GSA explicit forward proxy
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 27e2b33 · +48 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: Learn How to Configure Explicit Forward Proxy
3
+description: Learn How to Configure Explicit Forward Proxy
4
+ms.topic: concept-article
5
+ms.date: 04/06/2026
6
+ms.author: alexpav
7
+author: idmdev
8
+ms.reviewer:
9
+---
10
+
11
+# How to Configure Explicit Forward Proxy (preview)
12
+
13
+## Overview
14
+
15
+Explicit Forward Proxy (EFP) allows you to use Secure Web and AI Gateway capabilities of Microsoft Entra Internet Access without installing the Global Secure Access (GSA) client. EFP works with any browser that supports proxy automatic configuration (PAC).
16
+
17
+> [!IMPORTANT]
18
+> The Explicit Forward Proxy feature is currently in PREVIEW.
19
+> This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
20
+
21
+## Prerequisites
22
+
23
+- Ensure that you have the following Microsoft Entra admin roles:
24
+ - The Global Secure Access Administrator role to manage the GSA features
25
+ - The Conditional Access Administrator role to create and manage Microsoft Entra Conditional Access policies.
26
+- Complete the Get started with Global Secure Access guide
27
+- Review the EFP concepts and EFP Session Management concepts.
28
+- Enable the Internet Access traffic forwarding profile
29
+- Configure Transport Layer Security (TLS) Inspection
30
+
31
+## Enable EFP
32
+
33
+You can enable and manage EFP using the Microsoft Entra admin portal.
34
+1. Sign in to https://entra.microsoft.com
35
+1. Navigate to Global Secure Access > Session management and navigate to the Explicit Forward Proxy tab.
36
+1. Toggle the Internet Access setting to On. By default, Smart Session Management is enabled when you enable EFP.
37
+1. Optionally, enable HTTP Header Session Management. For more information, see [Configure HTTP Header Session management](how-to-configure-explicit-forward-proxy-headers.md).
38
+
39
+ :::image type="content" border="true" source="./media/how-to-configure-explicit-forward-proxy/enable-explicit-forward-proxy.png" alt-text="Screenshot of the Configure EFP screen." lightbox="./media/how-to-configure-explicit-forward-proxy/enable-explicit-forward-proxy.png":::
40
+
41
+> [!IMPORTANT]
42
+> EFP session management relies on IP affinity as one of the session management anchors. We recommend that you configure a Conditional Access policy that restricts the use of EFP to networks you trust. For more information, please see EFP Session Management and Configure Conditional Access Policy for EFP.
43
+
44
+## Next Steps
45
+
46
+[Configure Conditional Access Policy for Explicit Forward Proxy](how-to-configure-conditional-access-policy-for-explicit-forward-proxy.md)
47
+[Configure HTTP Header Session management](how-to-configure-explicit-forward-proxy-headers.md)
48
+[Configure EFP in Microsoft Edge using Intune Mobile Application Management (MAM)](how-to-configure-explicit-forward-proxy-intune-policy.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 17:01 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.