Internet Access TLS inspection FAQ
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit df1c5e5 · +3 −2 lines · also on GitHub
⋯ 3 unchanged lines
44
description: "Get answers to common questions about Transport Layer Security (TLS) inspection."
55
author: HULKsmashGithub
66
ms.author: jayrusso
7
+ ms.service: global-secure-access
78
ms.topic: faq
89
ms.date: 05/28/2025
910
⋯ 38 unchanged lines
4849
4950
- question: How should I handle applications that use certificate pinning?
5051
answer: |
51
− The connection fails if TLS inspection terminates traffic from applications that use certificate pinning. To ensure your applications work as expected, create a custom bypass rule in the traffic forwarding profile to exclude traffic from these applications from Global Secure Access. You can perform this operation as part of custom bypass in the [Internet access forwarding profile](/mem/intune/protect/compliance-custom-script). We're working on custom TLS rules to let you acquire traffic and bypass TLS inspection only.
52
+ The connection fails if TLS inspection terminates traffic from applications that use certificate pinning. To ensure your applications work as expected, use a [custom TLS bypass rule](how-to-transport-layer-security.md) to bypass TLS inspection only for these applications.
5253
5354
- question: What destinations are included in the system bypass?
5455
answer: |
⋯ 45 unchanged lines
100101
answer: We use software-protected keys. Global Secure Access intermediate certificate keys are stored in memory to dynamically generate leaf certificates for websites. While these keys aren't protected by an HSM, access to our servers is highly restricted, and we use strict security controls to safeguard key access and system integrity.
101102
102103
- question: What other Global Secure Access features have dependencies on TLS inspection?
103
− answer: Content-based security controls have dependencies on TLS inspection, including URL filtering, Content policies, Prompt policies, and enabling partner security solutions.
104
+ answer: Content-based security controls have dependencies on TLS inspection, including URL filtering, File policies, Prompt policies, and enabling partner security solutions.
104105
105106
additionalContent: |
106107
## Related content
⋯ 3 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 00:08 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.