GSA explicit forward proxy
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 9fab986 · +28 −25 lines · also on GitHub
11
---
2
−title: Learn how to configure Explicit Forward Proxy
3
−description: Learn how to configure Explicit Forward Proxy
4
−ms.topic: concept-article
2
+title: Configure Explicit Forward Proxy
3
+description: Learn how to configure Explicit Forward Proxy.
4
+ms.topic: how-to
55
ms.date: 04/06/2026
66
ms.author: alexpav
77
author: idmdev
88
ms.reviewer:
99
---
1010
11
−# How to Configure Explicit Forward Proxy (preview)
11
+# Configure Explicit Forward Proxy (preview)
1212
13
−Explicit Forward Proxy (EFP) allows you to use Secure Web and AI Gateway capabilities of Microsoft Entra Internet Access without installing the Global Secure Access (GSA) client. EFP works with any browser that supports proxy automatic configuration (PAC).
13
+With Explicit Forward Proxy, you can use the secure web and AI gateway capabilities of Microsoft Entra Internet Access without installing the Global Secure Access client. Explicit Forward Proxy works with any browser that supports proxy automatic configuration (PAC).
1414
1515
> [!IMPORTANT]
16
−> The Explicit Forward Proxy feature is currently in PREVIEW.
17
−> This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
16
+> The Explicit Forward Proxy feature is currently in preview. This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
1817
1918
## Prerequisites
2019
2120
- Ensure that you have the following Microsoft Entra admin roles:
22
− - The Global Secure Access Administrator role to manage the GSA features
23
− - The Conditional Access Administrator role to create and manage Microsoft Entra Conditional Access policies.
24
−- Complete the Get started with Global Secure Access guide
25
−- Review the EFP concepts and EFP Session Management concepts.
26
−- Enable the Internet Access traffic forwarding profile
27
−- Configure Transport Layer Security (TLS) Inspection
21
+ - The Global Secure Access Administrator role to manage the Global Secure Access features
22
+ - The Conditional Access Administrator role to create and manage Microsoft Entra Conditional Access policies
23
+- Complete the [guide for getting started with Global Secure Access](/entra/global-secure-access/quickstart-access-admin-center).
24
+- Review the [Explicit Forward Proxy concepts](/entra/global-secure-access/concept-explicit-forward-proxy) and [Explicit Forward Proxy session management concepts](/entra/global-secure-access/concept-explicit-forward-proxy-session-management).
25
+- Enable the Internet Access traffic-forwarding profile.
26
+- Configure Transport Layer Security (TLS) inspection.
2827
29
−## Enable EFP
28
+## Enable Explicit Forward Proxy
3029
31
−You can enable and manage EFP using the Microsoft Entra admin portal.
32
−1. Sign in to https://entra.microsoft.com
33
−1. Navigate to Global Secure Access > Session management and navigate to the Explicit Forward Proxy tab.
34
−1. Toggle the Internet Access setting to On. By default, Smart Session Management is enabled when you enable EFP.
35
−1. Optionally, enable HTTP Header Session Management. For more information, see [Configure HTTP Header Session management](how-to-configure-explicit-forward-proxy-headers.md).
30
+You can enable and manage Explicit Forward Proxy by using the Microsoft Entra admin portal:
3631
37
− :::image type="content" border="true" source="./media/how-to-configure-explicit-forward-proxy/enable-explicit-forward-proxy.png" alt-text="Screenshot of the Configure EFP screen." lightbox="./media/how-to-configure-explicit-forward-proxy/enable-explicit-forward-proxy.png":::
32
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
3833
34
+1. Go to **Global Secure Access** > **Session management**, and then select the **Explicit Forward Proxy** tab.
35
+
36
+1. Set the **Internet Access** toggle to **Enabled**. By default, smart session management is enabled when you enable Explicit Forward Proxy.
37
+
38
+1. Optionally, enable HTTP header session management. For more information, see [Configure HTTP header session management](how-to-configure-explicit-forward-proxy-headers.md).
39
+
40
+:::image type="content" border="true" source="./media/how-to-configure-explicit-forward-proxy/enable-explicit-forward-proxy.png" alt-text="Screenshot of the tab in the Microsoft Entra admin center for configuring Explicit Forward Proxy." lightbox="./media/how-to-configure-explicit-forward-proxy/enable-explicit-forward-proxy.png":::
41
+
3942
> [!IMPORTANT]
40
−> EFP session management relies on IP affinity as one of the session management anchors. We recommend that you configure a Conditional Access policy that restricts the use of EFP to networks you trust. For more information, please see EFP Session Management and Configure Conditional Access Policy for EFP.
43
+> Explicit Forward Proxy session management relies on IP affinity as one of the session management anchors. We recommend that you configure a Conditional Access policy that restricts the use of Explicit Forward Proxy to networks you trust. For more information, see [Explicit Forward Proxy session management](/entra/global-secure-access/concept-explicit-forward-proxy-session-management) and [Configure a Conditional Access policy for Explicit Forward Proxy](/entra/global-secure-access/how-to-configure-conditional-access-policy-for-explicit-forward-proxy).
4144
42
−## Next steps
45
+## Related content
4346
44
−[Configure Conditional Access Policy for Explicit Forward Proxy](how-to-configure-conditional-access-policy-for-explicit-forward-proxy.md)
45
−[Configure HTTP Header Session management](how-to-configure-explicit-forward-proxy-headers.md)
46
−[Configure EFP in Microsoft Edge using Intune Mobile Application Management (MAM)](how-to-configure-explicit-forward-proxy-intune-policy.md)
47
+- [Configure a Conditional Access policy for Explicit Forward Proxy](how-to-configure-conditional-access-policy-for-explicit-forward-proxy.md)
48
+- [Configure HTTP header session management](how-to-configure-explicit-forward-proxy-headers.md)
49
+- [Configure Explicit Forward Proxy in Microsoft Edge by using Intune mobile application management](how-to-configure-explicit-forward-proxy-intune-policy.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:59 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.