GSA proxy configuration requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 27e2b33 · +44 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: Learn about Proxy Automatic Configuration (PAC)
3
+description: Learn about Explicit Forward Proxy PAC file concepts
4
+ms.topic: concept-article
5
+ms.date: 04/06/2026
6
+ms.author: alexpav
7
+author: idmdev
8
+ms.reviewer:
9
+---
10
+
11
+# Introduction to Proxy Automatic Configuration (PAC) Files
12
+
13
+A PAC file is a mechanism used to automatically determine which proxy server a web browser or application should use for a given request. PAC files are an integral part of Explicit Forward Proxy configuration, enabling flexible and dynamic traffic steering decisions. In the context of Global Secure Access, PAC files are similar to the traffic forwarding policies of the GSA client.
14
+
15
+## How PAC Files Work
16
+
17
+Once configured, PAC files operate by providing browsers with a JavaScript function called **FindProxyForURL**. When a browser requests a resource, it calls this function, which then evaluates conditions---such as destination address, protocol, or hostname---and returns a directive indicating which proxy (or proxies) to use, or whether to connect directly (bypass). This approach allows for granular control over network traffic, enabling you to define routing logic tailored to your specific needs.
18
+
19
+## PAC File Structure and Syntax
20
+
21
+The core of a PAC file is the JavaScript block that defines the **FindProxyForURL(url, host)** function. Within this function, you can use JavaScript constructs like **if** statements, regular expressions, and built-in helper functions (e.g., **dnsDomainIs**, **isInNet**, **shExpMatch**) to determine proxy behavior. The function returns a string specifying proxy settings, such as **\"PROXY *tenantID*.internet.efp.globalsecureaccess.microsoft.com:443\"** for proxy use or **\"DIRECT\"** for direct connections.
22
+
23
+The below example PAC file snippet shows a configuration where Entra ID login is allowed to be accessed directly (required for EFP for Internet Access), while all other URLs are accessed via EFP:
24
+
25
+function FindProxyForURL(url, host) {
26
+
27
+if (dnsDomainIs(host, \"login.microsoftonline.com\"))
28
+
29
+return \"DIRECT\";
30
+
31
+else
32
+
33
+return \"PROXY *tenantId*.internet.efp.globalsecureaccess.microsoft.com:443\";
34
+
35
+}
36
+
37
+## Applying PAC File Settings to Browsers
38
+
39
+The mechanism for applying PAC file settings varies depending on device management and browser type. On managed devices, such as those governed by browser policy or enterprise mobility management, you can distribute PAC file URLs or content through centralized configuration tools. For unmanaged devices, you can instruct end users to manually enter the PAC file location in browser settings or rely on network-provided configuration (such as DHCP or WPAD).
40
+
41
+## Next Steps
42
+
43
+[Learn How to Configure Explicit Forward Proxy](how-to-configure-explicit-forward-proxy.md)
44
+[Configure Microsoft Edge MAM policy for explicit forward proxy](how-to-configure-explicit-forward-proxy-intune-policy.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:37 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.