GSA traffic forwarding profiles
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 732dc56 · +6 −6 lines · also on GitHub
⋯ 1 unchanged line
22
title: Global Secure Access traffic forwarding profiles
33
description: Learn about how traffic forwarding profiles for Global Secure Access streamline how you route traffic through your network.
44
ms.topic: concept-article
5
−ms.date: 01/12/2026
5
+ms.date: 03/12/2026
66
ms.reviewer: katabish
77
ai-usage: ai-assisted
88
---
⋯ 59 unchanged lines
6868
- Microsoft Entra ID P1 or P2 (prerequisite).
6969
- Microsoft Entra Internet Access or Microsoft Entra Suite.
7070
71
−## Entra traffic
71
+## Microsoft Entra traffic
7272
7373
The Microsoft Entra traffic profile is a dedicated system profile within Global Secure Access that handles all authentication and identity-related traffic for Microsoft Entra services. This profile operates independently of other traffic profiles (such as Private or Internet Access), ensuring that identity traffic is always acquired and protected, regardless of SKU or license assignment. As a system managed profile, admins don't see it in the portal.
7474
7575
Key characteristics:
7676
77
−- **Always on with any profile**: Entra traffic automatically enables whenever any other traffic forwarding profile is active. You can't enable or disable it independently.
78
−- **Highest policy priority**: Entra traffic is prioritized in the client policy to ensure it's always processed first, leveraging mTLS and certificate-based authentication for secure tunneling.
79
−- **No explicit assignment needed**: You don't need explicit user or branch assignment. Entra traffic is included automatically with any active profile.
77
+- **Always on with any profile**: Microsoft Entra traffic automatically enables whenever any other traffic forwarding profile is active. You can't enable or disable it independently.
78
+- **Highest policy priority**: Microsoft Entra traffic is prioritized in the client policy to ensure it's always processed first, leveraging mTLS and certificate-based authentication for secure tunneling.
79
+- **No explicit assignment needed**: You don't need explicit user or branch assignment. Microsoft Entra traffic is included automatically with any active profile.
8080
- **Comprehensive coverage**: The profile covers a defined set of FQDNs and IP ranges associated with Microsoft Entra authentication endpoints, including login, Graph API, and certificate validation services.
8181
8282
> [!NOTE]
83
−> If you use Network conditions in Conditional Access policies, enable Conditional Access signaling for Entra ID in Global Secure Access. See [Enable Global Secure Access signaling for Conditional Access](how-to-source-ip-restoration.md).
83
+> If you use Network conditions in Conditional Access policies, enable Conditional Access signaling for Microsoft Entra ID in Global Secure Access. See [Enable Global Secure Access signaling for Conditional Access](how-to-source-ip-restoration.md).
8484
8585
## Next steps
8686
⋯ 5 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:06 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.