GSA points of presence and IP addresses
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 9e707df · +8 −0 lines · also on GitHub
⋯ 91 unchanged lines
9292
## IP addresses and Fully Qualified Domain Names (FQDNs) for Global Secure Access service
9393
The Global Secure Access service is accessed from the Global Secure Access client and is used for Microsoft Entra Internet Access (including Microsoft 365) and Microsoft Entra Private Access traffic. The Internet Protocol (IP) addresses are listed.
9494
95
+> [!IMPORTANT]
96
+> Global Secure Access doesn’t provide dedicated or static public IP addresses per individual data center or geographic location.
97
+>
98
+> The service uses Anycast networking, which dynamically routes traffic to the nearest available Microsoft point of presence.
99
+> Because of this architecture, Microsoft can’t publish or guarantee fixed IP addresses per region or physical location.
100
+>
101
+> For perimeter firewall configuration, customers must allow the global Anycast IP ranges listed below. These IP ranges represent all Global Secure Access service entry points worldwide.
102
+
95103
### FQDN and IP addresses where the Global Secure Access service receives traffic
96104
Add Anycast IP ranges for accessing the Global Secure Access service edge to your enterprise Access Control Lists (ACLs) and firewalls. When operating in a side-by-side model with other Security Service Edge (SSE) clients, add the Anycast IP ranges to these other clients. If you are using TLS inspection on your egress firewalls, exclude GSA traffic from TLS inspection.
97105
⋯ 15 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.