GSA known limitations
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit b5c9d69 · +1 −1 lines · also on GitHub
⋯ 287 unchanged lines
288288
- **All internet apps with Global Secure Access** resource in Conditional Access does not include **GSA-ExplicitForwardProxy** resource. If you use the **All internet apps with Global Secure Access** for security profile assignment, you must create a separate policy targeting **GSA-ExplicitForwardProxy** as the resource and specifying the Global Secure Access profile to be used on the **Session** tab of Conditional Access policy.
289289
- If you apply Conditional Access Policy requiring Compliant Network to be satisfied for All Apps, you must exclude the **GSA-ExplicitForwardProxy** resource from that policy. EFP requires Entra ID authentication prior to the connection - Entra ID traffic must always be excluded from proxy automatic configuration (PAC) files. Because Entra ID traffic is not going through EFP, Compliant Network check will fail, unless the **GSA-ExplicitForwardProxy** principal is excluded from the policy.
290290
- On MacOS, coexistence of GSA client and EFP settings are not supported due to client certificate issues.
291
−- Microsoft Office 365 traffic should not be tunneled to EFP. EFP-hosted PAC file excludes Office 365 destinations. Office 365 traffic is defined in the [Microsoft365 IP and FQDN list](https://aka.ms/m365iplist)
291
+- Microsoft Office 365 traffic should not be tunneled to EFP. EFP-hosted PAC file excludes Office 365 destinations. Office 365 traffic is defined in the [Microsoft 365 IP and FQDN list](https://aka.ms/m365iplist)
292292
- EFP supports Microsoft Entra Internet Access traffic type. Private Access and Microsoft Traffic are not supported when users configure EFP.
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:20 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.