Internet Access TLS inspection policies

This page's changes and edits · All guidance changes

Microsoft's edit · 28 Oct 2025 18:14 UTC

add TLSi custom rules

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5be4d34 · +11 ~~−73~~ lines · also on GitHub

⋯ 24 unchanged lines

2525

2626 ## Prerequisites

2727 To complete the steps in this process, you must have the following prerequisites in place:

28 −- A Public Key Infrastructure (PKI) service to sign the Certificate Signing Request (CSR) and generate an intermediate certificate for TLS inspection. For testing scenarios, you can also use a self-signed root certificate created with OpenSSL.

28 +- Completed TLS inspection settings with an active enabled certificate authority. Follow <> to sign the Certificate Signing Request (CSR) and generate an intermediate certificate for TLS inspection. For testing scenarios, you can also use a self-signed root certificate created with OpenSSL.

2929 - Test devices or virtual machines running Windows that are either Microsoft Entra joined or hybrid joined to your organization's Microsoft Entra ID.

3030 - A trial license for Microsoft Entra Internet Access.

3131 - [Global Secure Access prerequisites](how-to-configure-web-content-filtering.md)

3232

3333 ## Create a context-aware TLS inspection policy

3434 To create a context-aware Transport Layer Security inspection policy and assign it to users in your organization, complete the following steps:

35 −1. [Create a CSR and upload the signed certificate for TLS termination](#step-1-global-secure-access-admin-create-a-csr-and-upload-the-signed-certificate-for-tls-termination)

36 −1. [Create a TLS inspection policy](#step-2-global-secure-access-admin-create-a-tls-inspection-policy)

37 −1. [Link the TLS inspection policy to a security profile](#step-3-global-secure-access-admin-link-the-tls-inspection-policy-to-a-security-profile)

38 −1. [Test the configuration](#step-4-test-the-configuration)

39 −

40 −### Step 1: Global Secure Access admin: create a CSR and upload the signed certificate for TLS termination

41 −To create a CSR and upload the signed certificate for TLS termination:

42 −1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) as a [Global Secure Access Administrator](../identity/role-based-access-control/permissions-reference.md#global-secure-access-administrator).

43 −1. Browse to **Global Secure Access** > **Secure** > **TLS inspection policies**.

44 −1. Switch to the **TLS inspection settings** tab.

45 −1. Select **+ Create certificate**. This step starts with generating a Certificate Sign Request (CSR).

46 −1. In the **Create certificate** pane, fill in the following fields:

47 − - **Certificate name**: This name appears in the certificate hierarchy when viewed in a browser. It must be unique, contain no spaces, and be no more than 12 characters long. You can't reuse previous names.

48 − - **Common name** (CN): Common name, for example, Contoso TLS ICA, that identifies the intermediate certificate.

49 − - **Organizational Unit** (OU): Organization name, for example, Contoso IT.

50 −1. Select **Create CSR**. This step creates a .csr file and saves it to your default download folder.

51 −:::image type="content" source="media/how-to-transport-layer-security/create-certificate.png" alt-text="Screenshot of the Create certificate pane with fields filled and the Create CSR button highlighted.":::

52 −

53 −1. Sign the CSR using your PKI service. Make sure Server Auth is in Extended Key Usage and `certificate authority (CA)=true`, `keyCertSign,cRLSign`, and `basicConstraints=critical,CA:TRUE` in Basic Extension. Save the signed certificate in .pem format. If you're testing with a self-signed certificate, follow the instructions to [use OpenSSL to sign the CSR](#test-with-a-self-signed-root-certificate-authority-using-openssl).

54 −

55 −1. Select **+Upload certificate**.

56 −1. In the Upload certificate form, upload the certificate.pem and chain.pem files.

57 −1. Select **Upload signed certificate**.

58 −:::image type="content" source="media/how-to-transport-layer-security/upload-certificate.png" alt-text="Screenshot of Upload certificate form with example certificate and chain certificate files in the upload fields.":::

59 −

60 −1. After the certificate uploads, the status changes to **Active**.

61 −:::image type="content" source="media/how-to-transport-layer-security/status-active.png" alt-text="Screenshot of the TLS inspection settings tab with the certificate status set to Active.":::

62 −

63 −For a test configuration, see [Test with a self-signed root certificate authority using OpenSSL](#test-with-a-self-signed-root-certificate-authority-using-openssl).

64 −

65 −### Step 2: Global Secure Access admin: create a TLS inspection policy

35 +### Step 1: Global Secure Access admin: create a TLS inspection policy

6636 To create a TLS inspection policy:

67 −1. In the Microsoft Entra admin center, go to **Secure** > **TLS inspection policies**.

68 −1. Create a new policy with **Action** set to **Inspect**.

69 −1. Select **Save**. This configuration enables TLS termination for all traffic categories except Education, Finance, Government, and Health and medicine.

70 −:::image type="content" source="media/how-to-transport-layer-security/inspection-policy.png" alt-text="Screenshot of the Create a TLS inspection policy screen open to the Review tab.":::

37 +1. In the Microsoft Entra admin center, go to **Secure** > **TLS inspection policies** > **Create policy**

38 +![alt textPolicy Basic Setting](image.png)

39 +The **Default action" specifies what to do if there are no rules matched. By default, it is set as "Inspect".

40 +1. Select **Next** > **Add rule** brings you to the rules page. You may define a custom rule by specifying a FQDN or select a category.

41 +![Add a rule](image-3.png)

7142

72 −### Step 3: Global Secure Access admin: link the TLS inspection policy to a security profile

43 +1. **Save**>**Next**>**Submit** to complete the policy configuration. Note a system rule has been auto created to exclude destinations that do not work with TLS inspection. An editable recommended bypass rule was auto-created to exclude Education, Finance, Government, and Health & Medicine categories for TLS policies migrating from the Public Preview.

44 +1. Select a policy >**Edit**>**Rules**To review rules created including the pre-created rules.

45 + ![alt text](image-4.png)

46 +### Step 2: Global Secure Access admin: link the TLS inspection policy to a security profile

7347 Link the TLS inspection policy to a security profile.

7448

7549 Before you enable TLS inspection on user traffic, make sure your organization has established and communicated an appropriate Terms of Use (ToU) for end users. This step helps maintain transparency and supports compliance with privacy and consent requirements.

⋯ 47 unchanged lines

12397 1. Select **Actions**.

12498 1. Select **Delete**.

12599

126 −## Test with a self-signed root certificate authority using OpenSSL

127 −For **testing purposes only**, use a self-signed root certificate authority (CA) that you create with OpenSSL to sign the CSR. To test with OpenSSL:

128 −1. If you don't already have one, create an *openssl.cnf* file with this configuration:

129 −```ini

130 −[ rootCA_ext ]

131 −subjectKeyIdentifier = hash

132 −authorityKeyIdentifier = keyid:always,issuer

133 −basicConstraints = critical, CA:true

134 −keyUsage = critical, digitalSignature, cRLSign, keyCertSign

135 −

136 −[ interCA_ext ]

137 −subjectKeyIdentifier = hash

138 −authorityKeyIdentifier = keyid:always,issuer

139 −basicConstraints = critical, CA:true, pathlen:1

140 −keyUsage = critical, digitalSignature, cRLSign, keyCertSign

141 −

142 −[ signedCA_ext ]

143 −basicConstraints = critical, CA:true

144 −keyUsage = critical, digitalSignature, cRLSign, keyCertSign

145 −extendedKeyUsage = serverAuth

146 −

147 −[ server_ext ]

148 −subjectKeyIdentifier = hash

149 −authorityKeyIdentifier = keyid:always,issuer

150 −basicConstraints = critical, CA:false

151 −keyUsage = critical, digitalSignature

152 −extendedKeyUsage = serverAuth

153 −```

154 −

155 −2. Create a new root certificate authority and private key using the following *openssl.cnf* config file:

156 −```openssl req -x509 -new -nodes -newkey rsa:4096 -keyout rootCAchain.key -sha256 -days 370 -out rootCAchain.pem -subj "/C=US/ST=US/O=Self Signed/CN=Self Signed Root CA" -config openssl.cnf -extensions rootCA_ext```

157 −1. Sign the CSR using the following command:

158 − ```openssl x509 -req -in <CSR file> -CA rootCAchain.pem -CAkey rootCAchain.key -CAcreateserial -out signedcertificate.pem -days 370 -sha256 -extfile openssl.cnf -extensions signedCA_ext```

159 −1. Upload the signed certificates (```signedcertificate.pem```and ```rootCAchain.pem```) according to the steps in [Create a CSR and upload the signed certificate for TLS termination](#step-1-global-secure-access-admin-create-a-csr-and-upload-the-signed-certificate-for-tls-termination).

160 −

161 −Examples of configuring TLS certificate using powershell are listed in the below related content section.

162100 ## Related content

163101 * [Create a TLS certificates using ADCS](scripts/powershell-active-directory-certificate-service.md)

164102 * [Create a TLS certificate using OpenSSL](scripts/powershell-open-secure-sockets-layer.md)

⋯ 2 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 00:54 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.