GSA coexistence with Palo Alto Networks
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5f3d4b4 · +61 −61 lines · also on GitHub
⋯ 49 unchanged lines
5050
5151
To set up Global Secure Access and test all scenarios in this documentation you will need to perform the following.
5252
53
−- Enable and disable different Global Secure Access traffic forwarding profiles for your Microsoft Entra tenant. For more information about enabling and disabling profiles, see [Global Secure Access traffic forwarding profiles](/entra/global-secure-access/concept-traffic-forwarding).
53
+- Enable and disable different Global Secure Access traffic forwarding profiles for your Microsoft Entra tenant. For more information about enabling and disabling profiles, see [Global Secure Access traffic forwarding profiles](/entra/global-secure-access/concept-traffic-forwarding).
5454
55
−- Install and configure the Microsoft Entra private network connector. For information on how to install and configure the connector, see [How to configure connectors](/entra/global-secure-access/how-to-configure-connectors).
55
+- Install and configure the Microsoft Entra private network connector. For information on how to install and configure the connector, see [How to configure connectors](/entra/global-secure-access/how-to-configure-connectors).
5656
5757
> [!NOTE]
5858
> Private Network Connectors are required for Microsoft Entra Private Access applications.
5959
60
−- Configure Quick Access to your private resources and set up Private Domain Name System (DNS) and DNS suffixes. For information on how to configure Quick Access, see [How to configure Quick Access](/entra/global-secure-access/how-to-configure-quick-access).
61
−- Install and configure the Global Secure Access client on end-user devices. For more information about clients, see [Global Secure Access clients](/entra/global-secure-access/concept-clients). For information on how to install the Windows client, see [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client). For macOS, see [Global Secure Access Client for macOS](/entra/global-secure-access/how-to-install-macos-client).
60
+- Configure Quick Access to your private resources and set up Private Domain Name System (DNS) and DNS suffixes. For information on how to configure Quick Access, see [How to configure Quick Access](/entra/global-secure-access/how-to-configure-quick-access).
61
+- Install and configure the Global Secure Access client on end-user devices. For more information about clients, see [Global Secure Access clients](/entra/global-secure-access/concept-clients). For information on how to install the Windows client, see [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client). For macOS, see [Global Secure Access Client for macOS](/entra/global-secure-access/how-to-install-macos-client).
6262
6363
**Palo Alto Prisma Access**
6464
⋯ 4 unchanged lines
6969
- Configure the GlobalProtect tunnel settings and app settings to work with Microsoft Entra Private DNS and bypass Microsoft Entra service Fully Qualified Domain Name (FQDN) and Internet Protocol (IP) addresses.
7070
7171
Tunnel Settings:
72
−1. In the **Strata Cloud Manager portal**, go to **Workflows** \> **Prisma Access Setup** \> **GlobalProtect** \> **GlobalProtect App** \> **Tunnel Settings**.
73
−1. In the **Split Tunneling** section, exclude traffic by adding the domain and routes: `*.globalsecureaccess.microsoft.com`, `150.171.19.0/24`, `150.171.20.0/24`, `13.107.232.0/24`, `13.107.233.0/24`, `150.171.15.0/24`, `150.171.18.0/24`, `151.206.0.0/16`, `6.6.0.0/16`.
72
+1. In the **Strata Cloud Manager portal**, go to **Workflows** \> **Prisma Access Setup** \> **GlobalProtect** \> **GlobalProtect App** \> **Tunnel Settings**.
73
+1. In the **Split Tunneling** section, exclude traffic by adding the domain and routes: `*.globalsecureaccess.microsoft.com`, `150.171.19.0/24`, `150.171.20.0/24`, `13.107.232.0/24`, `13.107.233.0/24`, `150.171.15.0/24`, `150.171.18.0/24`, `151.206.0.0/16`, `6.6.0.0/16`.
7474
7575
App Settings:
76
−1. In the **Strata Cloud Manager portal**, go to **Workflows** \> **Prisma Access Setup** \> **GlobalProtect** \> **GlobalProtect App** \> **App Settings**
76
+1. In the **Strata Cloud Manager portal**, go to **Workflows** \> **Prisma Access Setup** \> **GlobalProtect** \> **GlobalProtect App** \> **App Settings**
7777
1. Scroll to **App Configuration** \> **Show Advanced Options** \> **DNS** and **uncheck** the box for **Resolve All FQDNs Using DNS Servers Assigned by the Tunnel (Windows Only)**
7878
> [!NOTE]
7979
> The setting **"Resolve All FQDNs Using DNS Servers Assigned by the Tunnel (Windows Only)"** should be **disabled** when using Microsoft Entra Private DNS (Configurations 1 and 2). During testing, this setting was **enabled** (checked) for Configurations 3 and 4.
80
−1. Navigate to **Workflows** \> **Prisma Access Setup** \> **GlobalProtect** \> **GlobalProtect App**. Select **Push Config** and select **Push** on the top right side of your screen.
81
−1. Verify that the configuration pushed to the GlobalProtect client. Navigate to **Manage** \> **Operations** \> **Push Status**.
80
+1. Navigate to **Workflows** \> **Prisma Access Setup** \> **GlobalProtect** \> **GlobalProtect App**. Select **Push Config** and select **Push** on the top right side of your screen.
81
+1. Verify that the configuration pushed to the GlobalProtect client. Navigate to **Manage** \> **Operations** \> **Push Status**.
8282
1. Install the Palo Alto Networks GlobalProtect client. For more information on installing the Palo Alto Networks GlobalProtect client, for Windows see [GlobalProtect App for Windows](https://docs.paloaltonetworks.com/globalprotect/6-2/globalprotect-app-user-guide/globalprotect-app-for-windows). For macOS see, [GlobalProtect App for macOS](https://docs.paloaltonetworks.com/globalprotect/6-2/globalprotect-app-user-guide/globalprotect-app-for-mac). To set up the GlobalProtect client there are a lot of options like tying in Microsoft Entra ID to create your accounts. For more information about the options, see [Microsoft Entra single sign-on (SSO) integration with Palo Alto Networks - GlobalProtect](/entra/identity/saas-apps/palo-alto-networks-globalprotect-tutorial). For the most basic setup, add a local user to the GlobalProtect from Palo Alto Networks’ Strata Cloud Manager.
8383
1. Browse to **Manage** \> **Configuration** \> **NGFW and Prisma Access**.
8484
1. Select **Configuration Scope** \> **GlobalProtect** and then select **Identity Services** \> **Local Users & Groups** \> **Local Users**. Add a user and password for testing.
⋯ 11 unchanged lines
9696
For this scenario you will need to do the following.
9797
9898
- [Enable Microsoft Entra Private Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-private-access-profile.md#enable-the-private-access-traffic-forwarding-profile).
99
−- Install a [Private Network Connector](/entra/global-secure-access/how-to-configure-connectors) for Microsoft Entra Private Access.
100
−- Configure [Quick Access and set up Private DNS](/entra/global-secure-access/how-to-configure-quick-access).
101
−- Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client) or [macOS](/entra/global-secure-access/how-to-install-macos-client).
99
+- Install a [Private Network Connector](/entra/global-secure-access/how-to-configure-connectors) for Microsoft Entra Private Access.
100
+- Configure [Quick Access and set up Private DNS](/entra/global-secure-access/how-to-configure-quick-access).
101
+- Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client) or [macOS](/entra/global-secure-access/how-to-install-macos-client).
102102
103103
**Palo Alto Prisma Access configuration**
104104
⋯ 7 unchanged lines
112112
113113
Verify configuration for Global Secure Access client.
114114
115
−1. Right click on the **Global Secure Access client \> Advanced Diagnostics \> Forwarding Profile** and verify that Private Access and Private DNS rules are applied to this client.
116
−2. Navigate to **Advanced Diagnostics \> Health Check** and ensure no checks are failing.
115
+1. Right click on the **Global Secure Access client \> Advanced Diagnostics \> Forwarding Profile** and verify that Private Access and Private DNS rules are applied to this client.
116
+2. Navigate to **Advanced Diagnostics \> Health Check** and ensure no checks are failing.
117117
118118
> [!NOTE]
119119
> For information about troubleshooting health check failures, see [Troubleshoot the Global Secure Access client: Health check - Global Secure Access \| Microsoft Learn](/entra/global-secure-access/troubleshoot-global-secure-access-client-diagnostics-health-check).
120120
121121
**Test traffic flow**
122122
123
−1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
124
−2. Access these websites from the browsers: `salesforce.com`, `Instagram.com`, `yelp.com`.
123
+1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
124
+2. Access these websites from the browsers: `salesforce.com`, `Instagram.com`, `yelp.com`.
125125
3. In the system tray, right-click **Global Secure Access Client** and select **Advanced Diagnostics** \> **Traffic tab**.
126
−4. Scroll to observe that the Global Secure Access client **isn't** capturing traffic from these websites
127
−5. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** \> **Monitor** \> **Traffic logs**. Validate traffic related to these sites is missing from the Global Secure Access traffic logs.
128
−6. Sign in to Palo Alto Networks’ Strata Cloud Manager and browse to **Incidents & Alerts** \> **Log Viewer**.
126
+4. Scroll to observe that the Global Secure Access client **isn't** capturing traffic from these websites
127
+5. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** \> **Monitor** \> **Traffic logs**. Validate traffic related to these sites is missing from the Global Secure Access traffic logs.
128
+6. Sign in to Palo Alto Networks’ Strata Cloud Manager and browse to **Incidents & Alerts** \> **Log Viewer**.
129129
7. Validate traffic related to these sites **is** present in the Prisma Access logs.
130130
8. Access your private application set up in Microsoft Entra Private Access. For example, access a File Share via Server Message Block (SMB).
131
−9. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** \> **Monitor** \> **Traffic logs**.
131
+9. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** \> **Monitor** \> **Traffic logs**.
132132
10. Validate traffic related to the File Share **is** captured in the Global Secure Access traffic logs.
133
−11. Sign in to Palo Alto Networks’ Strata Cloud Manager and browse to **Incidents & Alerts** \> **Log Viewer**. Validate traffic related to the private application isn’t present in the logs.
134
−12. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the **Traffic** dialog box, select **Stop collecting**.
135
−13. Scroll to confirm the Global Secure Access client handled only private application traffic.
133
+11. Sign in to Palo Alto Networks’ Strata Cloud Manager and browse to **Incidents & Alerts** \> **Log Viewer**. Validate traffic related to the private application isn’t present in the logs.
134
+12. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the **Traffic** dialog box, select **Stop collecting**.
135
+13. Scroll to confirm the Global Secure Access client handled only private application traffic.
136136
137137
## Microsoft Entra Private Access with Palo Alto Prisma Access for Private Application and Internet Access
138138
⋯ 4 unchanged lines
143143
For this scenario you will need to:
144144
145145
- [Enable Microsoft Entra Private Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-private-access-profile.md#enable-the-private-access-traffic-forwarding-profile).
146
−- Install a [Private Network Connector](/entra/global-secure-access/how-to-configure-connectors) for Microsoft Entra Private Access.
147
−- Configure [Quick Access and set up Private DNS](/entra/global-secure-access/how-to-configure-quick-access).
148
−- Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client) or [macOS](/entra/global-secure-access/how-to-install-macos-client).
146
+- Install a [Private Network Connector](/entra/global-secure-access/how-to-configure-connectors) for Microsoft Entra Private Access.
147
+- Configure [Quick Access and set up Private DNS](/entra/global-secure-access/how-to-configure-quick-access).
148
+- Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client) or [macOS](/entra/global-secure-access/how-to-install-macos-client).
149149
150150
**Palo Alto Networks configuration**
151151
⋯ 7 unchanged lines
159159
160160
Verify configuration for Global Secure Access client.
161161
162
−1. Right click on the **Global Secure Access client \> Advanced Diagnostics \> Forwarding Profile** and verify that Private Access and Private DNS rules are applied to this client.
163
−2. Navigate to **Advanced Diagnostics \> Health Check** and ensure no checks are failing.
162
+1. Right click on the **Global Secure Access client \> Advanced Diagnostics \> Forwarding Profile** and verify that Private Access and Private DNS rules are applied to this client.
163
+2. Navigate to **Advanced Diagnostics \> Health Check** and ensure no checks are failing.
164164
165165
> [!NOTE]
166166
> For information about troubleshooting health check failures, see [Troubleshoot the Global Secure Access client: Health check - Global Secure Access \| Microsoft Learn](/entra/global-secure-access/troubleshoot-global-secure-access-client-diagnostics-health-check).
167167
168168
**Test traffic flow**
169169
170
−1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
171
−2. Access these websites from the browsers: `salesforce.com`, `Instagram.com`, `yelp.com`.
170
+1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
171
+2. Access these websites from the browsers: `salesforce.com`, `Instagram.com`, `yelp.com`.
172172
3. In the system tray, right-click **Global Secure Access Client** and select **Advanced Diagnostics** \> **Traffic tab**.
173
−4. Scroll to observe that the Global Secure Access client **isn't** capturing traffic from these websites.
174
−5. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** \> **Monitor** \> **Traffic logs**. Validate traffic related to these sites is missing from the Global Secure Access traffic logs.
175
−6. Sign in to Palo Alto Networks’ Strata Cloud Manager and browse to **Incidents & Alerts** \> **Log Viewer**.
173
+4. Scroll to observe that the Global Secure Access client **isn't** capturing traffic from these websites.
174
+5. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** \> **Monitor** \> **Traffic logs**. Validate traffic related to these sites is missing from the Global Secure Access traffic logs.
175
+6. Sign in to Palo Alto Networks’ Strata Cloud Manager and browse to **Incidents & Alerts** \> **Log Viewer**.
176176
7. Validate traffic related to these sites **is** present in the Prisma Access logs.
177177
8. Access your private application set up in Microsoft Entra Private Access. For example, access a File Share via Server Message Block (SMB).
178178
9. Access your private application set up in Prisma Access through a service connection or ZTNA connector. For example, open an RDP session to a private server.
179
−10. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** \> **Monitor** \> **Traffic logs**.
179
+10. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** \> **Monitor** \> **Traffic logs**.
180180
11. Validate traffic related to the SMB file share private app is captured and that traffic related to the RDP session **isn’t** captured in the Global Secure Access traffic logs.
181
−12. Sign in to Palo Alto Networks’ Strata Cloud Manager and browse to **Incidents & Alerts** \> **Log Viewer**. Validate traffic related to the private RDP session **is** present and that traffic related to the SMB file share **isn’t** in the logs.
182
−13. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the network traffic dialog box, select **Stop collecting**.
181
+12. Sign in to Palo Alto Networks’ Strata Cloud Manager and browse to **Incidents & Alerts** \> **Log Viewer**. Validate traffic related to the private RDP session **is** present and that traffic related to the SMB file share **isn’t** in the logs.
182
+13. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the network traffic dialog box, select **Stop collecting**.
183183
14. Scroll to confirm the Global Secure Access client handled private application traffic for the SMB file share and didn't handle the RDP session traffic.
184184
185185
## Microsoft Entra Microsoft Access with Palo Alto Prisma Access for Private Application and Internet Access
⋯ 5 unchanged lines
191191
For this scenario you will need to:
192192
193193
- [Enable Microsoft Entra Microsoft Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-profile.md#enable-the-microsoft-traffic-profile).
194
−- Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client) or [macOS](/entra/global-secure-access/how-to-install-macos-client).
194
+- Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client) or [macOS](/entra/global-secure-access/how-to-install-macos-client).
195195
196196
**Palo Alto Networks configuration**
197197
⋯ 10 unchanged lines
208208
209209
Verify configuration for Global Secure Access client.
210210
211
−1. Right click on the **Global Secure Access client \> Advanced Diagnostics \> Forwarding Profile** and verify that Microsoft 365 rules are applied to this client.
212
−2. Navigate to **Advanced Diagnostics \> Health Check** and ensure no checks are failing.
211
+1. Right click on the **Global Secure Access client \> Advanced Diagnostics \> Forwarding Profile** and verify that Microsoft 365 rules are applied to this client.
212
+2. Navigate to **Advanced Diagnostics \> Health Check** and ensure no checks are failing.
213213
214214
> [!NOTE]
215215
> For information about troubleshooting health check failures, see [Troubleshoot the Global Secure Access client: Health check - Global Secure Access \| Microsoft Learn](/entra/global-secure-access/troubleshoot-global-secure-access-client-diagnostics-health-check).
216216
217217
**Test traffic flow**
218218
219
−1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
220
−2. Access these websites from the browsers: `salesforce.com`, `Instagram.com`, `yelp.com`.
221
−3. In the system tray, right-click **Global Secure Access Client** and select **Advanced Diagnostics** \> **Traffic tab**.
222
−4. Scroll to observe that the Global Secure Access client **isn't** capturing traffic from these websites.
223
−5. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** \> **Monitor** \> **Traffic logs**. Validate traffic related to these sites is missing from the Global Secure Access traffic logs.
224
−6. Sign in to Palo Alto Networks’ Strata Cloud Manager and browse to **Incidents & Alerts** \> **Log Viewer**.
219
+1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
220
+2. Access these websites from the browsers: `salesforce.com`, `Instagram.com`, `yelp.com`.
221
+3. In the system tray, right-click **Global Secure Access Client** and select **Advanced Diagnostics** \> **Traffic tab**.
222
+4. Scroll to observe that the Global Secure Access client **isn't** capturing traffic from these websites.
223
+5. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** \> **Monitor** \> **Traffic logs**. Validate traffic related to these sites is missing from the Global Secure Access traffic logs.
224
+6. Sign in to Palo Alto Networks’ Strata Cloud Manager and browse to **Incidents & Alerts** \> **Log Viewer**.
225225
7. Validate traffic related to these sites **is** present in the Prisma Access logs.
226226
8. Access your private application set up in Prisma Access through a service connection or ZTNA connector. For example, open an RDP session to a private server.
227
−9. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** \> **Monitor** \> **Traffic logs**.
228
−10. Validate traffic related to the RDP session **isn’t** in the Global Secure Access traffic logs
229
−11. Sign in to Palo Alto Networks’ Strata Cloud Manager and browse to **Incidents & Alerts** \> **Log Viewer**. Validate traffic related to the RDP session is present in the Prisma Access logs.
230
−12. Access Outlook Online (`outlook.com`, `outlook.office.com`, `outlook.office365.com`), SharePoint Online (`<yourtenantdomain>.sharepoint.com`).
231
−13. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the **Traffic** dialog box, select **Stop collecting**.
227
+9. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** \> **Monitor** \> **Traffic logs**.
228
+10. Validate traffic related to the RDP session **isn’t** in the Global Secure Access traffic logs
229
+11. Sign in to Palo Alto Networks’ Strata Cloud Manager and browse to **Incidents & Alerts** \> **Log Viewer**. Validate traffic related to the RDP session is present in the Prisma Access logs.
230
+12. Access Outlook Online (`outlook.com`, `outlook.office.com`, `outlook.office365.com`), SharePoint Online (`<yourtenantdomain>.sharepoint.com`).
231
+13. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the **Traffic** dialog box, select **Stop collecting**.
232232
14. Scroll to confirm the Global Secure Access client handled only Microsoft 365 traffic.
233
−15. You can also validate that the traffic is captured in the Global Secure Access traffic logs. In the Microsoft Entra admin center, navigate to **Global Secure Access** \> **Monitor** \> **Traffic logs**.
233
+15. You can also validate that the traffic is captured in the Global Secure Access traffic logs. In the Microsoft Entra admin center, navigate to **Global Secure Access** \> **Monitor** \> **Traffic logs**.
234234
16. Validate traffic related to Outlook Online and SharePoint Online is missing from Prisma Access logs in Strata Cloud Manager **Incidents & Alerts** \> **Log Viewer**.
235235
236236
## Microsoft Entra Internet Access and Microsoft Entra Microsoft Access with Palo Alto Prisma Access for Private Application Access
⋯ 4 unchanged lines
241241
242242
For this scenario you will need to do the following.
243243
244
−- [Enable Microsoft Entra Microsoft Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-profile.md#enable-the-microsoft-traffic-profile) and [Microsoft Entra Internet Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-internet-access-profile.md#prerequisites).
245
−- Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client) or [macOS](/entra/global-secure-access/how-to-install-macos-client).
244
+- [Enable Microsoft Entra Microsoft Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-profile.md#enable-the-microsoft-traffic-profile) and [Microsoft Entra Internet Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-internet-access-profile.md#prerequisites).
245
+- Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client) or [macOS](/entra/global-secure-access/how-to-install-macos-client).
246246
- Add a Microsoft Entra Internet Access traffic forwarding profile custom bypass to exclude Prisma Access service FQDN.
247247
248248
Add a custom bypass for Prisma Access in Global Secure Access:
⋯ 18 unchanged lines
267267
268268
Verify configuration for Global Secure Access client.
269269
270
−1. Right click on the **Global Secure Access client \> Advanced Diagnostics \> Forwarding Profile** and verify that Microsoft 365 and Internet Access rules are applied to this client.
271
−2. Navigate to **Advanced Diagnostics \> Health Check** and ensure no checks are failing.
270
+1. Right click on the **Global Secure Access client \> Advanced Diagnostics \> Forwarding Profile** and verify that Microsoft 365 and Internet Access rules are applied to this client.
271
+2. Navigate to **Advanced Diagnostics \> Health Check** and ensure no checks are failing.
272272
273273
> [!NOTE]
274274
> For information about troubleshooting health check failures, see [Troubleshoot the Global Secure Access client: Health check - Global Secure Access \| Microsoft Learn](/entra/global-secure-access/troubleshoot-global-secure-access-client-diagnostics-health-check).
275275
276276
**Test traffic flow**
277277
278
−1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
279
−2. Access these websites from the browser: `bing.com`, `salesforce.com`, `Instagram.com`, Outlook Online (`outlook.com`, `outlook.office.com`, `outlook.office365.com`), SharePoint Online (`<yourtenantdomain>.sharepoint.com`).
280
−3. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** \> **Monitor** \> **Traffic logs**. Validate traffic related to these sites is captured in the Global Secure Access traffic logs.
278
+1. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. Select the **Traffic** tab and select **Start collecting**.
279
+2. Access these websites from the browser: `bing.com`, `salesforce.com`, `Instagram.com`, Outlook Online (`outlook.com`, `outlook.office.com`, `outlook.office365.com`), SharePoint Online (`<yourtenantdomain>.sharepoint.com`).
280
+3. Sign in to Microsoft Entra admin center and browse to **Global Secure Access** \> **Monitor** \> **Traffic logs**. Validate traffic related to these sites is captured in the Global Secure Access traffic logs.
281281
4. Access your private application set up in Prisma Access through a service connection or ZTNA connector. For example, open an RDP session to a private server.
282
−5. Sign in to Palo Alto Networks’ Strata Cloud Manager and browse to **Incidents & Alerts** \> **Log Viewer**. Validate traffic related to the RDP session is present and that traffic related to Microsoft 365 and Internet Traffic such as `Instagram.com`, Outlook Online, and SharePoint Online is missing from the Prisma Access logs.
283
−6. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the network traffic dialog box, select **Stop collecting**.
284
−7. Scroll to observe that the Global Secure Access client **isn't** capturing traffic from the private application. Also, observe that the Global Secure Access client **is** capturing traffic for Microsoft 365 and other internet traffic.
282
+5. Sign in to Palo Alto Networks’ Strata Cloud Manager and browse to **Incidents & Alerts** \> **Log Viewer**. Validate traffic related to the RDP session is present and that traffic related to Microsoft 365 and Internet Traffic such as `Instagram.com`, Outlook Online, and SharePoint Online is missing from the Prisma Access logs.
283
+6. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the network traffic dialog box, select **Stop collecting**.
284
+7. Scroll to observe that the Global Secure Access client **isn't** capturing traffic from the private application. Also, observe that the Global Secure Access client **is** capturing traffic for Microsoft 365 and other internet traffic.
285285
286286
## Next steps
287287
⋯ 1 unchanged line
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:50 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.