GSA proxy configuration requirements

This page's changes and edits · All guidance changes

Microsoft's edit · 29 Apr 01:00 UTC

Updating based on reviewer's comments

Microsoft's commit message in MicrosoftDocs/entra-docs · commit a3235de · +7 −5 lines · also on GitHub

⋯ 11 unchanged lines

1212

1313 A PAC file is a mechanism used to automatically determine which proxy server a web browser or application should use for a given request. PAC files are an integral part of Explicit Forward Proxy configuration, enabling flexible and dynamic traffic steering decisions. In the context of Global Secure Access, PAC files are similar to the traffic forwarding policies of the GSA client.

1414

15 −## How PAC Files Work

15 +## How PAC files work

1616

1717 Once configured, PAC files operate by providing browsers with a JavaScript function called **FindProxyForURL**. When a browser requests a resource, it calls this function, which then evaluates conditions---such as destination address, protocol, or hostname---and returns a directive indicating which proxy (or proxies) to use, or whether to connect directly (bypass). This approach allows for granular control over network traffic, enabling you to define routing logic tailored to your specific needs.

1818

19 −## PAC File Structure and Syntax

19 +## PAC file structure and syntax

2020

2121 The core of a PAC file is the JavaScript block that defines the **FindProxyForURL(url, host)** function. Within this function, you can use JavaScript constructs like **if** statements, regular expressions, and built-in helper functions (e.g., **dnsDomainIs**, **isInNet**, **shExpMatch**) to determine proxy behavior. The function returns a string specifying proxy settings, such as **\"PROXY *tenantID*.internet.efp.globalsecureaccess.microsoft.com:443\"** for proxy use or **\"DIRECT\"** for direct connections.

2222

23 −The below example PAC file snippet shows a configuration where Entra ID login is allowed to be accessed directly (required for EFP for Internet Access), while all other URLs are accessed via EFP:

23 +The example PAC file snippet shows a configuration where Entra ID login is allowed to be accessed directly (required for EFP for Internet Access), while all other URLs are accessed via EFP:

2424

25 +```javascript

2526 function FindProxyForURL(url, host) {

2627

2728 if (dnsDomainIs(host, \"login.microsoftonline.com\"))

⋯ 5 unchanged lines

3334 return \"PROXY *tenantId*.internet.efp.globalsecureaccess.microsoft.com:443\";

3435

3536 }

37 +```

3638

37 −## Applying PAC File Settings to Browsers

39 +## Applying PAC file settings to browsers

3840

3941 The mechanism for applying PAC file settings varies depending on device management and browser type. On managed devices, such as those governed by browser policy or enterprise mobility management, you can distribute PAC file URLs or content through centralized configuration tools. For unmanaged devices, you can instruct end users to manually enter the PAC file location in browser settings or rely on network-provided configuration (such as DHCP or WPAD).

4042

41 −## Next Steps

43 +## Next steps

4244

4345 [Learn How to Configure Explicit Forward Proxy](how-to-configure-explicit-forward-proxy.md)

4446 [Configure Microsoft Edge MAM policy for explicit forward proxy](how-to-configure-explicit-forward-proxy-intune-policy.md)

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:59 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.