Internet Access TLS inspection
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit ba90233 · +19 −16 lines · also on GitHub
⋯ 3 unchanged lines
44
author: HULKsmashGithub
55
ms.author: jayrusso
66
ms.topic: concept-article
7
−ms.date: 05/28/2025
7
+ms.date: 03/23/2026
8
+ms.reviewer: teresayao
89
910
#customer intent: As a Global Secure Access administrator, I want to learn about the Transport Layer Security (TLS) protocol to support the creation of TLS inspection policies.
1011
⋯ 2 unchanged lines
1314
The Transport Layer Security (TLS) protocol uses certificates at the transport layer to ensure the privacy, integrity, and authenticity of data exchanged between two communicating parties. While TLS secures legitimate traffic, malicious traffic like malware and data leakage attacks can still hide behind encryption. The Microsoft Entra Internet Access TLS inspection capability provides visibility into encrypted traffic by making content available for enhanced protection, such as malware detection, data loss prevention, prompt inspection, and other advanced security controls. This article gives an overview of the TLS inspection process.
1415
1516
## The TLS inspection process
16
−When you enable TLS inspection, Global Secure Access decrypts HTTPS requests at the service edge. Advanced security controls, such as full URL filtering and file scan policies, are evaluated. If no security control blocks the request, Global Secure Access re-encrypts and forwards the request to the destination.
17
+When you enable TLS inspection, Global Secure Access decrypts HTTPS requests at the service edge and applies security controls like full URL enhanced web content filtering policies. If no security control blocks the request, Global Secure Access encrypts and forwards the request to the destination.
1718
1819
To enable TLS inspection, follow these steps:
1920
1. Generate a certificate signing request (CSR) in the Global Secure Access portal and sign the CSR using your organization's root or intermediate certificate authority.
20
−1. Upload the signed certificate to the portal.
21
+1. Upload the signed certificate to the portal.
2122
22
−Global Secure Access uses a two-tier certificate architecture. The customer-signed intermediate certificate is the first tier and is used to create a second short-lived intermediate certificate, which dynamically generates leaf certificates for TLS termination. TLS inspection establishes two separate TLS connections:
23
+Global Secure Access uses this certificate as an intermediate certificate authority for TLS inspection. During traffic interception, Global Secure Access dynamically generates short lived leaf certificates using the intermediate certificate. TLS inspection establishes two separate TLS connections:
2324
- One from the client browser to a Global Secure Access service edge
24
−- One from Global Secure Access to the destination server
25
+- One from Global Secure Access to the destination server
2526
26
−Global Secure Access uses leaf certificates during TLS handshakes between client devices and the service. To ensure successful handshakes, install your root certificate authority and the intermediate certificate authority (if used to sign the CSR) in the trusted certificate store on all client devices.
27
+Global Secure Access uses leaf certificates during TLS handshakes between client devices and the service. To ensure successful handshakes, install your root certificate authority, and intermediate certificate authority if used for signing the CSR, in the trusted certificate store on all client devices.
2728
2829
<!-- Art Library Source# ConceptArt-0-000-047 -->
2930
:::image type="content" source="media/concept-transport-layer-security/inspection-process-diagram.png" alt-text="Diagram that shows the Transport Layer Security (TLS) inspection process." lightbox="media/concept-transport-layer-security/inspection-process-diagram-expanded.png":::
⋯ 2 unchanged lines
3233
- _TlsAction_: Bypassed or Intercepted
3334
- _TlsPolicyId_: The unique identifier of the applied TLS policy
3435
- _TlsPolicyName_: The readable name of the TLS policy for easier reference
35
−- _TlsStatus_: Success or Failure
36
+- _TlsStatus_: Success or Failure
3637
37
−To get started with TLS inspection, see [Configure Transport Layer Security Policies](how-to-transport-layer-security.md).
38
+To get started with TLS inspection, see [Configure Transport Layer Security](how-to-transport-layer-security.md).
3839
3940
## Supported ciphers
40
−| List of supported ciphers |
41
+|List of supported ciphers |
4142
|-------------------|
4243
|ECDHE-ECDSA-AES128-GCM-SHA256|
4344
|ECDHE-ECDSA-CHACHA20-POLY1305|
⋯ 9 unchanged lines
5354
|ECDHE-RSA-AES256-SHA |
5455
|AES256-GCM-SHA384|
5556
|AES256-SHA |
56
−
5757
## Known limitations
5858
TLS inspection has the following known limitations:
59
−- TLS inspection supports up to 100 policies, 1,000 rules, and 8,000 destinations.
60
−- Make sure each certificate signing request (CSR) you generate has a unique certificate name and isn't reused. The signed certificate must stay valid for at least six months.
59
+- TLS inspection supports up to 100 policies, 1000 rules, and 8000 destinations.
60
+- Make sure each certificate signing request (CSR) you generate has a unique certificate name and isn't reused. The signed certificate must stay valid for at least 6 months.
6161
- You can use only one active certificate at a time.
62
−- TLS inspection doesn't support HTTP/2 negotiation. Most sites automatically fall back to HTTP/1.1 and continue to work, but sites that require HTTP/2 won't load if TLS inspection is enabled. Add a custom TLS bypass rule to allow access to HTTP/2-only sites.
62
+- TLS inspection doesn't support HTTP/2 negotiation. Most sites automatically fall back to HTTP/1.1 and continue to work, but sites that require HTTP/2 won't load if TLS inspection is enabled. Add a custom TLS bypass rule to allow access to HTTP/2 only sites.
6363
- TLS inspection doesn't follow Authority Information Access (AIA) and Online Certificate Status Protocol (OCSP) links when validating destination certificates.
6464
6565
## Mobile platform
6666
- Many mobile applications implement certificate pinning, which prevents successful TLS inspection, resulting in handshake failures or loss of functionality. To reduce risk, enable TLS inspection in a test environment first and validate that critical applications are compatible. For apps that rely on certificate pinning, configure TLS inspection custom rules to bypass these destinations using domain-based or category-based rules.
6767
6868
## Related content
69
−- [Configure Transport Layer Security Policies](how-to-transport-layer-security.md)
70
−- [Configure Transport Layer Security Settings](how-to-transport-layer-security-settings.md)
71
−- [Frequently asked questions for Transport Layer Security inspection](faq-transport-layer-security.yml)
69
+
70
+* [Configure Transport Layer Security Policies](how-to-transport-layer-security.md)
71
+
72
+* [Configure Transport Layer Security Settings](how-to-transport-layer-security-settings.md)
73
+
74
+* [Frequently asked questions for Transport Layer Security inspection](faq-transport-layer-security.yml)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 00:39 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.