GSA traffic forwarding profiles
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit f193d49 · +7 −7 lines · also on GitHub
⋯ 66 unchanged lines
6767
6868
## Entra traffic
6969
70
−The Entra traffic is a dedicated system profile within Global Secure Access that handles all authentication and identity-related traffic for Microsoft Entra services. This profile is designed to operate independently of other traffic profiles (such as Private or Internet Access), ensuring that identity traffic is always acquired and protected, regardless of SKU or license assignment. Being a system managed profile, it is not exposed to admins in the portal.
70
+The Microsoft Entra traffic profile is a dedicated system profile within Global Secure Access that handles all authentication and identity-related traffic for Microsoft Entra services. This profile operates independently of other traffic profiles (such as Private or Internet Access), ensuring that identity traffic is always acquired and protected, regardless of SKU or license assignment. As a system managed profile, admins don't see it in the portal.
7171
72
−Key Characteristics:
72
+Key characteristics:
7373
74
−- Always On with Any Profile: Entra traffic is automatically enabled whenever any other traffic forwarding profile is active. It cannot be enabled or disabled independently.
75
−- Highest Policy Priority: Entra traffic is prioritized in the client policy to ensure it is always processed first, leveraging mTLS/certificate-based authentication for secure tunneling.
76
−- No Explicit Assignment Needed: There is no need for explicit user or branch assignment; Entra traffic is included automatically with any active profile.
77
−- Comprehensive Coverage: The profile covers a defined set of FQDNs and IP ranges associated with Microsoft Entra authentication endpoints, including login, Graph API, and certificate validation services.
74
+- **Always on with any profile**: Entra traffic automatically enables whenever any other traffic forwarding profile is active. You can't enable or disable it independently.
75
+- **Highest policy priority**: Entra traffic is prioritized in the client policy to ensure it's always processed first, leveraging mTLS and certificate-based authentication for secure tunneling.
76
+- **No explicit assignment needed**: You don't need explicit user or branch assignment. Entra traffic is included automatically with any active profile.
77
+- **Comprehensive coverage**: The profile covers a defined set of FQDNs and IP ranges associated with Microsoft Entra authentication endpoints, including login, Graph API, and certificate validation services.
7878
7979
> [!NOTE]
80
−> If you use Network conditions in Conditional Access policies, ensure CA signaling for Entra ID in enabled in Global Secure Access. See [Enable Global Secure Access signaling for Conditional Access](how-to-source-ip-restoration.md).
80
+> If you use Network conditions in Conditional Access policies, enable Conditional Access signaling for Entra ID in Global Secure Access. See [Enable Global Secure Access signaling for Conditional Access](how-to-source-ip-restoration.md).
8181
8282
## Next steps
8383
⋯ 5 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:06 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.