GSA points of presence and IP addresses
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 78e2b06 · +0 −9 lines · also on GitHub
⋯ 2 unchanged lines
33
description: Global Secure Access points of presence and IP addresses for Microsoft Entra Internet Access and Microsoft Entra Private Access.
44
author: kenwith
55
ms.author: kenwith
6
−manager: dougeby
76
ms.topic: reference
87
ms.date: 08/28/2025
98
ms.service: global-secure-access
⋯ 81 unchanged lines
9190
9291
## IP addresses and Fully Qualified Domain Names (FQDNs) for Global Secure Access service
9392
The Global Secure Access service is accessed from the Global Secure Access client and is used for Microsoft Entra Internet Access (including Microsoft 365) and Microsoft Entra Private Access traffic. The Internet Protocol (IP) addresses are listed.
94
−
95
−> [!IMPORTANT]
96
−> Global Secure Access doesn’t provide dedicated or static public IP addresses per individual data center or geographic location.
97
−>
98
−> The service uses Anycast networking, which dynamically routes traffic to the nearest available Microsoft point of presence.
99
−> Because of this architecture, Microsoft can’t publish or guarantee fixed IP addresses per region or physical location.
100
−>
101
−> For perimeter firewall configuration, customers must allow the global Anycast IP ranges listed below. These IP ranges represent all Global Secure Access service entry points worldwide.
10293
10394
### FQDN and IP addresses where the Global Secure Access service receives traffic
10495
Add Anycast IP ranges for accessing the Global Secure Access service edge to your enterprise Access Control Lists (ACLs) and firewalls. When operating in a side-by-side model with other Security Service Edge (SSE) clients, add the Anycast IP ranges to these other clients. If you are using TLS inspection on your egress firewalls, exclude GSA traffic from TLS inspection.
⋯ 16 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.