GSA Windows client prerequisites and installation

[added: Keep QUIC enabled in users' browsers. To prevent QUIC connections from bypassing Microsoft Entra Internet Access inspection, use Custom Acquire to acquire UDP traffic on destination port 443 for the intended destinations, and use a cloud firewall Block rule for the same traffic. Keep Default Acquire enabled for TCP ports 80 and 443 so that applications that support fallback can connect over HTTPS using TCP.]

Before: No saved wording on this side.

After: Keep QUIC enabled in users' browsers. To prevent QUIC connections from bypassing Microsoft Entra Internet Access inspection, use Custom Acquire to acquire UDP traffic on destination port 443 for the intended destinations, and use a cloud firewall Block rule for the same traffic. Keep Default Acquire enabled for TCP ports 80 and 443 so that applications that support fallback can connect over HTTPS using TCP.

[added: Note This example acquires and blocks UDP port 443, commonly used for HTTP/3 over QUIC. RFC 9114, section 3.1 permits HTTP/3 on any UDP port. If applications or servers use other destination ports, configure corresponding traffic acquisition and cloud firewall block rules. Blocking UDP port 443 alone doesn't block QUIC on other ports.]

Before: No saved wording on this side.

After: Note This example acquires and blocks UDP port 443, commonly used for HTTP/3 over QUIC. RFC 9114, section 3.1 permits HTTP/3 on any UDP port. If applications or servers use other destination ports, configure corresponding traffic acquisition and cloud firewall block rules. Blocking UDP port 443 alone doesn't block QUIC on other ports.

[added: Link the cloud firewall policy to a security profile, enable the policy link, and apply the profile to the intended users through Conditional Access. Creating a firewall rule alone doesn't configure traffic acquisition. For configuration and verification steps, see Control QUIC traffic on UDP port 443.]

Before: No saved wording on this side.

After: Link the cloud firewall policy to a security profile, enable the policy link, and apply the profile to the intended users through Conditional Access. Creating a firewall rule alone doesn't configure traffic acquisition. For configuration and verification steps, see Control QUIC traffic on UDP port 443.

[added: If you previously disabled browser QUIC specifically for Global Secure Access, remove that browser configuration after you verify Custom Acquire and cloud firewall blocking. Review other organizational requirements before changing existing browser policies.]

Before: No saved wording on this side.

After: If you previously disabled browser QUIC specifically for Global Secure Access, remove that browser configuration after you verify Custom Acquire and cloud firewall blocking. Review other organizational requirements before changing existing browser policies.

[added: Important Cloud firewall for clients supports QUIC acquisition and blocking in preview, not end-to-end QUIC forwarding. An Allow rule for UDP port 443 doesn't enable supported end-to-end QUIC connectivity.]

Before: No saved wording on this side.

After: Important Cloud firewall for clients supports QUIC acquisition and blocking in preview, not end-to-end QUIC forwarding. An Allow rule for UDP port 443 doesn't enable supported end-to-end QUIC connectivity.

[added: The Global Secure Access Windows client requires DNS over HTTPS to be disabled for FQDN-based traffic acquisition. Use the following Intune instructions to configure DNS over HTTPS separately from QUIC. Don't disable QUIC in the browser for this configuration.]

Before: No saved wording on this side.

After: The Global Secure Access Windows client requires DNS over HTTPS to be disabled for FQDN-based traffic acquisition. Use the following Intune instructions to configure DNS over HTTPS separately from QUIC. Don't disable QUIC in the browser for this configuration.

On the Configuration settings tab: Select + Add settings. In Settings picker, search for [removed: QUIC. From the search results:Select Microsoft Edge, and then select the Allow QUIC protocol setting. Select Google Chrome, and then select the Allow QUIC protocol setting. In Settings picker, search for] DNS-over-HTTPS. From the search results:Select Microsoft Edge, and then select the Control the mode of DNS-over-HTTPS setting. Select Google Chrome, and then select the Control the mode of DNS-over-HTTPS setting. Close Settings picker.

Before: On the Configuration settings tab: Select + Add settings. In Settings picker, search for QUIC. From the search results:Select Microsoft Edge, and then select the Allow QUIC protocol setting. Select Google Chrome, and then select the Allow QUIC protocol setting. In Settings picker, search for DNS-over-HTTPS. From the search results:Select Microsoft Edge, and then select the Control the mode of DNS-over-HTTPS setting. Select Google Chrome, and then select the Control the mode of DNS-over-HTTPS setting. Close Settings picker.

After: On the Configuration settings tab: Select + Add settings. In Settings picker, search for DNS-over-HTTPS. From the search results:Select Microsoft Edge, and then select the Control the mode of DNS-over-HTTPS setting. Select Google Chrome, and then select the Control the mode of DNS-over-HTTPS setting. Close Settings picker.

For Google Chrome, set [removed: both toggles] [added: Control the mode of DNS-over-HTTPS] to Disabled.

Before: For Google Chrome, set both toggles to Disabled.

After: For Google Chrome, set Control the mode of DNS-over-HTTPS to Disabled.

For Microsoft Edge, set [removed: both toggles] [added: Control the mode of DNS-over-HTTPS] to Disabled.

Before: For Microsoft Edge, set both toggles to Disabled.

After: For Microsoft Edge, set Control the mode of DNS-over-HTTPS to Disabled.

Admins can use remediation scripts in Intune to disable DNS over HTTPS [removed: and QUIC protocols] in the Firefox browser.

Before: Admins can use remediation scripts in Intune to disable DNS over HTTPS and QUIC protocols in the Firefox browser.

After: Admins can use remediation scripts in Intune to disable DNS over HTTPS in the Firefox browser.

[removed: Microsoft Entra Internet Access doesn't support DNS over HTTPS or Quick UDP Internet Connections (QUIC) traffic. To mitigate this limitation, disable these protocols in users' browsers. The following instructions provide guidance on how to enforce these controls by using Intune.]

Before: Microsoft Entra Internet Access doesn't support DNS over HTTPS or Quick UDP Internet Connections (QUIC) traffic. To mitigate this limitation, disable these protocols in users' browsers. The following instructions provide guidance on how to enforce these controls by using Intune.

After: No saved wording on this side.