GSA known limitations

This page's changes and edits · All guidance changes

Microsoft's edit · 26 Feb 20:45 UTC

update url filtering documentation for GA

Microsoft's commit message in MicrosoftDocs/entra-docs · commit e180b5d · +5 −5 lines · also on GitHub

⋯ 4 unchanged lines

55 author: HULKsmashGithub

66 ms.topic: reference

77 ms.author: jayrusso

8 −ms.date: 02/24/2026

8 +ms.date: 11/07/2025

99 ms.custom: agent-id-ignite

1010

1111

⋯ 140 unchanged lines

152152            return "PROXY 10.1.0.10:8080";  // forward the connection to the proxy

153153 }

154154 ```

155 −> [!IMPORTANT]

156 −> If the Global Secure Access client is behind an outbound proxy, configure the PAC file exclusions as described previously to bypass the proxy for Global Secure Access traffic.

155 +If a direct internet connection isn't possible, configure the client to connect to the Global Secure Access service through a proxy. For example, set the `grpc_proxy` system variable to match the value of the proxy, such as `http://proxy:8080`.

157156

157 +To apply the configuration changes, restart the Global Secure Access client Windows services.

158 +

158159 #### Packet injection

159160 The client only tunnels traffic sent using sockets. It doesn't tunnel traffic injected to the network stack using a driver (for example, some of the traffic generated by Network Mapper (Nmap)). Injected packets go directly to the network.

160161

⋯ 59 unchanged lines

220221 Known limitations for remote networks include:

221222 - The maximum number of remote networks per tenant is 200, and the maximum number of device links per remote network is 25. To increase these limits further for your tenant, contact Microsoft Support.

222223 - Universal Conditional Access lets you apply identity controls like requiring multifactor authentication, requiring a compliant device, or defining an acceptable sign-in risk to network traffic—not just cloud apps. These identity controls apply to devices with the Global Secure Access client installed. Remote network connectivity is a clientless approach where customers create an IPsec tunnel from their on-premises equipment to the Global Secure Access edge service. Network traffic from all devices at that remote network (or branch office) is sent to Global Secure Access through the IPsec tunnel. In other words, Conditional Access policies for Microsoft or Internet traffic are only enforced when a user has the Global Secure Access client.

223 −- Use the Global Secure Access client for Microsoft Entra Private Access. Remote network connectivity supports the Microsoft traffic and Internet Access traffic forwarding profiles.

224 +- Use the Global Secure Access client for Microsoft Entra Private Access. Remote network connectivity supports only Microsoft Entra Internet Access.

224225 - Internet over remote network connectivity is supported only in the specific regions listed in the **Region** drop-down when you create a remote network.

225226 - The [Custom Bypass](how-to-manage-internet-access-profile.md#internet-access-traffic-forwarding-profile-policies) feature in the Internet traffic forwarding profile doesn't work with remote network connectivity. You must manually bypass specific URLs from your Customer Premises Equipment (CPE).

226227

⋯ 32 unchanged lines

259260 Known limitations for Internet Access include:

260261 - An admin can create up to 256 security profiles per tenant, up to 1,000 policies per tenant, and up to 1,000 rules per tenant.

261262 - An admin can configure 8,000 total destinations (which can be any combination of IP, FQDN, URL, or web category) in each tenant. For example, within a single tenant can create up to two policies targeting 4,000 domains each *or* up to 1,000 policies with eight domains each.

262 −- Admins can currently configure rules based on up to 1,000 total URLs.

263263 - TLS inspection supports up to 100 TLS inspection policies, 1,000 rules, and 8,000 destinations.

264264 - The platform assumes standard ports for HTTP/S traffic (ports 80 and 443).

265265 - The Global Secure Access client doesn't support IPv6. The client tunnels only IPv4 traffic and transfers IPv6 traffic directly to the network. To make sure that all traffic routes to Global Secure Access, set the network adapter properties to [IPv4 preferred](troubleshoot-global-secure-access-client-diagnostics-health-check.md#ipv4-preferred).

⋯ 14 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:20 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.