microsoft Entra Microsoft Access with Cisco Secure Internet Access and Cisco Secure Private Access
231231
232232
233 −#### Steps
234233
234 +
235235 **Global Secure Access configuration**
236236
237 −- Enable Microsoft Access forwarding profile.
238 −- Install and configure the Global Secure Access client for Windows or macOS.
237 +1. Enable Microsoft Access forwarding profile.
238 +1. Install and configure the Global Secure Access client for Windows or macOS.
239239
240240 **Cisco Secure Access configuration**
241241
242 −- Configure required destinations to bypass Internet Security, including other Microsoft IPs and FQDNs. For instructions, see [Bypass Global Secure Access IP's and FQDN's in Cisco Secure Access / Umbrella](#bypass-global-secure-access-ips-and-fqdns-in-cisco-secure-accessumbrella) and select the tab for **Cisco Secure Access portal** or **Umbrella portal**.
243 −- Deploy and configure Cisco Secure Client with Zero Trust Access and Umbrella modules.
244 −- Add private resources and access policies.
242 +1. Configure required destinations to bypass Internet Security, including other Microsoft IPs and FQDNs. For instructions, see [Bypass Global Secure Access IPs and FQDNs in Cisco Secure Access / Umbrella](#bypass-global-secure-access-ips-and-fqdns-in-cisco-secure-accessumbrella) and select the tab for **Cisco Secure Access portal** or **Umbrella portal**.
243 +1. Deploy and configure Cisco Secure Client with Zero Trust Access and Umbrella modules.
244 +1. Add private resources and access policies.
245245
246246 **Validation**
247 − - Ensure both clients are enabled and the Umbrella profile is `Active`.
248 − - To verify rules are applied and health checks pass, use Advanced Diagnostics in the Global Secure Access client.
249 − - Test traffic flow by accessing various sites and validating traffic logs in both platforms.
250 − 1. Start collecting traffic in Global Secure Access client.
251 − 2. Access `bing.com`, `salesforce.com` in browsers.
252 − 3. Verify Global Secure Access client **isn't** capturing traffic for these sites.
253 − 4. In the Cisco Secure Access portal, validate traffic to these sites **is** captured.
254 − 5. Access `outlook.office365.com`, `<yourtenantdomain>.sharepoint.com`.
255 − 6. Validate Global Secure Access traffic logs show these sites; Cisco Secure Access doesn't.
256 − 7. Access private resources via Cisco Secure Private Access.
257 − 8. Validate traffic logs in both portals.
258 − 9. Stop collecting traffic and confirm Global Secure Access only captured Microsoft traffic.
247 +1. Ensure both clients are enabled and the Umbrella profile is `Active`.
248 +1. To verify rules are applied and health checks pass, use Advanced Diagnostics in the Global Secure Access client.
249 +1. Test traffic flow by accessing various sites and validating traffic logs in both platforms.
250 + 1. Start collecting traffic in Global Secure Access client.
251 + 2. Access `bing.com`, `salesforce.com` in browsers.
252 + 3. Verify Global Secure Access client **isn't** capturing traffic for these sites.
253 + 4. In the Cisco Secure Access portal, validate traffic to these sites **is** captured.
254 + 5. Access `outlook.office365.com`, `<yourtenantdomain>.sharepoint.com`.
255 + 6. Validate Global Secure Access traffic logs show these sites; Cisco Secure Access doesn't.
256 + 7. Access private resources via Cisco Secure Private Access.
257 + 8. Validate traffic logs in both portals.
258 + 9. Stop collecting traffic and confirm Global Secure Access only captured Microsoft traffic.
259259
260260 ---
261261
262262 ### 4. Microsoft Entra Internet Access and Microsoft Access with Cisco Secure Private Access
263263
264264
265 −#### Steps
266265
266 +
267267 **Global Secure Access configuration**
268268
269 −- Enable Internet Access and Microsoft Access forwarding profiles.
270 −- Install and configure the Global Secure Access client for Windows or macOS.
271 −- Add a custom bypass for Cisco Secure Access: `*.zpc.sse.cisco.com`.
269 +1. Enable Internet Access and Microsoft Access forwarding profiles.
270 +1. Install and configure the Global Secure Access client for Windows or macOS.
271 +1. Add a custom bypass for Cisco Secure Access: `*.zpc.sse.cisco.com`.
272272
273273
274274 **Cisco Secure Access configuration**
275275
276 −- Configure required destinations to bypass Internet Security, including other Microsoft IPs and FQDNs. For instructions, see [Bypass Global Secure Access IP's and FQDN's in Cisco Secure Access / Umbrella](#bypass-global-secure-access-ips-and-fqdns-in-cisco-secure-accessumbrella) and select the tab for **Cisco Secure Access portal** or **Umbrella portal**.
277 −- Deploy and configure Cisco Secure Client with Zero Trust Access module.
278 −- Add private resources and access policies.
276 +1. Configure required destinations to bypass Internet Security, including other Microsoft IPs and FQDNs. For instructions, see [Bypass Global Secure Access IPs and FQDNs in Cisco Secure Access / Umbrella](#bypass-global-secure-access-ips-and-fqdns-in-cisco-secure-accessumbrella) and select the tab for **Cisco Secure Access portal** or **Umbrella portal**.
277 +1. Deploy and configure Cisco Secure Client with Zero Trust Access module.
278 +1. Add private resources and access policies.
279279
280280 > [!NOTE]
281281 > For this scenario, Cisco Secure Access only handles private traffic. The Umbrella module is not installed.
282282
283283 **Validation**
284 − - Ensure both clients are enabled.
285 − - To verify rules are applied and health checks pass, use Advanced Diagnostics in the Global Secure Access client.
286 − - Test traffic flow by accessing various sites and validating traffic logs in both platforms.
287 − 1. Start collecting traffic in Global Secure Access client.
288 − 2. Access `bing.com`, `salesforce.com`, `outlook.office365.com`.
289 − 3. Verify Global Secure Access client captures traffic for these sites.
290 − 4. In the Cisco Secure Access portal, validate traffic to these sites **isn't** captured.
291 − 5. Access private resources via Cisco Secure Private Access.
292 − 6. Validate traffic logs in both portals.
293 − 7. Stop collecting traffic and confirm Global Secure Access **didn't** handle private application traffic.
284 +1. Ensure both clients are enabled.
285 +1. To verify rules are applied and health checks pass, use Advanced Diagnostics in the Global Secure Access client.
286 +1. Test traffic flow by accessing various sites and validating traffic logs in both platforms.
287 + 1. Start collecting traffic in Global Secure Access client.
288 + 2. Access `bing.com`, `salesforce.com`, `outlook.office365.com`.
289 + 3. Verify Global Secure Access client captures traffic for these sites.
290 + 4. In the Cisco Secure Access portal, validate traffic to these sites **isn't** captured.
291 + 5. Access private resources via Cisco Secure Private Access.
292 + 6. Validate traffic logs in both portals.
293 + 7. Stop collecting traffic and confirm Global Secure Access **didn't** handle private application traffic.
294294
295295
296296 ---
⋯ 6 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:50 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 22:55 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.