Internet Access custom bypass rule script
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 6f5b815 · +118 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: PowerShell sample - Add a custom bypass rule to internet access forwarding profile
3
+description: PowerShell example that bypasses a certain fqdn or IP from being acquired by the Global Secure Access Client in the Internet Access forwarding profile.
4
+author: fgomulka
5
+manager: ashishj
6
+ms.service: global-secure-access
7
+ms.topic: sample
8
+ms.date: 06/06/2025
9
+ms.author: frankgomulka
10
+ms.reviewer: katabish
11
+---
12
+
13
+# Add a custom bypass rule to Global Secure Access Internet Access
14
+
15
+This PowerShell script demonstrates how to programmatically add a custom bypass rule to the Microsoft Entra Internet Access forwarding policy. The script finds the "Custom Bypass" forwarding policy and adds a sample rule to bypass specified domains.
16
+
17
+The sample requires the [Microsoft Graph Beta PowerShell module](/powershell/microsoftgraph/installation) 2.10 or newer.
18
+
19
+## Important considerations
20
+- Run the PowerShell script as an Administrator from an elevated PowerShell session.
21
+- Make sure you install the Microsoft.Graph.Beta module:
22
+ ```powershell
23
+ Install-Module Microsoft.Graph.Beta -AllowClobber -Force
24
+ ```
25
+- The account used for `Connect-MgGraph` must have the following permissions:
26
+ - Policy.Read.All
27
+ - NetworkAccess.ReadWrite.All
28
+
29
+## Sample script
30
+
31
+```powershell
32
+# bypassscript.ps1 adds sample endpoints to the custom bypass policy in the internet access forwarding profile
33
+#
34
+# Version 1.0
35
+#
36
+# This script requires following
37
+# - PowerShell 5.1 (x64) or beyond
38
+# - Module: Microsoft.Graph.Beta
39
+#
40
+# Before you begin:
41
+# - Make sure you are running PowerShell as an Administrator
42
+# - Make sure you run: Install-Module Microsoft.Graph.Beta -AllowClobber -Force
43
+# - Make sure the account used for Connect-MgGraph has the following permissions:
44
+# - Policy.Read.All
45
+# - NetworkAccess.ReadWrite.All
46
+#
47
+if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Beta.Identity.SignIns)) {
48
+ Write-Host "Module Microsoft.Graph.Beta.Identity.SignIns is not installed. Please install it using: Install-Module Microsoft.Graph.Beta -AllowClobber"
49
+ exit
50
+}
51
+Import-Module Microsoft.Graph.Beta.Identity.SignIns
52
+Connect-MgGraph -Scopes "Policy.Read.All,NetworkAccess.ReadWrite.All"
53
+
54
+# Find out custom bypass forwarding policy id
55
+$custombypass = $null
56
+$forwardingpolicies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/networkaccess/forwardingpolicies"
57
+foreach ($policy in $forwardingpolicies.value) {
58
+ if ($policy.name -eq "Custom Bypass"){
59
+ $custombypass = $policy.id
60
+ }
61
+}
62
+if ($custombypass -eq $null) {
63
+ Write-Host "Could not find the IA custom bypass forwarding policy. Exiting."
64
+ exit
65
+}
66
+
67
+# First, Bypass the Intune endpoints
68
+$samplerule = [PSCustomObject]@{
69
+ name = "Sample FQDN bypass rule"
70
+ action = "bypass"
71
+ destinations = @()
72
+ ruleType = "fqdn"
73
+ ports = @("80", "443")
74
+ protocol = "tcp"
75
+ '@odata.type' = "#microsoft.graph.networkaccess.internetAccessForwardingRule"
76
+}
77
+$sampledomains = @(
78
+ "bing.com",
79
+ "*.bing.com"
80
+)
81
+
82
+foreach ($sampledomain in $sampledomains) {
83
+ $fqdn = [PSCustomObject]@{
84
+ '@odata.type' = "#microsoft.graph.networkaccess.fqdn"
85
+ value = $sampledomain
86
+ }
87
+ $samplerule.destinations += $fqdn
88
+}
89
+$body = $samplerule | ConvertTo-Json
90
+Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/beta/networkaccess/forwardingPolicies('$($custombypass)')/policyRules" -Body $body -ContentType "application/json"
91
+
92
+# Next, Bypass the sample IP-based endpoints
93
+$sampleipbypassrule = [PSCustomObject]@{
94
+ name = "Sample IP bypass rule"
95
+ action = "bypass"
96
+ destinations = @()
97
+ ruleType = "ipSubnet"
98
+ ports = @("80", "443")
99
+ protocol = "tcp"
100
+ '@odata.type' = "#microsoft.graph.networkaccess.internetAccessForwardingRule"
101
+}
102
+$sampleipbypassdomains = @(
103
+ "1.2.3.4/32"
104
+)
105
+foreach ($sampleipbypassdomain in $sampleipbypassdomains) {
106
+ $ip = [PSCustomObject]@{
107
+ '@odata.type' = "#microsoft.graph.networkaccess.ipSubnet"
108
+ value = $sampleipbypassdomain
109
+ }
110
+ $sampleipbypassrule.destinations += $ip
111
+}
112
+$body = $sampleipbypassrule | ConvertTo-Json
113
+Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/beta/networkaccess/forwardingPolicies('$($custombypass)')/policyRules" -Body $body -ContentType "application/json"
114
+```
115
+
116
+## Next steps
117
+
118
+- [Microsoft Graph PowerShell overview](/powershell/microsoftgraph/overview)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 17:01 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.