GSA traffic forwarding profiles
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit b8810c9 · +13 −6 lines · also on GitHub
⋯ 4 unchanged lines
55
ms.author: kenwith
66
manager: dougeby
77
ms.topic: article
8
−ms.date: 02/21/2025
8
+ms.date: 01/12/2025
99
ms.service: global-secure-access
1010
ms.reviewer: katabish
1111
ai-usage: ai-assisted
⋯ 19 unchanged lines
3131
3232
## Microsoft traffic
3333
34
−The Microsoft traffic forwarding profile includes Microsoft Entra ID/ Microsoft Graph, SharePoint Online, Exchange Online, and other Microsoft apps. Traffic forwarding policies are grouped based on the workload - for example, Exchange Online. You can choose to either forward the traffic from each group to Global Secure Access, or to bypass it.
34
+The Microsoft traffic forwarding profile includes Microsoft Teams, SharePoint Online, Exchange Online, and other Microsoft apps. Traffic forwarding policies are grouped based on the workload - for example, Exchange Online. You can choose to either forward the traffic from each group to Global Secure Access, or to bypass it.
3535
3636
Microsoft traffic is forwarded to the service through either [remote network connectivity](concept-remote-network-connectivity.md), such as branch office location, or through the [Global Secure Access client](how-to-install-windows-client.md).
3737
⋯ 27 unchanged lines
6565
6666
Internet access traffic can be forwarded to the service by connecting through the [Global Secure Access desktop client](how-to-install-windows-client.md).
6767
68
−### Licensing
68
+## Entra traffic
6969
70
−Internet access profile requires the following licenses:
70
+The Entra traffic is a dedicated system profile within Global Secure Access that handles all authentication and identity-related traffic for Microsoft Entra services. This profile is designed to operate independently of other traffic profiles (such as Private or Internet Access), ensuring that identity traffic is always acquired and protected, regardless of SKU or license assignment. Being a system managed profile, it is not exposed to admins in the portal.
7171
72
−- Microsoft Entra ID P1 or P2 (prerequisite).
73
−- Microsoft Entra Internet Access or Microsoft Entra Suite.
72
+Key Characteristics:
73
+
74
+- Always On with Any Profile: Entra traffic is automatically enabled whenever any other traffic forwarding profile is active. It cannot be enabled or disabled independently.
75
+- Highest Policy Priority: Entra traffic is prioritized in the client policy to ensure it is always processed first, leveraging mTLS/certificate-based authentication for secure tunneling.
76
+- No Explicit Assignment Needed: There is no need for explicit user or branch assignment; Entra traffic is included automatically with any active profile.
77
+- Comprehensive Coverage: The profile covers a defined set of FQDNs and IP ranges associated with Microsoft Entra authentication endpoints, including login, Graph API, and certificate validation services.
78
+
79
+> [!NOTE]
80
+> If you use Network conditions in Conditional Access policies, ensure CA signaling for Entra ID in enabled in Global Secure Access. See [Enable Global Secure Access signaling for Conditional Access](how-to-source-ip-restoration.md).
7481
7582
## Next steps
7683
⋯ 5 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:06 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.