Create a Private Access traffic forwarding profile
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 3938e78 · +88 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: Create a Microsoft Entra Private Access traffic forwarding profile
3
+description: Learn how to create and configure a custom Private Access traffic forwarding profile in Global Secure Access.
4
+ms.topic: how-to
5
+ms.date: 09/20/2026
6
+ms.subservice: entra-private-access
7
+ms.reviewer: katabish
8
+ai-usage: ai-assisted
9
+---
10
+
11
+# Create a Private Access traffic forwarding profile
12
+
13
+Global Secure Access includes a default traffic forwarding profile for each traffic type. You can create custom Private Access traffic forwarding profiles to:
14
+
15
+- Provide different sets of private applications to different users or devices.
16
+- Use separate profiles for desktop and mobile device platforms.
17
+- Roll out Private Access to selected users, groups, or devices.
18
+- Control which profile takes precedence when more than one profile applies.
19
+
20
+> [!NOTE]
21
+> Creating custom traffic forwarding profiles is currently in preview. This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here. For more information, see the [Microsoft Entra preview terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
22
+>
23
+> During preview, you can create up to 10 custom Private Access traffic forwarding profiles.
24
+
25
+## Prerequisites
26
+
27
+To create a Private Access traffic forwarding profile, you must have:
28
+
29
+- A [Global Secure Access Administrator](../identity/role-based-access-control/permissions-reference.md#global-secure-access-administrator) role in Microsoft Entra ID.
30
+- An [Application Administrator](../identity/role-based-access-control/permissions-reference.md#application-administrator) role to manage Private Access applications.
31
+- A Microsoft Entra Private Access or Microsoft Entra Suite license. For more information, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md).
32
+- A tenant onboarded to Global Secure Access.
33
+- The latest Global Secure Access client installed on applicable end-user devices.
34
+
35
+## Create a profile
36
+
37
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a Global Secure Access Administrator.
38
+1. Browse to **Global Secure Access** > **Connect** > **Traffic forwarding**.
39
+1. Select **Create new traffic forwarding profile**, and then select **Private access profile**.
40
+
41
+ 
42
+
43
+1. Enter the profile settings:
44
+
45
+ - **Profile name**: Enter a unique, descriptive name.
46
+ - **Description**: Describe the users, devices, or applications intended for the profile.
47
+ - **Priority**: Enter a value from 101 through 199. If multiple Private Access profiles apply to the same user and device, only the applicable profile with the highest priority is used.
48
+ - **Status**: Select **Enabled** to make the profile available after you configure its acquisition rules and assignments.
49
+
50
+1. Select **Next**, review the settings, and then select **Create**.
51
+
52
+The new profile is created without application acquisition rules or assignments. Configure both before using the profile.
53
+
54
+## Configure acquisition rules
55
+
56
+1. From **Global Secure Access** > **Connect** > **Traffic forwarding**, select the custom profile.
57
+1. Select **Acquisition rules**.
58
+1. Configure **Quick Access** to include or exclude Quick Access destinations.
59
+1. Select the applications link, such as **0 Applications selected**.
60
+1. Select the Private Access applications to include, and then select **Select**.
61
+
62
+ 
63
+
64
+Use **Select all** if most applications should be included, and then remove the applications that you want to exclude.
65
+
66
+## Attach an application from its properties
67
+
68
+You can also associate a Private Access application with one or more profiles from the application:
69
+
70
+1. Browse to **Global Secure Access** > **Applications** > **Enterprise applications**.
71
+1. Select the Private Access application.
72
+1. Select **Network access properties**.
73
+1. Select **Manage attached profiles**.
74
+1. Select one or more traffic forwarding profiles, and then select **Save**.
75
+
76
+ 
77
+
78
+## Configure assignments
79
+
80
+After you select the applications for the profile, assign the profile to the intended users, groups, devices, and device platforms. Assignment conditions are evaluated together, and profile priority resolves cases where multiple profiles apply.
81
+
82
+For detailed steps, see [Assign users and devices to traffic forwarding profiles](how-to-manage-users-groups-assignment.md).
83
+
84
+## Next steps
85
+
86
+- [Manage Private Access traffic forwarding profiles](how-to-manage-private-access-profile.md)
87
+- [Delete a Private Access traffic forwarding profile](how-to-delete-traffic-forwarding-profile.md)
88
+- [Assign users and devices to traffic forwarding profiles](how-to-manage-users-groups-assignment.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 17:01 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.