Internet Access MCP firewall
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 2f377c0 · +280 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: Configure Global Secure Access MCP firewall to secure Model Context Protocol traffic
3
+description: "Learn how to configure the Global Secure Access MCP firewall to inspect, audit, and enforce Allow or Block policies on Model Context Protocol traffic between AI agents and remote MCP servers."
4
+ms.topic: how-to
5
+ms.date: 08/06/2026
6
+ms.reviewer: katabish
7
+ms.custom: sfi-image-nochange
8
+ai-usage: ai-assisted
9
+
10
+#customer intent: As an IT admin, I want to configure the Global Secure Access MCP firewall so that I can inspect and control Model Context Protocol traffic between AI agents and remote MCP servers.
11
+
12
+---
13
+
14
+# Configure Global Secure Access MCP firewall to secure MCP traffic (preview)
15
+
16
+As AI agents increasingly rely on external tools, APIs, and data sources to reason and act, the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) has emerged as the standard interface for communication between large language models (LLMs) and tools. This shift also introduces new security risks. MCP servers expose powerful capabilities—such as file access, database queries, and tool execution—that create a large attack surface if left unguarded. Without comprehensive controls, malicious or misconfigured agents can exfiltrate sensitive data, trigger unintended side effects, or impersonate trusted services.
17
+
18
+The Global Secure Access MCP firewall is a network-based, identity-centric security control that provides centralized visibility, policy enforcement, and runtime protection for MCP traffic between AI agents and remote MCP servers. It extends the Global Secure Access Security Service Edge (SSE) capabilities—identity-based access, Conditional Access, and Continuous Access Evaluation —to the MCP protocol layer.
19
+
20
+Global Secure Access can now inspect, audit, and enforce security policies on every MCP interaction—including tool invocations, resource access, prompt templates, and server metadata—without requiring changes to the MCP protocol specification, or to MCP client, host, or server implementations, bringing Zero Trust model for AI agents at a globally distributed edge.
21
+
22
+> [!NOTE]
23
+> The MCP firewall is currently in preview. This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here. For more information, see the [Microsoft Entra preview terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
24
+
25
+This article explains how to create an MCP policy to inspect and control MCP traffic that flows through Global Secure Access.
26
+
27
+## Supported scenarios
28
+
29
+The MCP firewall inspects MCP traffic (JSON-RPC 2.0 over streamable HTTP and Server-Sent Events) and enforces **Allow** or **Block** decisions based on various conditions. It supports the following key scenarios:
30
+
31
+- **Block all MCP traffic.** Disable all MCP communication across the tenant until you review and approve trusted MCP servers.
32
+
33
+- **Allow or block MCP servers.** Create allow-lists or deny-lists of MCP servers based on server URL patterns.
34
+
35
+- **Allow or block MCP primitives.** Selectively allow or block **Tools**, **Resources**, or **Prompt templates** on a per-server basis.
36
+
37
+- **Allow or block specific methods and protocol versions.** Block MCP connection attempts over unencrypted HTTP or enforce protocol hygiene by blocking connections from outdated, potentially vulnerable MCP versions.
38
+
39
+## Prerequisites
40
+
41
+To configure the MCP firewall, you need the following prerequisites:
42
+
43
+- A valid Microsoft Entra tenant.
44
+
45
+- A valid Microsoft Entra Internet Access license. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
46
+
47
+- A user with the [Global Secure Access Administrator](reference-role-based-permissions.md#global-secure-access-administrator) role to configure Global Secure Access settings.
48
+
49
+- A user with the [Conditional Access Administrator](reference-role-based-permissions.md#conditional-access-administrator) role to configure Conditional Access policies.
50
+
51
+- The Global Secure Access client installed on a device (or virtual machine) that is Microsoft Entra joined or Microsoft Entra hybrid joined.
52
+
53
+- [Transport Layer Security (TLS) inspection](how-to-transport-layer-security.md) enabled. TLS inspection is required because MCP messages travel in the encrypted payload of the traffic. Without TLS inspection, Global Secure Access can’t parse or enforce MCP policy.
54
+
55
+## Initial configuration
56
+
57
+To prepare your environment for MCP policies, complete the following initial setup steps:
58
+
59
+1. [Enable the Internet Access traffic forwarding profile](how-to-manage-internet-access-profile.md#enable-the-internet-access-traffic-forwarding-profile) and ensure correct user assignments.
60
+
61
+2. [Configure the TLS inspection policy](how-to-transport-layer-security.md) so that MCP traffic is decrypted for inspection.
62
+
63
+3. Install and configure the Global Secure Access client:
64
+
65
+ 1. Install the Global Secure Access client on Windows or macOS.
66
+ > [!IMPORTANT]
67
+ > Before you continue, verify that the client’s internet traffic is routed through Global Secure Access.
68
+
69
+ 2. Select the **Global Secure Access** icon and select the **Troubleshooting** tab.
70
+ 3. Under **Advanced Diagnostics**, select **Run tool**.
71
+ 4. In the Global Secure Access Advanced Diagnostics window, select the **Forwarding Profile** tab.
72
+ 5. Verify that **Internet Access** rules are present in the **Rules** section. This configuration might take up to 15 minutes to apply to clients after you enable the Internet Access traffic profile in the Microsoft Entra admin center.
73
+
74
+4. Confirm that the client can reach MCP servers that you plan to cover with MCP policies.
75
+
76
+## Configure an MCP policy
77
+
78
+To configure the MCP firewall, complete the following steps:
79
+
80
+1. Create an MCP policy.
81
+
82
+2. Link the MCP policy to a security profile.
83
+
84
+3. Configure a Conditional Access policy.
85
+
86
+### Create an MCP policy
87
+
88
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Secure Access Administrator](reference-role-based-permissions.md#global-secure-access-administrator).
89
+2. Browse to **Global Secure Access** > **Secure** > **MCP policies (Preview)**.
90
+3. Select **+ Create policy**.
91
+4. On the **Basics** tab, enter the policy **Name** and **Description**.
92
+5. On the **Policy settings** tab, pick a **Default action** of Allow or Block.
93
+6. On the **Add rules** tab, add one or more rules. For each rule, enter the **Rule name**, **Priority, Description**, **Status**, and then configure the matching conditions.
94
+7. Configure **MCP protocol versions** to allow or block based on MCP version used for communication.
95
+
96
+:::image type="content" source="media/how-to-configure-mcp-firewall/mcp-protocol-version.png" alt-text="Screenshot showing MCP protocol version." lightbox="media/how-to-configure-mcp-firewall/mcp-protocol-version.png":::
97
+
98
+8. You may also configure specific **MCP methods**, **Transport protocol**, and **Protected resource metadata**.
99
+9. Configure **MCP server primitives** based on your requirements:
100
+
101
+ - **Block all MCP traffic.** Add a block rule with no server or primitive scoping to disable all MCP protocol traffic across the assigned users.
102
+
103
+ - **Match on discovered MCP servers.** Scope the rule to a discovered MCP server based on Gen AI insights
104
+
105
+ - Click on **View suggested MCP servers from recent activity**.
106
+
107
+ - Pick one or more servers and tools from suggested MCP servers.
108
+
109
+ - Select **Add servers and tools**.
110
+
111
+ - **Match on known MCP servers.** Scope the rule to one or more known MCP servers by:
112
+
113
+ - **Server URL** — enter the server URL, or a comma separated list.
114
+
115
+ - Click on **Add server.**
116
+
117
+ - **Match on discovered tools.** Discover and add the tools that a server exposes:
118
+
119
+ - Add an MCP server URL. Select **Add server**.
120
+
121
+ - Once the server is added, select **Discover**.
122
+
123
+ - Tools available under this server are listed and a classification is auto applied.
124
+
125
+ - You can granularly select the tools to be in scope for this rule.
126
+
127
+ - Select a matching condition on the tool name for this rule to be applied.
128
+
129
+:::image type="content" source="media/how-to-configure-mcp-firewall/mcp-discovered-tools.png" alt-text="Screenshot showing discovered tools." lightbox="media/how-to-configure-mcp-firewall/mcp-discovered-tools.png":::
130
+
131
+ - **Add a primitive manually.** If an MCP server requires authentication or isn't reachable, tools, resources, or prompts can be added manually as well.
132
+
133
+ - Add an MCP server URL. Select **Add server**.
134
+
135
+ - Select **Add Manually.**
136
+
137
+ - Choose the primitive **type** from **Tool, Resource, or Prompt.**
138
+
139
+ - Provide a **Name** and **Description.**
140
+
141
+ - Select **Add**.
142
+
143
+ - Select a matching condition on the tool name for this rule to be applied.
144
+
145
+:::image type="content" source="media/how-to-configure-mcp-firewall/mcp-manual-tools.png" alt-text="Screenshot showing manual option." lightbox="media/how-to-configure-mcp-firewall/mcp-manual-tools.png":::
146
+
147
+10. Set the **Action** to **Allow** or **Block**.
148
+11. Click **Add**.
149
+12. Select **Next** when all rules are added.
150
+13. On the **Review** tab, review your settings.
151
+14. Click **Create** to create the policy.
152
+
153
+> [!TIP]
154
+> To discover which MCP servers and tools are in use in your organization before you author rules, review MCP traffic in **Global Secure Access** > **Monitor** > **Generative AI Insights**. Select an `initialize` response event to see a server’s reported tools and capabilities. For more information, see [How to view Model Context Protocol (MCP) traffic logs in Global Secure Access](how-to-view-model-context-protocol-logging.md).
155
+> These insights also feed into the **View suggested MCP servers from recent activity** option above.
156
+
157
+
158
+### Link the MCP policy to a security profile
159
+
160
+1. Browse to **Global Secure Access** > **Secure** > **Security profiles**.
161
+
162
+2. Select the security profile you want to modify.
163
+
164
+3. Switch to the **Link policies** view.
165
+
166
+4. Configure the link:
167
+
168
+1. Select **+ Link a policy** > **Existing MCP policy**.
169
+
170
+2. From the **Policy name** menu, select the MCP policy you created.
171
+
172
+3. Keep the default values for **Position** and **State**.
173
+
174
+4. Select **Add**.
175
+
176
+5. Close the security profile.
177
+
178
+### Configure a Conditional Access policy
179
+
180
+To enforce the Global Secure Access security profile, create a Conditional Access policy with the following configuration:
181
+
182
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
183
+
184
+2. Browse to **Identity** > **Protection** > **Conditional Access**.
185
+
186
+3. Select **+ Create new policy**.
187
+
188
+4. Name the policy.
189
+
190
+5. Select the users and groups to apply the policy to.
191
+
192
+6. Set the **Target resources** to **All internet resources with Global Secure Access**.
193
+
194
+7. Configure the **Network**, **Conditions**, and **Grant** sections according to your needs.
195
+
196
+8. Under **Session**, select **Use Global Secure Access Security Profile** and select the security profile you created.
197
+
198
+9. To create the policy, select **Create**.
199
+
200
+For more information, see [Create and link a Conditional Access policy](how-to-configure-web-content-filtering.md#create-and-link-conditional-access-policy).
201
+
202
+The MCP policy is successfully configured.
203
+
204
+## Test the MCP policy
205
+
206
+Test the configuration by using an MCP client or AI agent on a managed device with GSA to connect to an MCP server that matches your policy conditions. Verify that the policy allows or blocks the traffic as expected.
207
+
208
+### Example 1: Block a specific tool on an MCP server
209
+
210
+This example blocks a single tool while allowing the rest of an MCP server.
211
+
212
+1. In your MCP policy, add a rule with the **Action** set to **Block**.
213
+
214
+2. Under matching conditions, set the **Server URL** to the target MCP server and add a **Tool name** condition that matches the tool you want to block.
215
+
216
+3. Link the policy to a security profile and enforce it with a Conditional Access policy, as described earlier.
217
+
218
+4. On a managed device with the Global Secure Access client installed, use an MCP client or agent to connect to the server and invoke the blocked tool.
219
+
220
+5. Verify that the tool call is blocked while other tools on the same server continue to work.
221
+
222
+6. To confirm the block, review **Global Secure Access** > **Monitor** > **Traffic logs** and the MCP activity in **Generative AI Insights**.
223
+
224
+### Example 2: Only allow approved MCP servers
225
+
226
+This example blocks all connections while allowing an approved list of MCP servers.
227
+
228
+1. In your MCP policy, add a default action of **Block**.
229
+
230
+2. Create a rule with the **Action** set to **Allow**.
231
+
232
+3. Under matching conditions, set the **Server URL** to the list of allowed MCP servers.
233
+
234
+4. Link the policy to a security profile and enforce it with a Conditional Access policy, as described earlier.
235
+
236
+5. On a managed device with the Global Secure Access client installed, use an MCP client or agent to connect to the server.
237
+
238
+6. Verify that connections only to the specified servers are allowed. Connection to any other server gets blocked.
239
+
240
+7. To confirm the block, review **Global Secure Access** > **Monitor** > **Traffic logs** and the MCP activity in **Generative AI Insights**.
241
+
242
+## Monitoring and logging
243
+
244
+### Review Global Secure Access traffic logs
245
+
246
+To view the network-level traffic logs and confirm allow or block decisions:
247
+
248
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Reports Reader](../identity/role-based-access-control/permissions-reference.md#reports-reader).
249
+
250
+2. Browse to **Global Secure Access** > **Monitor** > **Traffic logs**.
251
+
252
+### Review MCP activity in Generative AI Insights
253
+
254
+To review MCP sessions, tool invocations, and discovered servers:
255
+
256
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Security Reader](../identity/role-based-access-control/permissions-reference.md#security-reader).
257
+
258
+2. Browse to **Global Secure Access** > **Monitor** > **Generative AI Insights**.
259
+
260
+3. Use the **Activity** filter and select **MCP** to view only MCP traffic events.
261
+
262
+For details on the fields captured and how to interpret them, see [How to view Model Context Protocol (MCP) traffic logs in Global Secure Access](how-to-view-model-context-protocol-logging.md).
263
+
264
+## Known limitations
265
+
266
+- The MCP firewall inspects MCP traffic over streamable HTTP and Server-Sent Events transport only. MCP traffic over stdio or other non-HTTP transport isn’t supported.
267
+
268
+- Only **remote** MCP servers are inspected. Local MCP servers that run on a device aren’t visible to Global Secure Access.
269
+
270
+- JSON-RPC batches aren’t inspected.
271
+
272
+- When specific tools, resources, or prompts are configured under MCP server primitives, these details are not rendered in the UI on subsequent retrieval of the rules. The details can be verified using Microsoft Graph API instead.
273
+
274
+## Related content
275
+
276
+- [How to view Model Context Protocol (MCP) traffic logs in Global Secure Access](how-to-view-model-context-protocol-logging.md)
277
+
278
+- [Create content policies for network content filtering](how-to-network-content-filtering.md)
279
+
280
+- [Configure Transport Layer Security inspection](how-to-transport-layer-security.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 17:01 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.