GSA coexistence with Netskope
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit efec0b4 · +54 −222 lines · also on GitHub
⋯ 3 unchanged lines
44
author: kenwith
55
contributors:
66
ms.topic: concept-article
7
−ms.date: 06/09/2025
7
+ms.date: 07/07/2025
88
ms.author: kenwith
99
ms.reviewer: shkhalid
1010
ai-usage: ai-assisted
1111
---
1212
13
−# Security Service Edge (SSE) Coexistence With Microsoft and Netskope
13
+# Security Service Edge (SSE) coexistence With Microsoft and Netskope
1414
1515
Learn about Security Service Edge (SSE) coexistence with Microsoft and Netskope
1616
⋯ 21 unchanged lines
3838
3939
To configure Microsoft and Netskope for a unified SASE solution, start by setting up Microsoft Entra Internet Access and Microsoft Entra Private Access. Next, configure Netskope Private Access and Internet Access. Finally, make sure to establish the required Fully Qualified Domain Name (FQDN) and IP bypasses to ensure smooth integration between the two platforms.
4040
41
−- Set up Microsoft Entra Internet Access and Microsoft Entra Private Access. These products make up the Global Secure Access solution.
42
−
43
−- Set up Netskope Private Access and Internet Access
44
−
45
−- Configure the Global Secure Access FQDN and IP bypasses
41
+1. Set up Microsoft Entra Internet Access and Microsoft Entra Private Access. These products make up the Global Secure Access solution.
42
+1. Set up Netskope Private Access and Internet Access
43
+1. Configure the Global Secure Access FQDN and IP bypasses
4644
4745
## Microsoft Global Secure Access
4846
4947
To set up Global Secure Access and test all scenarios in this documentation:
5048
51
−- Enable and disable different Microsoft Global Secure Access traffic forwarding profiles for your Microsoft Entra tenant. For more information about enabling and disabling profiles, see [Global Secure Access traffic forwarding profiles](/entra/global-secure-access/concept-traffic-forwarding).
52
−
53
−- Install and configure the Microsoft Entra private network connector. To learn how to install and configure the connector, see [How to configure connectors](/entra/global-secure-access/how-to-configure-connectors).
54
−
55
−> [!NOTE]
56
−> Private Network Connectors are required for Microsoft Entra Private Access applications.
57
−
58
−- Configure Quick Access to your private resources and set up Private Domain Name System (DNS) and DNS suffixes. To learn how to configure Quick Access, see [How to configure Quick Access](/entra/global-secure-access/how-to-configure-quick-access).
59
−
60
−- Install and configure the Global Secure Access client on end-user devices. For more information about clients, see [Global Secure Access clients](/entra/global-secure-access/concept-clients). To learn how to install the Windows client, see [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client). For macOS, see [Global Secure Access Client for macOS](/entra/global-secure-access/how-to-install-macos-client).
49
+1. Enable and disable different Microsoft Global Secure Access traffic forwarding profiles for your Microsoft Entra tenant. For more information about enabling and disabling profiles, see [Global Secure Access traffic forwarding profiles](/entra/global-secure-access/concept-traffic-forwarding).
50
+1. Install and configure the Microsoft Entra private network connector. To learn how to install and configure the connector, see [How to configure connectors](/entra/global-secure-access/how-to-configure-connectors).
51
+ > [!NOTE]
52
+ > Private Network Connectors are required for Microsoft Entra Private Access applications.
53
+1. Configure Quick Access to your private resources and set up Private Domain Name System (DNS) and DNS suffixes. To learn how to configure Quick Access, see [How to configure Quick Access](/entra/global-secure-access/how-to-configure-quick-access).
54
+1. Install and configure the Global Secure Access client on end-user devices. For more information about clients, see [Global Secure Access clients](/entra/global-secure-access/concept-clients). To learn how to install the Windows client, see [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client). For macOS, see [Global Secure Access Client for macOS](/entra/global-secure-access/how-to-install-macos-client).
6155
6256
## Netskope Private Access and Internet Access
6357
64
−- Configure Netskope Private Apps. To learn more about configuring Netskope Private Access, see [Netskope One Private Access](https://docs.netskope.com/en/netskope-private-access) documentation.
65
−
66
−- Configure Netskope Steering Configurations for Private and Internet Access. To learn more about configuring Netskope, see [Netskope Traffic Steering documentation](https://docs.netskope.com/en/creating-a-steering-configuration/). The steps for creating the required steering configurations for each scenario are listed.
67
−
68
−- Setup and configure Netskope Real-time Protection Policies to allow access to Private Apps. For more information, see [Netskope Real-time Protection Policy for Private Apps](https://docs.netskope.com/en/create-a-real-time-protection-policy-for-private-apps/).
69
−
70
−- Invite users to Netskope and send them an email containing links to the Netskope client install package. To invite users, navigate to the **Netskope portal** > **Settings** > **Security** **Cloud** **Platform** > **Users**.
58
+1. Configure Netskope Private Apps. To learn more about configuring Netskope Private Access, see [Netskope One Private Access](https://docs.netskope.com/en/netskope-private-access) documentation.
59
+1. Configure Netskope Steering Configurations for Private and Internet Access. To learn more about configuring Netskope, see [Netskope Traffic Steering documentation](https://docs.netskope.com/en/creating-a-steering-configuration/). The steps for creating the required steering configurations for each scenario are listed.
60
+1. Set up and configure Netskope Real-time Protection Policies to allow access to Private Apps. For more information, see [Netskope Real-time Protection Policy for Private Apps](https://docs.netskope.com/en/create-a-real-time-protection-policy-for-private-apps/).
61
+1. Invite users to Netskope and send them an email containing links to the Netskope client install package. To invite users, navigate to the **Netskope portal** > **Settings** > **Security** **Cloud** **Platform** > **Users**.
7162
7263
## Netskope Location Profiles
7364
⋯ 7 unchanged lines
8172
8273
Configure the `MSFT SSE M365` policy:
8374
84
−1. Repeat Steps 1 & 2 to Add Microsoft 365 IPs and save them as `MSFT SSE M365`:
75
+- Repeat Steps 1 & 2 to Add Microsoft 365 IPs and save them as `MSFT SSE M365`:
8576
`132.245.0.0/16`, `204.79.197.215/32`, `150.171.32.0/22`, `131.253.33.215/32`, `23.103.160.0/20`, `40.96.0.0/13`, `52.96.0.0/14`, `40.104.0.0/15`, `13.107.128.0/22`, `13.107.18.10/31`, `13.107.6.152/31`, `52.238.78.88/32`, `104.47.0.0/17`, `52.100.0.0/14`, `40.107.0.0/16`, `40.92.0.0/15`, `150.171.40.0/22`, `52.104.0.0/14`, `104.146.128.0/17`, `40.108.128.0/17`, `13.107.136.0/22`, `40.126.0.0/18`, `20.231.128.0/19`, `20.190.128.0/18`, `20.20.32.0/19`.
8677
8778
The `MSFT SSE Service` and `MSFT SSE M365` profiles are used in steering configurations.
⋯ 6 unchanged lines
9485
9586
For this scenario:
9687
97
−- [Enable Microsoft Entra Private Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-private-access-profile.md#enable-the-private-access-traffic-forwarding-profile).
98
−
99
−- Install a [Private Network Connector](/entra/global-secure-access/how-to-configure-connectors) for Microsoft Entra Private Access.
100
−
101
−- Configure [Quick Access and set up Private DNS](/entra/global-secure-access/how-to-configure-quick-access).
102
−
103
−- Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client) or [macOS](/entra/global-secure-access/how-to-install-macos-client).
88
+1. [Enable Microsoft Entra Private Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-private-access-profile.md#enable-the-private-access-traffic-forwarding-profile).
89
+1. Install a [Private Network Connector](/entra/global-secure-access/how-to-configure-connectors) for Microsoft Entra Private Access.
90
+1. Configure [Quick Access and set up Private DNS](/entra/global-secure-access/how-to-configure-quick-access).
91
+1. Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client) or [macOS](/entra/global-secure-access/how-to-install-macos-client).
10492
10593
### Netskope Internet Access configuration
10694
10795
Netskope portal configuration
10896
109
−- Set up and configure [Netskope Steering Configuration](https://docs.netskope.com/en/steering-configuration/) to steer Web Traffic.
110
−
111
−- Install the Netskope Client for [Windows](https://docs.netskope.com/en/netskope-client-for-windows), or [macOS](https://docs.netskope.com/en/netskope-client-for-macos).
97
+1. Set up and configure [Netskope Steering Configuration](https://docs.netskope.com/en/steering-configuration/) to steer Web Traffic.
98
+1. Install the Netskope Client for [Windows](https://docs.netskope.com/en/netskope-client-for-windows), or [macOS](https://docs.netskope.com/en/netskope-client-for-macos).
11299
113100
#### Add Steering Configuration for Internet Access
114101
115102
1. Navigate to **Netskope portal** > **Settings** > **Security Cloud Platform** > **Steering Configuration** > **New Configuration**.
116
−
117103
1. Add a Configuration Name such as `MSFTSSEWebTraffic`.
118
−
119104
1. Choose a **User Group** or **OU** to apply the configuration to.
120
−
121105
1. Under **Cloud, Web and Firewall** > **Web Traffic**
122
−
123106
1. **Bypass exception traffic at** > **Client**
124
−
125107
1. Under **Private Apps** > **None**.
126
−
127108
1. Under **Borderless SD-WAN Apps** > **None**.
128
−
129109
1. Set **Status** to **Disabled** and select **Save**.
130
−
131110
1. Select the `MSFTSSEWebTraffic` configuration > **Exceptions** > **New Exception** > **Destination Locations**.
132
−
133111
1. Select `MSFT SSE Service` (Instructions for creating this object are listed in the Netskope profiles section).
134
−
135112
1. The action is **Bypass** > check the box for **Treat it like local IP address** > **Add**.
136
−
137113
1. Select **New Exception** > **Domains** and add the Global Secure Access domain exception: \*.globalsecureaccess.microsoft.com > **Save**
138
−
139114
1. Ensure that the `MSFTSSEWebTraffic` configuration is at the top of the list of steering configurations in your tenant. Then enable the configuration.
140
−
141115
1. Go to the system tray to check that Global Secure Access and Netskope clients are enabled.
142116
143117
#### Verify configurations for clients
144118
145119
1. Right-click on **Global Secure Access Client** > **Advanced Diagnostics** > **Forwarding Profile** and verify that Private access and Private DNS rules are applied to this client.
146
−
147120
1. Navigate to **Advanced Diagnostics** > **Health Check** and ensure no checks are failing.
148
−
149121
1. Right-click on **Netskope Client** > **Configuration**. Verify **Steering Configuration** matches the name of the configuration. If not, select the **Update** link.
150
−
151
−> [!NOTE]
152
−> For information troubleshooting health check failures: [Troubleshoot the Global Secure Access client: Health check - Global Secure Access | Microsoft Learn](/entra/global-secure-access/troubleshoot-global-secure-access-client-diagnostics-health-check).
153
−
122
+ > [!NOTE]
123
+ > If you experience `information troubleshooting` health check failures, see [Troubleshoot the Global Secure Access client](/entra/global-secure-access/troubleshoot-global-secure-access-client-diagnostics-health-check).
154124
155125
#### Test traffic flow
156126
157127
1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
158
−
159128
1. Access these websites from the browsers: `bing.com`, `salesforce.com`, `Instagram.com`.
160
−
161129
1. In the system tray, right-click **Global Secure Access Client** and select **Advanced Diagnostics** > **Traffic** **tab**.
162
−
163130
1. Scroll to observe that the Global Secure Access client **isn't** capturing traffic from these websites.
164
−
165131
1. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** > **Monitor** > **Traffic logs**. Validate traffic related to these sites is missing from the Global Secure Access traffic logs.
166
−
167132
1. Sign in to Netskope portal and browse to **Skope IT** > **Events & Alerts** > **Page Events**. Validate traffic related to these sites **is** present in Netskope logs.
168
−
169133
1. Access your private application set up in Microsoft Entra Private Access. For example, access a File Share via Server Message Block (SMB).
170
−
171134
1. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** > **Monitor** > **Traffic logs**. Validate traffic related to File Share **is** captured in the Global Secure Access traffic logs.
172
−
173135
1. Sign in to Netskope portal and browse to **Skope IT** > **Events & Alerts** > **Network Events**. Validate traffic related to the private application **is not** present in the traffic logs.
174
−
175136
1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the **Traffic** dialog box, select **Stop collecting**.
176
−
177137
1. Scroll to confirm the Global Secure Access client handled only private application traffic.
178138
179139
## Configuration 2: Microsoft Entra Private Access with Netskope Private Access and Netskope Internet Access
⋯ 7 unchanged lines
187147
188148
For this scenario:
189149
190
−- [Enable Microsoft Entra Private Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-private-access-profile.md#enable-the-private-access-traffic-forwarding-profile).
191
−
192
−- Install a [Private Network Connector](/entra/global-secure-access/how-to-configure-connectors) for Microsoft Entra Private Access.
193
−
194
−- Configure [Quick Access and set up Private DNS](/entra/global-secure-access/how-to-configure-quick-access).
195
−
196
−- Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client).
150
+1. [Enable Microsoft Entra Private Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-private-access-profile.md#enable-the-private-access-traffic-forwarding-profile).
151
+1. Install a [Private Network Connector](/entra/global-secure-access/how-to-configure-connectors) for Microsoft Entra Private Access.
152
+1. Configure [Quick Access and set up Private DNS](/entra/global-secure-access/how-to-configure-quick-access).
153
+1. Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client).
197154
198155
### Netskope Private Access and Netskope Internet Access configuration
199156
200157
In the Netskope portal:
201
−
202
−- Set up and configure [Netskope Steering Configuration](https://docs.netskope.com/en/steering-configuration/) to steer Web Traffic and Private Apps.
203
−
204
−- Install the Netskope Client for [Windows](https://docs.netskope.com/en/netskope-client-for-windows).
205
−
206
−- Create [Real-time Protection policy](https://docs.netskope.com/en/inline-policies/) to allow access to Private Apps.
207
−
208
−- Install the [Netskope Private Access Publisher](https://docs.netskope.com/en/deploy-a-publisher).
158
+1. Set up and configure [Netskope Steering Configuration](https://docs.netskope.com/en/steering-configuration/) to steer Web Traffic and Private Apps.
159
+1. Install the Netskope Client for [Windows](https://docs.netskope.com/en/netskope-client-for-windows).
160
+1. Create [Real-time Protection policy](https://docs.netskope.com/en/inline-policies/) to allow access to Private Apps.
161
+1. Install the [Netskope Private Access Publisher](https://docs.netskope.com/en/deploy-a-publisher).
209162
210163
#### Add Steering Configuration for Internet Access and Private Apps
211164
212165
1. Navigate to **Netskope portal** > **Settings** > **Security Cloud Platform** > **Steering Configuration**> **New Configuration**.
213
−
214166
1. Add a **Configuration Name** such as `MSFTSSEWebAndPrivate`.
215
−
216167
1. Choose a **User Group** or **OU** to apply the configuration to.
217
−
218168
1. Under **Cloud, Web and Firewall** > **Web Traffic**
219
−
220169
1. **Bypass exception traffic at** > **Client**
221
−
222170
1. Under **Private Apps**, select **Specific Private Apps**.
223
−
224171
1. On the next line > **Netskope will** > **Steer**
225
−
226172
1. Under **Borderless SD-WAN Apps** > **None**.
227
−
228173
1. Set **Status** to **Disabled** and select **Save**.
229
−
230174
1. Select the `MSFTSSEWebAndPrivate` configuration > **Exceptions** > **New Exception** > **Destination Locations**.
231
−
232175
1. Select `MSFT SSE Service` (Instructions for creating this object are listed in the Netskope profiles section).
233
−
234176
1. The action is **Bypass** > check the box for **Treat it like local IP address** > Add.
235
−
236177
1. Select **New Exception** > **Domains** and add the Global Secure Access domain exception: \*.globalsecureaccess.microsoft.com > **Save**.
237
−
238178
1. Select **Add Steered Item**.
239
−
240179
1. Select **Private App** and select the private applications for Netskope to steer > **Add**.
241
−
242180
1. Ensure that the `MSFTSSEWebAndPrivate` configuration is at the top of the list of steering configurations in your tenant. Then enable the configuration.
243181
244182
#### Add Netskope Private App Real-time Protection Policy
245183
246184
1. Navigate to **Netskope Portal** > **Policies** > **Real-time Protection**.
247
−
248185
1. Select **New** **Policy** > **Private** **App** **Access**.
249
−
250186
1. In **Source**, select the **Users**, **Groups**, or **OUs** to grant access.
251
−
252187
1. Add any required **Criteria**, like OS or Device Classification.
253
−
254188
1. In **Destination** > **Private** **App** > select Private Apps to allow access to.
255
−
256189
1. In **Profile & Action** > **Allow**.
257
−
258190
1. Give the policy a name such as `Private Apps` and put it in the **Default** group.
259
−
260191
1. Set **Status** to Enabled.
261
−
262
−Go to the system tray to check that Global Secure Access and Netskope clients are enabled.
192
+1. Go to the system tray to check that Global Secure Access and Netskope clients are enabled.
263193
264194
#### Verify configurations for clients
265195
266196
1. Right-click on **Global Secure Access Client** > **Advanced Diagnostics** > **Forwarding Profile** and verify that Private access and Private DNS rules are applied to this client.
267
−
268197
1. Navigate to **Advanced Diagnostics** > **Health Check** and ensure no checks are failing.
269
−
270198
1. Right-click on **Netskope Client** > **Configuration**. Verify **Steering Configuration** matches the name of the configuration created. If not, select the **Update** link.
271
−
272
−> [!NOTE]
273
−> For information troubleshooting health check failures: [Troubleshoot the Global Secure Access client: Health check - Global Secure Access | Microsoft Learn](/entra/global-secure-access/troubleshoot-global-secure-access-client-diagnostics-health-check).
199
+ > [!NOTE]
200
+ > For information troubleshooting health check failures: [Troubleshoot the Global Secure Access client: Health check - Global Secure Access | Microsoft Learn](/entra/global-secure-access/troubleshoot-global-secure-access-client-diagnostics-health-check).
274201
275202
#### Test traffic flow
276203
277204
1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
278
−
279205
1. Access these websites from the browsers: `bing.com`, `salesforce.com`, `yelp.com`.
280
−
281206
1. In the system tray, right-click **Global Secure Access Client** and select **Advanced Diagnostics** > **Traffic tab**.
282
−
283207
1. Scroll to observe that the Global Secure Access client **isn't** capturing traffic from these websites.
284
−
285208
1. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** > **Monitor** > **Traffic** **logs**. Validate traffic related to these sites is missing from the Global Secure Access traffic logs.
286
−
287209
1. Sign in to Netskope portal and browse to **Skope IT** > **Events & Alerts** > **Page Events**. Validate traffic related to these sites **is** present in Netskope logs.
288
−
289210
1. Access your private application set up in Microsoft Entra Private Access. For example, access a File Share via SMB.
290
−
291211
1. Access your private application set up in Netskope Private Access. For example, open an RDP session to a private server.
292
−
293212
1. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** > **Monitor** > **Traffic logs**.
294
−
295213
1. Validate traffic related to the SMB file share private app **is** captured and that traffic related to the RDP session **isn't** captured in the Global Secure Access traffic logs.
296
−
297214
1. Sign in to Netskope portal and browse to **Skope IT** > **Events & Alerts** > **Network Events**. Validate traffic related to the **RDP** session **is** present and that traffic related to the **SMB** file share **isn't** in the Netskope logs.
298
−
299215
1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the **Traffic** dialog box, select **Stop collecting**.
300
−
301216
1. Scroll to confirm the Global Secure Access client handled private application traffic for the SMB file share and didn't handle the RDP session traffic.
302217
303218
## Configuration 3: Microsoft Entra Microsoft Access with Netskope Private Access and Netskope Internet Access
⋯ 7 unchanged lines
311226
312227
For this scenario:
313228
314
−- [Enable Microsoft Entra Microsoft Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-access-profile.md#enable-the-microsoft-access-traffic-forwarding-profile).
315
−
316
−- Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client).
229
+1. [Enable Microsoft Entra Microsoft Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-access-profile.md#enable-the-microsoft-access-traffic-forwarding-profile).
230
+1. Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client).
317231
318232
### Netskope Private Access and Netskope Internet Access configuration
319233
320234
In the Netskope portal:
321235
322
−- Set up and configure [Netskope Steering Configuration](https://docs.netskope.com/en/steering-configuration/) to steer Web Traffic and Private Apps.
323
−
324
−- Install the Netskope Client for [Windows](https://docs.netskope.com/en/netskope-client-for-windows).
325
−
326
−- Create [Real-time Protection policy](https://docs.netskope.com/en/inline-policies/) to allow access to Private Apps.
327
−
328
−- Install the [Netskope Private Access Publisher](https://docs.netskope.com/en/deploy-a-publisher).
236
+1. Set up and configure [Netskope Steering Configuration](https://docs.netskope.com/en/steering-configuration/) to steer Web Traffic and Private Apps.
237
+1. Install the Netskope Client for [Windows](https://docs.netskope.com/en/netskope-client-for-windows).
238
+1. Create [Real-time Protection policy](https://docs.netskope.com/en/inline-policies/) to allow access to Private Apps.
239
+1. Install the [Netskope Private Access Publisher](https://docs.netskope.com/en/deploy-a-publisher).
329240
330241
#### Add Steering Configuration for Internet Access and Private Apps
331242
332243
1. Navigate to **Netskope portal** > **Settings** > **Security Cloud Platform** > **Steering Configuration**> **New Configuration**.
333
−
334244
1. Add a **Configuration Name** such as `MSFTSSEWebAndPrivate-NoM365`.
335
−
336245
1. Choose a **User Group** or **OU** to apply the configuration to.
337
−
338246
1. Under **Cloud, Web and Firewall** > **Web Traffic.**
339
−
340247
1. **Bypass exception traffic at** > **Client.**
341
−
342248
1. Under **Private Apps**, select **Specific Private Apps**.
343
−
344249
1. On the next line > **Netskope will** > **Steer.**
345
−
346250
1. Under **Borderless SD-WAN Apps** > **None**.
347
−
348251
1. Set **Status** to **Disabled** and select **Save**.
349
−
350252
1. Select the `MSFTSSEWebAndPrivate-NoM365` configuration > **Exceptions** > **New Exception** > **Destination Locations** > Select `MSFT SSE Service` and `MSFT SSE M365` (Instructions for creating this object are listed in the Netskope profiles section).
351
−
352253
1. Select **Bypass** and **Treat it like local IP address** options.
353
−
354254
1. Select **Exceptions** > **New Exception** > **Domains** and add these exceptions: `*.globalsecureaccess.microsoft.com`, `*.auth.microsoft.com`, `*.msftidentity.com`, `*.msidentity.com`, `*.onmicrosoft.com`, `*.outlook.com`, `*.protection.outlook.com`, `*.sharepoint.com`, `*.sharepointonline.com`, `*.svc.ms`, `*.wns.windows.com`, `account.activedirectory.windowsazure.com`, `accounts.accesscontrol.windows.net`, `admin.onedrive.com`, `adminwebservice.microsoftonline.com`, `api.passwordreset.microsoftonline.com`, `autologon.microsoftazuread-sso.com`, `becws.microsoftonline.com`, `ccs.login.microsoftonline.com`, `clientconfig.microsoftonline-p.net`, `companymanager.microsoftonline.com`, `device.login.microsoftonline.com`, `g.live.com`, `graph.microsoft.com`, `graph.windows.net`, `login-us.microsoftonline.com`, `login.microsoft.com`, `login.microsoftonline-p.com`, `login.microsoftonline.com`, `login.windows.net`, `logincert.microsoftonline.com`, `loginex.microsoftonline.com`, `nexus.microsoftonline-p.com`, `officeclient.microsoft.com`, `oneclient.sfx.ms`, `outlook.cloud.microsoft`, `outlook.office.com`, `outlook.office365.com`, `passwordreset.microsoftonline.com`, `provisioningapi.microsoftonline.com`, `spoprod-a.akamaihd.net`.
355
−
356255
1. Select **Add Steered Item** > Select **Private App** and select the private applications for Netskope to steer > **Add**.
357
−
358256
1. Ensure that the `MSFTSSEWebAndPrivate-NoM365` configuration is at the top of the list of steering configurations in your tenant. Then enable the configuration.
359257
360258
#### Add Netskope Private App Real-time Protection Policy
361259
362260
1. Navigate to **Netskope Portal** > **Policies** > **Real-time Protection**.
363
−
364261
1. Select **New** **Policy** > **Private** **App** **Access**.
365
−
366262
1. In **Source**, select the **Users**, **Groups**, or **OUs** to grant access.
367
−
368263
1. Add any required **Criteria**, like OS or Device Classification.
369
−
370264
1. In **Destination** > **Private** **App** > select Private Apps to allow access to.
371
−
372265
1. In **Profile & Action** > **Allow**.
373
−
374266
1. Give the policy a name such as `Private Apps` and put it in the **Default** group.
375
−
376267
1. Set **Status** to Enabled.
377
−
378
−Go to the system tray to check that Global Secure Access and Netskope clients are enabled.
268
+1. Go to the system tray to check that Global Secure Access and Netskope clients are enabled.
379269
380270
#### Verify configurations for clients
381271
382272
1. Right-click on **Global Secure Access Client** > **Advanced Diagnostics** > **Forwarding Profile** and verify that only Microsoft 365 rules are applied to this client.
383
−
384273
1. Navigate to **Advanced Diagnostics** > **Health Check** and ensure no checks are failing.
385
−
386274
1. Right-click on **Netskope Client** > **Configuration**. Verify **Steering Configuration** matches the name of the configuration created. If not, select the **Update** link.
387
−
388
−> [!NOTE]
389
−> For information troubleshooting health check failures: [Troubleshoot the Global Secure Access client: Health check - Global Secure Access | Microsoft Learn](/entra/global-secure-access/troubleshoot-global-secure-access-client-diagnostics-health-check).
275
+ > [!NOTE]
276
+ > For information troubleshooting health check failures: [Troubleshoot the Global Secure Access client: Health check - Global Secure Access | Microsoft Learn](/entra/global-secure-access/troubleshoot-global-secure-access-client-diagnostics-health-check).
390277
391278
#### Test traffic flow
392279
393280
1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
394
−
395281
1. Access these websites from the browsers: `bing.com`, `salesforce.com`, `yelp.com`.
396
−
397282
1. In the system tray, right-click **Global Secure Access Client** and select **Advanced Diagnostics** > **Traffic tab**.
398
−
399283
1. Scroll to observe that the Global Secure Access client **isn't** capturing traffic from these websites.
400
−
401284
1. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** > **Monitor** > **Traffic logs**. Validate traffic related to these sites is missing from the Global Secure Access traffic logs.
402
−
403285
1. Sign in to Netskope portal and browse to **Skope IT** > **Events & Alerts** > **Page Events**.
404
−
405286
1. Validate traffic related to these sites **is** present in Netskope logs.
406
−
407287
1. Access your private application set up in Netskope Private Access. For example, open an RDP session to a private server.
408
−
409288
1. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** > **Monitor** > **Traffic logs**.
410
−
411289
1. Validate traffic related to the RDP session **isn’t** in the Global Secure Access traffic logs.
412
−
413290
1. Sign in to Netskope portal and browse to **Skope IT** > **Events & Alerts** > **Network Events**. Validate traffic related to the **RDP** session **is** present.
414
−
415291
1. Access Outlook Online (`outlook.com`, `outlook.office.com`, `outlook.office365.com`), SharePoint Online (`<yourtenantdomain>.sharepoint.com`).
416
−
417292
1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the **Traffic** dialog box, select **Stop collecting**.
418
−
419293
1. Scroll to confirm the Global Secure Access client handled only Microsoft 365 traffic.
420
−
421294
1. You can also validate that the traffic is captured in the Global Secure Access traffic logs. In the Microsoft Entra admin center, navigate to **Global Secure Access** > **Monitor** > **Traffic logs**.
422
−
423295
1. Validate traffic related to Outlook Online and SharePoint Online is missing from Netskope portal in **Skope IT** > **Events & Alerts** > **Page Events**.
424296
425297
## Configuration 4: Microsoft Entra Internet Access and Microsoft Entra Microsoft Access and with Netskope Private Access
⋯ 4 unchanged lines
430302
431303
For this scenario:
432304
433
−- [Enable Microsoft Entra Microsoft Access](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-profile.md#enable-the-microsoft-traffic-profile) and [Microsoft Entra Internet Access forwarding profiles](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-internet-access-profile.md#prerequisites).
434
−
435
−- Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client) or [macOS](/entra/global-secure-access/how-to-install-macos-client).
436
−
437
−- Add a Microsoft Entra Internet Access traffic forwarding profile custom bypass to exclude Netskope service FQDN and IPs.
305
+1. [Enable Microsoft Entra Microsoft Access](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-profile.md#enable-the-microsoft-traffic-profile) and [Microsoft Entra Internet Access forwarding profiles](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-internet-access-profile.md#prerequisites).
306
+1. Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client) or [macOS](/entra/global-secure-access/how-to-install-macos-client).
307
+1. Add a Microsoft Entra Internet Access traffic forwarding profile custom bypass to exclude Netskope service FQDN and IPs.
438308
439309
#### Add a custom bypass for Netskope in Global Secure Access
440310
441311
1. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** > **Connect** > **Traffic forwarding** > **Internet access profile**.
442
−
443312
1. Under **Internet access policies** > Select **View**.
444
−
445313
1. Expand **Custom Bypass** > Select **Add rule**
446
−
447314
1. Leave destination type **FQDN** and in Destination enter `*.goskope.com` > **Save**
448
−
449315
1. Select **Add rule** again > **IP Range** > **Add** the IP ranges (each range is a new rule): `163.116.128.0..163.116.255.255`, `162.10.0.0..162.10.127.255`, `31.186.239.0..31.186.239.255`, `8.39.144.0..8.39.144.255`, `8.36.116.0..8.36.116.255`
450
−
451316
1. Select **Save**.
452317
453318
### Netskope Private Access configuration
454319
455320
In the Netskope portal:
456321
457
−- Set up and configure [Netskope Steering Configuration](https://docs.netskope.com/en/steering-configuration/) to steer Web Traffic and Private Apps.
458
−
459
−- Install the Netskope Client for [Windows](https://docs.netskope.com/en/netskope-client-for-windows), or [macOS](https://docs.netskope.com/en/netskope-client-for-macos).
460
−
461
−- Create [Real-time Protection policy](https://docs.netskope.com/en/inline-policies/) to allow access to Private Apps.
462
−
463
−- Install the [Netskope Private Access Publisher](https://docs.netskope.com/en/deploy-a-publisher).
322
+1. Set up and configure [Netskope Steering Configuration](https://docs.netskope.com/en/steering-configuration/) to steer Web Traffic and Private Apps.
323
+1. Install the Netskope Client for [Windows](https://docs.netskope.com/en/netskope-client-for-windows), or [macOS](https://docs.netskope.com/en/netskope-client-for-macos).
324
+1. Create [Real-time Protection policy](https://docs.netskope.com/en/inline-policies/) to allow access to Private Apps.
325
+1. Install the [Netskope Private Access Publisher](https://docs.netskope.com/en/deploy-a-publisher).
464326
465327
#### Add Steering Configuration for Internet Access and Private Apps
466328
467329
1. Navigate to **Netskope portal** > **Settings** > **Security Cloud Platform** > **Steering Configuration**> **New Configuration**.
468
−
469330
1. Add a **Configuration Name** such as `MSFTSSEPrivate`.
470
−
471331
1. Choose a **User Group** or **OU** to apply the configuration to.
472
−
473332
1. Under **Cloud, Web and Firewall** > **Web Traffic.**
474
−
475333
1. **Bypass exception traffic at** > **Client.**
476
−
477334
1. Under **Private Apps**, select **Specific Private Apps**.
478
−
479335
1. On the next line > **Netskope will** > **Steer.**
480
−
481336
1. Under **Borderless SD-WAN Apps** > **None**.
482
−
483337
1. Set **Status** to **Disabled** and select **Save**.
484
−
485338
1. Select the `MSFTSSEPrivate` configuration > **Exceptions** > **New Exception** > **Destination Locations** > Select `MSFT SSE Service` and `MSFT SSE M365` (Instructions for creating this object are listed in the Netskope profiles section).
486
−
487339
1. Select **Bypass** and **Treat it like local IP address** options.
488
−
489340
1. Select **Exceptions** > **New Exception** > **Domains** and add these exceptions: `*.globalsecureaccess.microsoft.com`, `*.auth.microsoft.com`, `*.msftidentity.com`, `*.msidentity.com`, `*.onmicrosoft.com`, `*.outlook.com`, `*.protection.outlook.com`, `*.sharepoint.com`, `*.sharepointonline.com`, `*.svc.ms`, `*.wns.windows.com`, `account.activedirectory.windowsazure.com`, `accounts.accesscontrol.windows.net`, `admin.onedrive.com`, `adminwebservice.microsoftonline.com`, `api.passwordreset.microsoftonline.com`, `autologon.microsoftazuread-sso.com`, `becws.microsoftonline.com`, `ccs.login.microsoftonline.com`, `clientconfig.microsoftonline-p.net`, `companymanager.microsoftonline.com`, `device.login.microsoftonline.com`, `g.live.com`, `graph.microsoft.com`, `graph.windows.net`, `login-us.microsoftonline.com`, `login.microsoft.com`, `login.microsoftonline-p.com`, `login.microsoftonline.com`, `login.windows.net`, `logincert.microsoftonline.com`, `loginex.microsoftonline.com`, `nexus.microsoftonline-p.com`, `officeclient.microsoft.com`, `oneclient.sfx.ms`, `outlook.cloud.microsoft`, `outlook.office.com`, `outlook.office365.com`, `passwordreset.microsoftonline.com`, `provisioningapi.microsoftonline.com`, `spoprod-a.akamaihd.net`.
490
−
491341
1. Select **Add Steered Item** > Select **Private App** and select the private applications for Netskope to steer > **Add**.
492
−
493342
1. Ensure that the `MSFTSSEPrivate` configuration is at the top of the list of steering configurations in your tenant. Then enable the configuration
494343
495344
#### Add Netskope Private App Real-time Protection Policy
496345
497346
1. Navigate to **Netskope Portal** > **Policies** > **Real-time Protection**.
498
−
499347
1. Select **New** **Policy** > **Private** **App** **Access**.
500
−
501348
1. In **Source**, select the **Users**, **Groups**, or **OUs** to grant access.
502
−
503349
1. Add any required **Criteria**, like OS or Device Classification.
504
−
505350
1. In **Destination** > **Private** **App** > select Private Apps to allow access to.
506
−
507351
1. In **Profile & Action** > **Allow**.
508
−
509352
1. Give the policy a name such as `Private Apps` and put it in the **Default** group.
510
−
511353
1. Set **Status** to Enabled.
512
−
513
−Go to the system tray to check that Global Secure Access and Netskope clients are enabled.
354
+1. Go to the system tray to check that Global Secure Access and Netskope clients are enabled.
514355
515356
#### Verify configurations for clients
516357
517358
1. Right-click on **Global Secure Access Client** > **Advanced Diagnostics** > **Forwarding Profile** and verify that Microsoft Access and Internet Access rules are applied to this client.
518
−
519359
1. Navigate to **Advanced Diagnostics** > **Health Check** and ensure no checks are failing.
520
−
521360
1. Right-click on **Netskope Client** > **Configuration**. Verify **Steering Configuration** matches the name of the configuration created. If not, select the **Update** link.
522
−
523
−> [!NOTE]
524
−> For information troubleshooting health check failures: [Troubleshoot the Global Secure Access client: Health check - Global Secure Access | Microsoft Learn](/entra/global-secure-access/troubleshoot-global-secure-access-client-diagnostics-health-check).
361
+ > [!NOTE]
362
+ > For information troubleshooting health check failures: [Troubleshoot the Global Secure Access client: Health check - Global Secure Access | Microsoft Learn](/entra/global-secure-access/troubleshoot-global-secure-access-client-diagnostics-health-check).
525363
526364
#### Test traffic flow
527365
528366
1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
529
−
530367
1. Access these websites from the browsers: `bing.com`, `salesforce.com`, `Instagram.com`, Outlook Online (`outlook.com`, `outlook.office.com`, `outlook.office365.com`), SharePoint Online (`<yourtenantdomain>.sharepoint.com`).
531
−
532368
1. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** > **Monitor** > **Traffic logs**. Validate traffic related to these sites **is** captured in the Global Secure Access traffic logs.
533
−
534369
1. Access your private application set up in Netskope Private Apps. For example, using Remote Desktop (RDP).
535
−
536370
1. Sign in to Netskope portal and browse to **Skope IT** > **Events & Alerts** > **Network Events**. Validate traffic related to the **RDP** session **is** present and that traffic related to Microsoft 365 and Internet Traffic such as Instagram.com, Outlook Online, and SharePoint Online is missing from Netskope Portal.
537
−
538371
1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the network **traffic** dialog box, select **Stop collecting**.
539
−
540372
1. Scroll to observe that the Global Secure Access client **isn't** capturing traffic from the private application. Also, observe that the Global Secure Access client is capturing traffic for Microsoft 365 and other internet traffic.
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 05:03 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.