Internet Access Intune device compliance bypass script
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 6f5b815 · +229 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: PowerShell sample - Add Intune device compliance bypasses to Global Secure Access Internet Access
3
+description: PowerShell example that adds Intune-related endpoints to the Global Secure Access Internet Access custom bypass policy to mitigate device compliance issues.
4
+author: fgomulka
5
+manager: ashishj
6
+ms.service: global-secure-access
7
+ms.topic: sample
8
+ms.date: 06/06/2025
9
+ms.author: frankgomulka
10
+ms.reviewer: katabish
11
+---
12
+
13
+# Add Intune device compliance bypasses to Global Secure Access Internet Access
14
+
15
+The [Universal Conditional Access documentation](/entra/global-secure-access/concept-universal-conditional-access#known-tunnel-authorization-limitations) notes that Global Secure Access has tunnel authorization limitations. This means that you can block access to a forwarding profile in Conditional Access and inadvertently lock users out from accessing anything on their machine.
16
+
17
+The way to mitigate this issue is bypassing [Network endpoints for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints). This PowerShell script adds Intune-related endpoints to the Global Secure Access Internet Access (IA) custom bypass policy. This helps mitigate device compliance issues and supports scenarios such as AzVPN side-by-side deployments.
18
+
19
+The sample requires the [Microsoft Graph Beta PowerShell module](/powershell/microsoftgraph/installation) 2.10 or newer.
20
+
21
+## Important considerations
22
+- Run the PowerShell script as an Administrator from an elevated PowerShell session.
23
+- Make sure you install the Microsoft.Graph.Beta module:
24
+ ```powershell
25
+ Install-Module Microsoft.Graph.Beta -AllowClobber -Force
26
+ ```
27
+- The account used for `Connect-MgGraph` must have the following permissions:
28
+ - Policy.Read.All
29
+ - NetworkAccess.ReadWrite.All
30
+
31
+## Sample script
32
+
33
+```powershell
34
+# add-ia-bypasses.ps1 adds intune-related endpoints to GSA IA custom bypass to mitigate the device-compliance related Chicken and Egg Problem.
35
+#
36
+# Version 1.0
37
+#
38
+# This script requires following
39
+# - PowerShell 5.1 (x64) or beyond
40
+# - Module: Microsoft.Graph.Beta
41
+#
42
+# Before you begin:
43
+# - Make sure you are running PowerShell as an Administrator
44
+# - Make sure you run: Install-Module Microsoft.Graph.Beta -AllowClobber -Force
45
+# - Make sure the account used for Connect-MgGraph has the following permissions:
46
+# - Policy.Read.All
47
+# - NetworkAccess.ReadWrite.All
48
+#
49
+if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Beta.Identity.SignIns)) {
50
+ Write-Host "Module Microsoft.Graph.Beta.Identity.SignIns is not installed. Please install it using: Install-Module Microsoft.Graph.Beta -AllowClobber"
51
+ exit
52
+}
53
+Import-Module Microsoft.Graph.Beta.Identity.SignIns
54
+Connect-MgGraph -Scopes "Policy.Read.All,NetworkAccess.ReadWrite.All"
55
+
56
+# Find out custom bypass forwarding policy id
57
+$custombypass = $null
58
+$forwardingpolicies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/networkaccess/forwardingpolicies"
59
+foreach ($policy in $forwardingpolicies.value) {
60
+ if ($policy.name -eq "Custom Bypass"){
61
+ $custombypass = $policy.id
62
+ }
63
+}
64
+if ($custombypass -eq $null) {
65
+ Write-Host "Could not find the IA custom bypass forwarding policy. Exiting."
66
+ exit
67
+}
68
+
69
+# First, Bypass the Intune endpoints
70
+$intunerule = [PSCustomObject]@{
71
+ name = "Network Endpoints for Microsoft Intune"
72
+ action = "bypass"
73
+ destinations = @()
74
+ ruleType = "fqdn"
75
+ ports = @("80", "443")
76
+ protocol = "tcp"
77
+ '@odata.type' = "#microsoft.graph.networkaccess.internetAccessForwardingRule"
78
+}
79
+$intunedomains = @(
80
+ "*.manage.microsoft.com",
81
+ "manage.microsoft.com",
82
+ "EnterpriseEnrollment.manage.microsoft.com",
83
+ "*.do.dsp.mp.microsoft.com",
84
+ "*.dl.delivery.mp.microsoft.com",
85
+ "*.emdl.ws.microsoft.com",
86
+ "kv801.prod.do.dsp.mp.microsoft.com",
87
+ "geo.prod.do.dsp.mp.microsoft.com",
88
+ "emdl.ws.microsoft.com",
89
+ "2.dl.delivery.mp.microsoft.com",
90
+ "bg.v4.emdl.ws.microsoft.com",
91
+ "swda01-mscdn.manage.microsoft.com",
92
+ "swda02-mscdn.manage.microsoft.com",
93
+ "swdb01-mscdn.manage.microsoft.com",
94
+ "swdb02-mscdn.manage.microsoft.com",
95
+ "swdc01-mscdn.manage.microsoft.com",
96
+ "swdc02-mscdn.manage.microsoft.com",
97
+ "swdd01-mscdn.manage.microsoft.com",
98
+ "swdd02-mscdn.manage.microsoft.com",
99
+ "swdin01-mscdn.manage.microsoft.com",
100
+ "swdin02-mscdn.manage.microsoft.com",
101
+ "account.live.com",
102
+ "login.live.com",
103
+ "config.edge.skype.com",
104
+ "go.microsoft.com",
105
+ "*.windowsupdate.com",
106
+ "*.dl.delivery.mp.microsoft.com",
107
+ "*.prod.do.dsp.mp.microsoft.com",
108
+ "emdl.ws.microsoft.com",
109
+ "*.delivery.mp.microsoft.com",
110
+ "*.update.microsoft.com",
111
+ "tsfe.trafficshaping.dsp.mp.microsoft.com",
112
+ "time.windows.com",
113
+ "clientconfig.passport.net",
114
+ "windowsphone.com",
115
+ "*.s-microsoft.com",
116
+ "c.s-microsoft.com",
117
+ "ekop.intel.com",
118
+ "ekcert.spserv.microsoft.com",
119
+ "ftpm.amd.com",
120
+ "lgmsapeweu.blob.core.windows.net",
121
+ "*.support.services.microsoft.com",
122
+ "remoteassistance.support.services.microsoft.com",
123
+ "rdprelayv3eastusprod-0.support.services.microsoft.com",
124
+ "*.trouter.skype.com",
125
+ "remoteassistanceprodacs.communication.azure.com",
126
+ "edge.skype.com",
127
+ "aadcdn.msftauth.net",
128
+ "aadcdn.msauth.net",
129
+ "alcdn.msauth.net",
130
+ "wcpstatic.microsoft.com",
131
+ "*.aria.microsoft.com",
132
+ "browser.pipe.aria.microsoft.com",
133
+ "*.events.data.microsoft.com",
134
+ "v10.events.data.microsoft.com",
135
+ "*.monitor.azure.com",
136
+ "js.monitor.azure.com",
137
+ "edge.microsoft.com",
138
+ "*.trouter.communication.microsoft.com",
139
+ "go.trouter.communication.microsoft.com",
140
+ "*.trouter.teams.microsoft.com",
141
+ "trouter2-usce-1-a.trouter.teams.microsoft.com",
142
+ "api.flightproxy.skype.com",
143
+ "ecs.communication.microsoft.com",
144
+ "remotehelp.microsoft.com",
145
+ "trouter-azsc-usea-0-a.trouter.skype.com",
146
+ "*.webpubsub.azure.com",
147
+ "AMSUA0101-RemoteAssistService-pubsub.webpubsub.azure.com",
148
+ "remoteassistanceweb-gcc.usgov.communication.azure.us",
149
+ "gcc.remotehelp.microsoft.com",
150
+ "gcc.relay.remotehelp.microsoft.com",
151
+ "*.gov.teams.microsoft.us",
152
+ "*.notify.windows.com",
153
+ "*.wns.windows.com",
154
+ "sinwns1011421.wns.windows.com",
155
+ "sin.notify.windows.com",
156
+ "*.do.dsp.mp.microsoft.com",
157
+ "*.dl.delivery.mp.microsoft.com",
158
+ "*.emdl.ws.microsoft.com",
159
+ "kv801.prod.do.dsp.mp.microsoft.com",
160
+ "geo.prod.do.dsp.mp.microsoft.com",
161
+ "emdl.ws.microsoft.com",
162
+ "2.dl.delivery.mp.microsoft.com",
163
+ "bg.v4.emdl.ws.microsoft.com",
164
+ "itunes.apple.com",
165
+ "*.itunes.apple.com",
166
+ "*.mzstatic.com",
167
+ "*.phobos.apple.com",
168
+ "phobos.itunes-apple.com.akadns.net",
169
+ "5-courier.push.apple.com",
170
+ "phobos.apple.com",
171
+ "ocsp.apple.com",
172
+ "ax.itunes.apple.com",
173
+ "ax.itunes.apple.com.edgesuite.net",
174
+ "s.mzstatic.com",
175
+ "a1165.phobos.apple.com",
176
+ "intunecdnpeasd.azureedge.net",
177
+ "login.microsoftonline.com",
178
+ "graph.windows.net",
179
+ "*.officeconfig.msocdn.com",
180
+ "config.office.com",
181
+ "enterpriseregistration.windows.net",
182
+ "naprodimedatapri.azureedge.net",
183
+ "naprodimedatasec.azureedge.net",
184
+ "naprodimedatahotfix.azureedge.net",
185
+ "euprodimedatapri.azureedge.net",
186
+ "euprodimedatasec.azureedge.net",
187
+ "euprodimedatahotfix.azureedge.net",
188
+ "approdimedatapri.azureedge.net",
189
+ "approdimedatasec.azureedge.net",
190
+ "approdimedatahotfix.azureedge.net",
191
+ "*.azureedge.net",
192
+ "graph.microsoft.com",
193
+ "displaycatalog.mp.microsoft.com",
194
+ "purchase.md.mp.microsoft.com",
195
+ "licensing.mp.microsoft.com",
196
+ "storeedgefd.dsx.mp.microsoft.com",
197
+ "intunemaape1.eus.attest.azure.net",
198
+ "intunemaape2.eus2.attest.azure.net",
199
+ "intunemaape3.cus.attest.azure.net",
200
+ "intunemaape4.wus.attest.azure.net",
201
+ "intunemaape5.scus.attest.azure.net",
202
+ "intunemaape6.ncus.attest.azure.net",
203
+ "intunemaape7.neu.attest.azure.net",
204
+ "intunemaape8.neu.attest.azure.net",
205
+ "intunemaape9.neu.attest.azure.net",
206
+ "intunemaape10.weu.attest.azure.net",
207
+ "intunemaape11.weu.attest.azure.net",
208
+ "intunemaape12.weu.attest.azure.net",
209
+ "intunemaape13.jpe.attest.azure.net",
210
+ "intunemaape17.jpe.attest.azure.net",
211
+ "intunemaape18.jpe.attest.azure.net",
212
+ "intunemaape19.jpe.attest.azure.net",
213
+ "*.dm.microsoft.com",
214
+ "*.events.data.microsoft.com"
215
+)
216
+foreach ($intunedomain in $intunedomains) {
217
+ $fqdn = [PSCustomObject]@{
218
+ '@odata.type' = "#microsoft.graph.networkaccess.fqdn"
219
+ value = $intunedomain
220
+ }
221
+ $intunerule.destinations += $fqdn
222
+}
223
+$body = $intunerule | ConvertTo-Json
224
+Invoke-MgGraphRequest -Method POST -Uri "https://graph.microsoft.com/beta/networkaccess/forwardingPolicies('$($custombypass)')/policyRules" -Body $body -ContentType "application/json"
225
+```
226
+
227
+## Next steps
228
+
229
+- [Microsoft Graph PowerShell overview](/powershell/microsoftgraph/overview)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 17:01 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.