GSA known limitations
Global Secure Access · Official Microsoft guidance
Observed content change
May need admin actionCheck your firewall and proxy allow lists; check whether a default changed for your tenant or devices.
Changed article references · 1 added · 1 removed
- Removed link: QUIC not supported for Internet Access
troubleshoot-global-secure-access-client-diagnostics-health-check#quic-not-supported-for-internet-access - Added link: Control QUIC traffic on UDP port 443
how-to-configure-cloud-firewall-clients#control-quic-traffic-on-udp-port-443
[added: End-to-end QUIC forwarding isn't supported in Internet Access. Cloud firewall for clients supports QUIC acquisition and blocking in preview.]
Before: No saved wording on this side.
After: End-to-end QUIC forwarding isn't supported in Internet Access. Cloud firewall for clients supports QUIC acquisition and blocking in preview.
[added: Keep QUIC enabled in browsers. Use Custom Acquire to acquire UDP traffic on destination port 443 for the intended destinations, and use cloud firewall to block that traffic. Apply the firewall policy through the security profile for the intended users. Applications that support fallback can then use HTTPS over TCP. Default Acquire on TCP port 443 doesn't acquire UDP port 443, and an Allow rule doesn't enable supported end-to-end QUIC forwarding. For configuration and verification steps, see Control QUIC traffic on UDP port 443.]
Before: No saved wording on this side.
After: Keep QUIC enabled in browsers. Use Custom Acquire to acquire UDP traffic on destination port 443 for the intended destinations, and use cloud firewall to block that traffic. Apply the firewall policy through the security profile for the intended users. Applications that support fallback can then use HTTPS over TCP. Default Acquire on TCP port 443 doesn't acquire UDP port 443, and an Allow rule doesn't enable supported end-to-end QUIC forwarding. For configuration and verification steps, see Control QUIC traffic on UDP port 443.
[removed: Since QUIC isn't yet supported for Internet Access, traffic to ports 80 UDP and 443 UDP can't be tunneled.]
Before: Since QUIC isn't yet supported for Internet Access, traffic to ports 80 UDP and 443 UDP can't be tunneled.
After: No saved wording on this side.
[removed: Administrators can disable QUIC protocol triggering clients to fall back to HTTPS over TCP, which is fully supported in Internet Access. For more information, see QUIC not supported for Internet Access.]
Before: Administrators can disable QUIC protocol triggering clients to fall back to HTTPS over TCP, which is fully supported in Internet Access. For more information, see QUIC not supported for Internet Access.
After: No saved wording on this side.
[removed: QUIC is currently supported in Private Access and Microsoft 365 workloads. Administrators can disable QUIC protocol on browsers, triggering clients to fall back to HTTPS over TCP, which is fully supported in Internet Access. For more information, see QUIC not supported for Internet Access.]
Before: QUIC is currently supported in Private Access and Microsoft 365 workloads. Administrators can disable QUIC protocol on browsers, triggering clients to fall back to HTTPS over TCP, which is fully supported in Internet Access. For more information, see QUIC not supported for Internet Access.
After: No saved wording on this side.
Source: Microsoft source · © Microsoft · MIT.
Read the current Microsoft source · Link to this observation · Compare any two versions
Observation details
- Observed by ChangeIntel
- 7 Nov 04:47 UTC
- Source update metadata
- 6 Nov 23:34 UTC
- Microsoft's latest commit in that period
- Use Custom Acquire and cloud firewall instead of disabling browser QUIC (#14776) · committed 6 Nov 18:34 UTC · View diff
- First observed on this installation
- 6 Oct 08:00 UTC
- Last successful check
- 14 Nov 20:39 UTC
- Next check due
- today 02:39 UTC
Observation time is not publication time, and a comparison does not establish an effective date. Full source bodies are not published; this page holds generated summaries, section headings and, as the page's license allows, Microsoft's changed wording. A documentation edit does not confirm feature availability in an environment. Article references show literal targets and labels, including relative addresses; image bytes are not captured or compared.