Internet Access TLS inspection policies
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 2041d19 · +10 −9 lines · also on GitHub
⋯ 6 unchanged lines
77
ms.service: global-secure-access
88
ms.topic: how-to
99
ms.reviewer: teresayao
10
−ms.date: 09/10/2025
10
+ms.date: 10/28/2025
1111
1212
1313
#customer intent: As a Global Secure Access administrator, I want to configure a context-aware Transport Layer Security inspection policy and assign the policy to users in my organization.
⋯ 21 unchanged lines
3535
### Step 1: Global Secure Access admin: create a TLS inspection policy
3636
To create a TLS inspection policy:
3737
1. In the Microsoft Entra admin center, go to **Secure** > **TLS inspection policies** > **Create policy**.
38
−
39
−The **Default action" specifies what to do if there are no rules matched. By default, it is set as "Inspect".
40
−1. Select **Next** > **Add rule** brings you to the rules page. You may define a custom rule by specifying a FQDN or select a category.
41
−
38
+:::image type="content" source="media/how-to-transport-layer-security/create-tlsipolicy.png" alt-text="Screenshot of the Create a TLS inspection policy screen open to the Basic tab.":::
39
+The **Default action** specifies what to do if no rules match. The default setting is **Inspect**..
40
+1. Select **Next** > **Add rule**. On the **Rules** page, you can define a custom rule by specifying an **FQDN** or selecting a **Web category**.
41
+:::image type="content" source="media/how-to-transport-layer-security/add-rule.png" alt-text="Screenshot of the Create a TLS inspection policy screen open to the Rules tab.":::
4242
43
−1. **Save**>**Next**>**Submit** to complete the policy configuration. Note a system rule has been auto created to exclude destinations that do not work with TLS inspection. An editable recommended bypass rule was auto-created to exclude Education, Finance, Government, and Health & Medicine categories for TLS policies migrating from the Public Preview.
44
−1. Select a policy >**Edit**>**Rules**To review rules created including the pre-created rules.
45
− 
43
+1. To complete the policy configuration, go to **Save** > **Next** > **Submit**. Note a system rule has been auto created to exclude destinations that do not work with TLS inspection. An editable recommended bypass rule is automatically created to exclude Education, Finance, Government, and Health & Medicine categories for TLS policies migrating from the preview.
44
+1. To review rules, including the auto-created rules, select a policy and then go to **Edit** > **Rules**.
45
+:::image type="content" source="media/how-to-transport-layer-security/edit-policy-rules.png" alt-text="Screenshot of the Edit a TLS inspection policy screen open to the Rules tab.":::
46
+
4647
### Step 2: Global Secure Access admin: link the TLS inspection policy to a security profile
4748
Link the TLS inspection policy to a security profile.
4849
49
−Before you enable TLS inspection on user traffic, make sure your organization has established and communicated an appropriate Terms of Use (ToU) for end users. This step helps maintain transparency and supports compliance with privacy and consent requirements.
50
+Before you enable TLS inspection on user traffic, make sure your organization has established and communicated TLS policy to end users. This step helps maintain transparency and supports compliance with privacy and consent requirements.
5051
5152
You can link the TLS policy to a security profile in two ways:
5253
#### Option 1: Link the TLS policy to the baseline profile for all users
⋯ 52 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 00:54 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.