GSA coexistence with Cisco Umbrella
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 872a549 · +100 −4 lines · also on GitHub
⋯ 1 unchanged line
22
title: Security Service Edge (SSE) Coexistence With Microsoft and Cisco Umbrella
33
description: "Deploy Global Secure Access alongside Cisco Umbrella with DNS security. Includes step-by-step configuration for both platforms to support private access, Microsoft 365 traffic, and internet access."
44
ms.topic: how-to
5
−ms.date: 03/25/2026
5
+ms.date: 05/26/2026
66
ms.subservice: entra-private-access
77
ms.reviewer: shkhalid
88
ai-usage: ai-assisted
⋯ 62 unchanged lines
7171
1. In the Microsoft Entra admin center, go to **Global Secure Access > Connect > Traffic forwarding > Internet access profile**.
7272
2. Under **Internet access policies**, select **View**.
7373
3. Expand **Custom Bypass** and select **Add rule**.
74
−4. Enter the following IPs: `208.67.222.222, 208.67.220.220, 67.215.64.0/19, 146.112.0.0/16, 155.190.0.0/16, 185.60.84.0/22, 204.194.232.0/21, 208.67.216.0/21, 208.69.32.0/21`
74
+4. Enter the following IPs:
75
+
76
+ ```text
77
+ 208.67.222.222
78
+ 208.67.220.220
79
+ 67.215.64.0/19
80
+ 146.112.0.0/16
81
+ 155.190.0.0/16
82
+ 185.60.84.0/22
83
+ 204.194.232.0/21
84
+ 208.67.216.0/21
85
+ 208.69.32.0/21
86
+ ```
7587
5. Select **Save**.
7688
7789
### Bypass Global Secure Access IPs and FQDNs in Umbrella/Cisco Secure Access
⋯ 4 unchanged lines
8294
> [!NOTE]
8395
> Cisco Umbrella supports implied wildcards, so you can use `globalsecureaccess.microsoft.com`.
8496
2. Add these Microsoft FQDNs (only required if Microsoft traffic forwarding profile is enabled):
85
− `auth.microsoft.com, msftidentity.com, msidentity.com, onmicrosoft.com, outlook.com, protection.outlook.com, sharepoint.com, sharepointonline.com, svc.ms, wns.windows.com, account.activedirectory.windowsazure.com, accounts.accesscontrol.windows.net, admin.onedrive.com, adminwebservice.microsoftonline.com, api.passwordreset.microsoftonline.com, autologon.microsoftazuread-sso.com, becws.microsoftonline.com, ccs.login.microsoftonline.com, clientconfig.microsoftonline-p.net, companymanager.microsoftonline.com, device.login.microsoftonline.com, g.live.com, graph.microsoft.com, graph.windows.net, login-us.microsoftonline.com, login.microsoft.com, login.microsoftonline-p.com, login.microsoftonline.com, login.windows.net, logincert.microsoftonline.com, loginex.microsoftonline.com, nexus.microsoftonline-p.com, officeclient.microsoft.com, oneclient.sfx.ms, outlook.cloud.microsoft, outlook.office.com, outlook.office365.com, passwordreset.microsoftonline.com, provisioningapi.microsoftonline.com, spoprod-a.akamaihd.net`
97
+
98
+ ```text
99
+ auth.microsoft.com
100
+ msftidentity.com
101
+ msidentity.com
102
+ onmicrosoft.com
103
+ outlook.com
104
+ protection.outlook.com
105
+ sharepoint.com
106
+ sharepointonline.com
107
+ svc.ms
108
+ wns.windows.com
109
+ account.activedirectory.windowsazure.com
110
+ accounts.accesscontrol.windows.net
111
+ admin.onedrive.com
112
+ adminwebservice.microsoftonline.com
113
+ api.passwordreset.microsoftonline.com
114
+ autologon.microsoftazuread-sso.com
115
+ becws.microsoftonline.com
116
+ ccs.login.microsoftonline.com
117
+ clientconfig.microsoftonline-p.net
118
+ companymanager.microsoftonline.com
119
+ device.login.microsoftonline.com
120
+ g.live.com
121
+ graph.microsoft.com
122
+ graph.windows.net
123
+ login-us.microsoftonline.com
124
+ login.microsoft.com
125
+ login.microsoftonline-p.com
126
+ login.microsoftonline.com
127
+ login.windows.net
128
+ logincert.microsoftonline.com
129
+ loginex.microsoftonline.com
130
+ nexus.microsoftonline-p.com
131
+ officeclient.microsoft.com
132
+ oneclient.sfx.ms
133
+ outlook.cloud.microsoft
134
+ outlook.office.com
135
+ outlook.office365.com
136
+ passwordreset.microsoftonline.com
137
+ provisioningapi.microsoftonline.com
138
+ spoprod-a.akamaihd.net
139
+ ```
86140
3. Add the Quick Access FQDN (only required if you use Private Access with Quick Access). `<quickaccessapplicationid>.globalsecureaccess.local`
87141
> [!NOTE]
88142
> Replace `<quickaccessapplicationid>` with the application ID of your Quick Access app.
⋯ 7 unchanged lines
96150
> [!NOTE]
97151
> Cisco Secure Access has an implied wildcard, so you can use `globalsecureaccess.microsoft.com`.
98152
3. Add these Microsoft FQDNs (only required if Microsoft traffic forwarding profile is enabled):
99
− `auth.microsoft.com, msftidentity.com, msidentity.com, onmicrosoft.com, outlook.com, protection.outlook.com, sharepoint.com, sharepointonline.com, svc.ms, wns.windows.com, account.activedirectory.windowsazure.com, accounts.accesscontrol.windows.net, admin.onedrive.com, adminwebservice.microsoftonline.com, api.passwordreset.microsoftonline.com, autologon.microsoftazuread-sso.com, becws.microsoftonline.com, ccs.login.microsoftonline.com, clientconfig.microsoftonline-p.net, companymanager.microsoftonline.com, device.login.microsoftonline.com, g.live.com, graph.microsoft.com, graph.windows.net, login-us.microsoftonline.com, login.microsoft.com, login.microsoftonline-p.com, login.microsoftonline.com, login.windows.net, logincert.microsoftonline.com, loginex.microsoftonline.com, nexus.microsoftonline-p.com, officeclient.microsoft.com, oneclient.sfx.ms, outlook.cloud.microsoft, outlook.office.com, outlook.office365.com, passwordreset.microsoftonline.com, provisioningapi.microsoftonline.com, spoprod-a.akamaihd.net`
153
+
154
+ ```text
155
+ auth.microsoft.com
156
+ msftidentity.com
157
+ msidentity.com
158
+ onmicrosoft.com
159
+ outlook.com
160
+ protection.outlook.com
161
+ sharepoint.com
162
+ sharepointonline.com
163
+ svc.ms
164
+ wns.windows.com
165
+ account.activedirectory.windowsazure.com
166
+ accounts.accesscontrol.windows.net
167
+ admin.onedrive.com
168
+ adminwebservice.microsoftonline.com
169
+ api.passwordreset.microsoftonline.com
170
+ autologon.microsoftazuread-sso.com
171
+ becws.microsoftonline.com
172
+ ccs.login.microsoftonline.com
173
+ clientconfig.microsoftonline-p.net
174
+ companymanager.microsoftonline.com
175
+ device.login.microsoftonline.com
176
+ g.live.com
177
+ graph.microsoft.com
178
+ graph.windows.net
179
+ login-us.microsoftonline.com
180
+ login.microsoft.com
181
+ login.microsoftonline-p.com
182
+ login.microsoftonline.com
183
+ login.windows.net
184
+ logincert.microsoftonline.com
185
+ loginex.microsoftonline.com
186
+ nexus.microsoftonline-p.com
187
+ officeclient.microsoft.com
188
+ oneclient.sfx.ms
189
+ outlook.cloud.microsoft
190
+ outlook.office.com
191
+ outlook.office365.com
192
+ passwordreset.microsoftonline.com
193
+ provisioningapi.microsoftonline.com
194
+ spoprod-a.akamaihd.net
195
+ ```
100196
4. Add the Quick Access FQDN (only required if you use Private Access with Quick Access). `<quickaccessapplicationid>.globalsecureaccess.local`
101197
> [!NOTE]
102198
> Replace `<quickaccessapplicationid>` with the application ID of your Quick Access app.
⋯ 62 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:32 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.