GSA coexistence with Netskope
Any two versions this installation kept of the page, compared the same way as each observed change. All guidance changes · Latest observation
Global Secure Access · Official Microsoft guidance18 Oct 23:18 UTC → 24 Oct 00:08 UTC
What changed across 2 changes
33 new passages (about 590 words). The changed wording mentions network endpoints. Review the source to confirm the effect.
May need admin actionCheck your firewall and proxy allow lists.
[added: Microsoft Entra Private Access and Microsoft Entra Microsoft Access with Netskope Internet Access]
[added: In the fifth scenario, Global Secure Access handles private application and Microsoft 365 traffic. Netskope only captures internet traffic.]
[added: Note These IP addresses should match the Microsoft services whose traffic you want the Global Secure Access client to forward. Verify the addresses against the Microsoft traffic forwarding profile rules in the Microsoft Entra admin center.]
[added: In this scenario, Global Secure Access handles private application and Microsoft 365 traffic. Netskope only captures internet traffic.]
[added: Enable the Microsoft Entra Private Access forwarding profile and the Microsoft Entra Microsoft Access forwarding profile.]
[added: Configure the MSFT SSE Service and MSFT SSE M365 profiles, as described in Netskope Location Profiles, for use in the steering configuration.]
[added: Set up a Netskope steering configuration to steer web traffic.]
[added: Install the Netskope client for Windows or macOS.]
[added: Enter a Configuration Name, such as MSFTSSEWebTraffic.]
[added: Under Cloud, Web and Firewall, select Web Traffic.]
[added: Set Bypass exception traffic at to Client.]
[added: Under Private Apps, select None.]
[added: Under Borderless SD-WAN Apps, select None.]
[added: Select MSFT SSE Service and MSFT SSE M365.]
[added: Select Bypass, select the Treat it like local IP address checkbox, and then select Add.]
[added: Select New Exception > Domains and add these domain exceptions: *.globalsecureaccess.microsoft.com, *.auth.microsoft.com, *.msftidentity.com, *.msidentity.com, *.onmicrosoft.com, *.outlook.com, *.protection.outlook.com, *.sharepoint.com, *.sharepointonline.com, *.svc.ms, *.wns.windows.com, account.activedirectory.windowsazure.com, accounts.accesscontrol.windows.net, admin.onedrive.com, adminwebservice.microsoftonline.com, api.passwordreset.microsoftonline.com, autologon.microsoftazuread-sso.com, becws.microsoftonline.com, ccs.login.microsoftonline.com, clientconfig.microsoftonline-p.net, companymanager.microsoftonline.com, device.login.microsoftonline.com, g.live.com, graph.microsoft.com, graph.windows.net, login-us.microsoftonline.com, login.microsoft.com, login.microsoftonline-p.com, login.microsoftonline.com, login.windows.net, logincert.microsoftonline.com, loginex.microsoftonline.com, nexus.microsoftonline-p.com, officeclient.microsoft.com, oneclient.sfx.ms, outlook.cloud.microsoft, outlook.office.com, outlook.office365.com, passwordreset.microsoftonline.com, provisioningapi.microsoftonline.com, spoprod-a.akamaihd.net > Save.]
[added: Right-click Global Secure Access Client > Advanced Diagnostics > Forwarding Profile and verify that only Private Access and Microsoft 365 rules are applied to this client.]
[added: Navigate to Advanced Diagnostics > Health Check and verify that no checks fail.]
[added: Right-click Netskope Client > Configuration. Verify that Steering Configuration matches the name of the configuration you created. If not, select the Update link.Note To troubleshoot health check failures, see Troubleshoot the Global Secure Access client.]
[added: In a browser, access bing.com, salesforce.com, and yelp.com.]
Microsoft's wording from Microsoft source, © Microsoft Corporation, under MIT. ChangeIntel marks removed and added words, drops formatting and shortens long unchanged stretches.
Sections to inspect
- Overview
- Netskope Location Profiles
- Microsoft Entra Private Access and Microsoft Entra Microsoft Access with Netskope Internet Access
- Microsoft Entra Private Access and Microsoft Entra Microsoft Access configuration
- Netskope Internet Access configuration
- Add a steering configuration for internet access
- Verify configurations for clients
- Test traffic flow
Read the current Microsoft source
Compared across every change between the two versions, so an edit made and later undone does not show. Observation time is not publication time. Full source bodies are not published; as the page's license allows, only Microsoft's changed wording is shown.