Internet Access TLS inspection
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 1f22430 · +3 −9 lines · also on GitHub
⋯ 10 unchanged lines
1111
#customer intent: As a Global Secure Access administrator, I want to learn about the Transport Layer Security (TLS) protocol to support the creation of TLS inspection policies.
1212
1313
---
14
−# What is Transport Layer Security inspection? (Preview)
15
−The Transport Layer Security (TLS) protocol uses certificates at the transport layer to ensure the privacy, integrity, and authenticity of data exchanged between two communicating parties. While TLS secures legitimate traffic, malicious traffic like malware and data leakage attacks can still hide behind encryption. The Microsoft Entra Internet Access TLS inspection capability provides visibility into encrypted traffic by making content available for enhanced protection, such as malware detection, data loss prevention, prompt inspection, and other advanced security controls.
16
−
17
−> [!IMPORTANT]
18
−> The Transport Layer Security inspection feature is currently in PREVIEW.
19
−> This information relates to a prerelease product that might be substantially modified before release. Microsoft makes no warranties, expressed or implied, with respect to the information provided here. While in preview, use TLS inspection with care, especially in production environments, thoroughly evaluate before deployment.
20
−
21
−This article gives an overview of the TLS inspection process.
14
+# What is Transport Layer Security inspection?
15
+The Transport Layer Security (TLS) protocol uses certificates at the transport layer to ensure the privacy, integrity, and authenticity of data exchanged between two communicating parties. While TLS secures legitimate traffic, malicious traffic like malware and data leakage attacks can still hide behind encryption. The Microsoft Entra Internet Access TLS inspection capability provides visibility into encrypted traffic by making content available for enhanced protection, such as malware detection, data loss prevention, prompt inspection, and other advanced security controls. This article gives an overview of the TLS inspection process.
2216
2317
## The TLS inspection process
2418
When you enable TLS inspection, Global Secure Access decrypts HTTPS requests at the service edge and applies security controls like full URL enhanced web content filtering policies. If no security control blocks the request, Global Secure Access encrypts and forwards the request to the destination.
⋯ 38 unchanged lines
6357
|AES256-SHA |
6458
## Known limitations
6559
TLS inspection has the following known limitations:
66
−- TLS inspection supports up to 100 policies, 1000 rules, and 8000 destinations.
60
+- TLS inspection supports up to 100 policies, 1000 rules and 8000 destinations
6761
- Make sure each certificate signing request (CSR) you generate has a unique certificate name and isn't reused. The signed certificate must stay valid for at least 6 months.
6862
- You can use only one active certificate at a time.
6963
- TLS inspection doesn't support Application-Layer Protocol Negotiation (ALPN) version 2. If a destination site requires HTTP/2, the upstream TLS handshake fails, and the site isn't accessible when TLS inspection is enabled.
⋯ 11 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 00:39 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.