GSA traffic forwarding profiles
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 3938e78 · +32 −11 lines · also on GitHub
11
---
22
title: Global Secure Access traffic forwarding profiles
3
−description: Learn about how traffic forwarding profiles for Global Secure Access streamline how you route traffic through your network.
3
+description: Learn how Global Secure Access traffic forwarding profiles route traffic and how multiple Private Access profiles provide granular application and assignment control.
44
ms.topic: concept-article
5
−ms.date: 03/12/2026
5
+ms.date: 09/20/2026
66
ms.reviewer: katabish
77
ai-usage: ai-assisted
88
---
⋯ 2 unchanged lines
1111
1212
## Overview
1313
14
−You use traffic forwarding profiles in Global Secure Access to apply policies to the network traffic that your organization wants to secure and manage. Network traffic is evaluated against the traffic forwarding policies you configure. The profiles are applied and the traffic goes through the service to the appropriate apps and resources.
14
+You use traffic forwarding profiles in Global Secure Access to apply policies to the network traffic that your organization wants to secure and manage. Network traffic is evaluated against the traffic forwarding profiles you configure. The applicable profile is applied, and traffic is forwarded through the service to the appropriate applications and resources.
1515
1616
This article describes the traffic forwarding profiles and how they work.
1717
1818
## Traffic forwarding
1919
20
−**Traffic forwarding** enables you to configure the type of network traffic to tunnel through the Microsoft Entra Private Access and Microsoft Entra Internet Access services. You set up profiles to manage how specific types of traffic are managed.
20
+**Traffic forwarding** enables you to configure the type of network traffic to tunnel through Microsoft Entra Private Access and Microsoft Entra Internet Access. You set up profiles to manage how specific types of traffic are handled.
2121
22
−When traffic comes through Global Secure Access, the service evaluates the type of traffic first through the **Microsoft access profile**, then through the **Private access profile**, and finally through the **Internet access profile**. Any traffic that doesn't match these three profiles isn't forwarded to Global Secure Access.
22
+When traffic comes through Global Secure Access, the service evaluates the traffic type first through the **Microsoft access profile**, then through the **Private access profile**, and finally through the **Internet access profile**. Traffic that doesn't match these profile types isn't forwarded to Global Secure Access.
2323
2424
For each traffic forwarding profile, you can configure:
2525
26
−- Which users receive the traffic forwarding profile and how your users connect to the service
27
−- Which traffic to forward to the service
28
−- What Conditional Access policies to apply
26
+- Which users and devices receive the profile.
27
+- Which device platforms receive the profile.
28
+- Which traffic is forwarded to the service.
29
+- Which Conditional Access policies apply to the resources.
2930
31
+## Profile priority and assignment
32
+
33
+You can assign traffic forwarding profiles to users, groups, devices, and device platforms. User and device assignments are evaluated together with device-platform assignments.
34
+
35
+When multiple enabled profiles for the same traffic type apply to a user and device, only the applicable profile with the highest priority is used by the client.
36
+
37
+For assignment details and examples, see [Assign users and devices to traffic forwarding profiles](how-to-manage-users-groups-assignment.md).
38
+
3039
## Microsoft traffic
3140
3241
The Microsoft traffic forwarding profile includes Microsoft Teams, SharePoint Online, Exchange Online, and other Microsoft apps. Traffic forwarding policies are grouped based on the workload - for example, Exchange Online. You can choose to either forward the traffic from each group to Global Secure Access, or to bypass it.
⋯ 10 unchanged lines
4352
4453
## Private access
4554
46
−With the Private Access profile, you can route traffic to your private resources. This traffic forwarding profile requires configuring Quick Access, which includes the fully qualified domain names (FQDNs) and IP addresses of the private apps and resources you want to forward to the service.
55
+Private Access traffic forwarding profiles route traffic to private resources through the Global Secure Access client. Private resource definitions come from Quick Access and Private Access enterprise applications.
4756
48
−Private access traffic can be forwarded to the service by connecting through the [Global Secure Access desktop client](how-to-install-windows-client.md).
57
+Every tenant has a default Private Access profile. You can also create custom Private Access profiles to:
4958
59
+- Provide different application sets to different users or devices.
60
+- Separate traffic acquisition by device platform, such as desktop and mobile platforms.
61
+- Gradually deploy Private Access to selected users, groups, or devices.
62
+- Exclude privileged or sensitive applications from a broadly assigned profile.
63
+
64
+Each custom profile has its own acquisition rules, assignments, status, and priority. During preview, you can create up to 10 custom Private Access profiles.
65
+
66
+Private access traffic is forwarded by the [Global Secure Access client](concept-clients.md).
67
+
5068
### Licensing
5169
5270
Private Access profile requires the following licenses:
⋯ 34 unchanged lines
87105
## Next steps
88106
89107
- [Learn more about the Microsoft traffic profile](concept-microsoft-traffic-profile.md)
108
+- [Create a Private Access traffic forwarding profile](how-to-create-traffic-forwarding-profile.md)
109
+- [Delete a Private Access traffic forwarding profile](how-to-delete-traffic-forwarding-profile.md)
90110
- [Manage the Microsoft traffic profile](how-to-manage-microsoft-profile.md)
91111
- [Manage the Internet access traffic profile](how-to-manage-internet-access-profile.md)
92
−- [Manage the Private access traffic profile](how-to-manage-private-access-profile.md)
112
+- [Manage Private Access traffic forwarding profiles](how-to-manage-private-access-profile.md)
113
+- [Assign users and devices to traffic forwarding profiles](how-to-manage-users-groups-assignment.md)
93114
- [Configure Quick Access](how-to-configure-quick-access.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:06 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.