Internet Access TLS inspection FAQ
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 03173e0 · +40 −0 lines · also on GitHub
⋯ 50 unchanged lines
5151
answer: |
5252
The connection fails if TLS inspection terminates traffic from applications that use certificate pinning. To ensure your applications work as expected, create a custom bypass rule in the traffic forwarding profile to exclude traffic from these applications from Global Secure Access. You can perform this operation as part of custom bypass in the [Internet access forwarding profile](/mem/intune/protect/compliance-custom-script). We're working on custom TLS rules to let you acquire traffic and bypass TLS inspection only.
5353
54
+ - question: What destinations are included in the system bypass?
55
+ answer: |
56
+ System bypass list includes known destinations that use certificate pinning or have other incompatibilities with TLS inspection.
57
+ These destinations are automatically excluded from TLS inspection to ensure proper functionality. The system bypass list is regularly updated to include new destinations as they are identified. A few examples of destinations in the system bypass list include:
58
+ - Adobe CRS
59
+ - AplusPC UCC Regions
60
+ - App Center
61
+ - Apple ESS Push Services
62
+ - Azure Diagnostics
63
+ - Azure IoT Hub
64
+ - Azure Management
65
+ - Azure WAN Listener
66
+ - Centanet
67
+ - Central Plaza e-Order
68
+ - Cisco Umbrella Proxy
69
+ - DocuSign
70
+ - Dropbox
71
+ - e-Szigno
72
+ - Global Secure Access Diagnostics
73
+ - Guardz Device Agent
74
+ - iCloud
75
+ - Likr Load Balancer
76
+ - MediaTek
77
+ - Microsigner
78
+ - Microsoft Graph
79
+ - Microsoft Login Services
80
+ - O2 Moje Login
81
+ - OpenSpace Solutions
82
+ - Power BI External
83
+ - Signal
84
+ - TeamViewer
85
+ - Visual Studio Telemetry
86
+ - Webex
87
+ - WhatsApp
88
+ - Windows Update
89
+ - ZDX Cloud
90
+ - Zscaler Beta
91
+ - Zscaler Two
92
+ - Zoom
93
+
5494
- question: Is TLS 1.3 supported?
5595
answer: Microsoft Entra TLS inspection enables TLS 1.2 and TLS 1.3 by default. The highest mutually supported version is selected for the session, from the client to Global Secure Access and from Global Secure Access to the destinations. Microsoft Entra doesn't support TLS 1.3 with Encrypted Client Hello (ECH) because the Server Name Indication (SNI) is encrypted, which prevents Global Secure Access from creating the corresponding leaf certificates for TLS termination.
5696
⋯ 14 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 00:08 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.