GSA coexistence with Palo Alto Networks

This page's changes and edits · All guidance changes

Microsoft's edit · 27 May 01:15 UTC

AI Readiness Phase B: high-confidence structure fixes across 10 files

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 872a549 · +9 −9 lines · also on GitHub

⋯ 1 unchanged line

22 title: Security Service Edge (SSE) coexistence with Microsoft and Palo Alto Networks

33 description: "Deploy Microsoft Entra Private Access alongside Palo Alto Prisma Access. Includes configuration steps for secure internet access and private application connectivity."

44 ms.topic: how-to

5 −ms.date: 03/25/2026

5 +ms.date: 05/26/2026

66 ms.subservice: entra-private-access

77 ms.reviewer: shkhalid

88 ai-usage: ai-assisted

⋯ 18 unchanged lines

2727

2828 In this scenario both clients will handle traffic for separate private applications. Private applications in Microsoft Entra Private Access will be handled by Global Secure Access while private applications in Prisma Access service connections, or ZTNA connectors, will be accessed through GlobalProtect client. Internet traffic will be handled by Prisma Access.

2929

30 −3. [**Microsoft Entra Microsoft Access with Palo Alto Prisma Access for Private Application and Internet Access**](#microsoft-entra-microsoft-access-with-palo-alto-prisma-access-for-private-application-and-internet-access)

30 +3. [**Microsoft traffic with Palo Alto Prisma Access for Private Application and Internet Access**](#microsoft-traffic-with-palo-alto-prisma-access-for-private-application-and-internet-access)

3131

3232 In this scenario Global Secure Access will handle all Microsoft 365 traffic. Prisma Access will handle Private applications via service connection or ZTNA connectors. Internet traffic will be handled by Prisma Access.

3333

34 −4. [**Microsoft Entra Internet Access and Microsoft Entra Microsoft Access with Palo Alto Prisma Access for Private Application Access**](#microsoft-entra-internet-access-and-microsoft-entra-microsoft-access-with-palo-alto-prisma-access-for-private-application-access)

34 +4. [**Microsoft Entra Internet Access and Microsoft traffic with Palo Alto Prisma Access for Private Application Access**](#microsoft-entra-internet-access-and-microsoft-traffic-with-palo-alto-prisma-access-for-private-application-access)

3535

3636 In this scenario Global Secure Access will handle Internet and Microsoft 365 traffic. Prisma Access will only capture private application traffic via service connection or ZTNA connectors.

3737

⋯ 144 unchanged lines

182182 13. In the system tray, right-click **Global Secure Access Client** and then select **Advanced Diagnostics**. In the network traffic dialog box, select **Stop collecting**.

183183 14. Scroll to confirm the Global Secure Access client handled private application traffic for the SMB file share and didn't handle the RDP session traffic.

184184

185 −## Microsoft Entra Microsoft Access with Palo Alto Prisma Access for Private Application and Internet Access

185 +## Microsoft traffic with Palo Alto Prisma Access for Private Application and Internet Access

186186

187187 In this scenario Global Secure Access will handle all Microsoft 365 traffic. Prisma Access will handle Private applications via service connection or ZTNA connectors and Internet traffic.

188188

189 −**Microsoft Entra Microsoft Access configuration**

189 +**Microsoft traffic configuration**

190190

191191 For this scenario you will need to:

192192

193 −- [Enable Microsoft Entra Microsoft Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-profile.md#enable-the-microsoft-traffic-profile).

193 +- [Enable Microsoft traffic forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-profile.md#enable-the-microsoft-traffic-profile).

194194 - Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client) or [macOS](/entra/global-secure-access/how-to-install-macos-client).

195195

196196 **Palo Alto Networks configuration**

⋯ 36 unchanged lines

233233 15. You can also validate that the traffic is captured in the Global Secure Access traffic logs. In the Microsoft Entra admin center, navigate to **Global Secure Access** \> **Monitor** \> **Traffic logs**.

234234 16. Validate traffic related to Outlook Online and SharePoint Online is missing from Prisma Access logs in Strata Cloud Manager **Incidents & Alerts** \> **Log Viewer**.

235235

236 −## Microsoft Entra Internet Access and Microsoft Entra Microsoft Access with Palo Alto Prisma Access for Private Application Access

236 +## Microsoft Entra Internet Access and Microsoft traffic with Palo Alto Prisma Access for Private Application Access

237237

238238 In this scenario Global Secure Access will handle Internet and Microsoft traffic. Prisma Access will only capture private application traffic via service connection or ZTNA connectors.

239239

240 −**Microsoft Entra Internet and Microsoft Access configuration**

240 +**Microsoft Entra Internet Access and Microsoft traffic configuration**

241241

242242 For this scenario you will need to do the following.

243243

244 −- [Enable Microsoft Entra Microsoft Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-profile.md#enable-the-microsoft-traffic-profile) and [Microsoft Entra Internet Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-internet-access-profile.md#prerequisites).

244 +- [Enable Microsoft traffic forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-microsoft-profile.md#enable-the-microsoft-traffic-profile) and [Microsoft Entra Internet Access forwarding profile](https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/global-secure-access/how-to-manage-internet-access-profile.md#prerequisites).

245245 - Install and configure the [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client) or [macOS](/entra/global-secure-access/how-to-install-macos-client).

246246 - Add a Microsoft Entra Internet Access traffic forwarding profile custom bypass to exclude Prisma Access service FQDN.

247247

⋯ 41 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:50 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.