Internet Access traffic forwarding profile
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 73565b5 · +38 −17 lines · also on GitHub
⋯ 1 unchanged line
22
title: How to manage the Internet Access profile
33
description: Learn how to manage the Internet Access traffic forwarding profile for Microsoft Entra Internet Access.
44
ms.topic: how-to
5
−ms.date: 03/25/2026
5
+ms.date: 08/02/2026
66
ms.subservice: entra-internet-access
77
ms.reviewer: katabish
88
ai-usage: ai-assisted
⋯ 5 unchanged lines
1414
1515
## Overview
1616
17
−The Internet Access traffic forwarding profile routes internet traffic through the Global Secure Access client. Enabling this traffic forwarding profile allows remote workers to connect to the internet in a controlled and secure way. With the features of Microsoft Entra Internet Access, you can control which internet sites can be accessed. You can also configure which traffic to exclude from Global Secure Access based on IP addresses, IP address ranges, IP subnets, and Fully Qualified Domain Names (FQDNs).
17
+The Internet Access traffic forwarding profile routes internet traffic through the Global Secure Access client and remote networks. Enabling this traffic forwarding profile allows users to connect to the internet in a controlled and secure way. You can configure which traffic to include or exclude from Global Secure Access based on IP addresses, IP address ranges, IP subnets, and Fully Qualified Domain Names (FQDNs). You can also deploy Global Secure Access side by side with another Secure Web Gateway (SWG) vendor by using the **Custom Acquire** policy to selectively acquire specific traffic, or the **Agentic Acquire** policy to acquire traffic from local AI agents (such as GitHub Copilot CLI or Claude CLI), while using other vendors for rest of the internet.
1818
1919
## Prerequisites
2020
⋯ 4 unchanged lines
2525
2626
## Internet Access traffic forwarding profile policies
2727
28
−View the policies that relate to the Internet Access traffic forwarding profile. There are three policies by default. To view them:
28
+View the policies that relate to the Internet Access traffic forwarding profile. There are six policies in total. To view them:
2929
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Secure Access Administrator](/azure/active-directory/roles/permissions-reference#global-secure-access-administrator).
3030
1. Browse to **Global Secure Access** > **Connect** > **Traffic forwarding**.
3131
1. Select the **View** link in the Internet Access policies section.
3232
33
−The default Internet Access policies include:
34
−- **Custom Bypass** Contains user-defined traffic/endpoints that are *excluded* from the Internet traffic profile. In other words, you define the traffic that the profile shouldn't acquire. You might typically exclude traffic such as your VPN endpoints, private IP ranges, and squat IP ranges, and endpoints that leverage a network Access Control List (ACL).
33
+The Internet Access policies include:
34
+- **Custom Bypass** Contains user-defined traffic/endpoints that are *excluded* from the Internet traffic profile. In other words, you define the traffic that the profile shouldn't acquire. You might typically exclude traffic such as your VPN endpoints, squat IP ranges, and endpoints that leverage a network Access Control List (ACL).
3535
- **Default Bypass** Contains predefined traffic that the Internet traffic profile doesn't acquire. For example, private IP ranges. You can't change rules in this policy.
36
−- **Default Acquire** Defines traffic that gets acquired by the Internet traffic profile. Currently, it’s all internet traffic on ports 80, 443 over Transmission Control Protocol (TCP). The policy takes lowest precedence after all bypass rules are evaluated. You can't change rules in this policy.
36
+- **Microsoft Traffic Bypass** Contains predefined Microsoft endpoints that are explicitly excluded from the Internet traffic profile and are instead acquired using Microsoft traffic profile. You can't change rules in this policy.
37
+- **Custom Acquire** Contains user-defined traffic/endpoints that are explicitly *acquired* by the Internet traffic profile. Unlike the **Default Acquire** policy, which is limited to ports 80 and 443 over TCP, Custom Acquire lets you selectively acquire traffic for specific IP addresses, IP address ranges, IP subnets, and Fully Qualified Domain Names (FQDNs) on any ports and protocol (TCP or UDP) you specify. This lets you deploy Global Secure Access side by side with another Secure Web Gateway (SWG) vendor: Global Secure Access acquires the traffic you specify (for example, `chat.com`), while the other vendor covers the rest of your internet traffic.
38
+- **Default Acquire** Contains predefined traffic that gets acquired by the Internet traffic profile. This includes internet traffic on ports 80, 443 over TCP. The policy takes lowest precedence after all bypass and custom acquire rules are evaluated. You can't change rules in this policy.
39
+- **Agentic Acquire** A special policy that signals the Global Secure Access client to acquire all web traffic that originates from local AI agents running on the device, such as GitHub Copilot CLI, Claude CLI, and similar local agents. Enable it to deploy Global Secure Access for agentic (AI agent) protection side by side with another SWG vendor that covers user traffic. You can't change rules in this policy.
3740
38
−Example of adding a custom bypass policy:
41
+## How to add a custom bypass policy
3942
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Secure Access Administrator](/azure/active-directory/roles/permissions-reference#global-secure-access-administrator).
40
−1. Browse to **Global Secure Access** > **Connect** > **Traffic forwarding**.
41
−1. In the Internet Access traffic forwarding profile area, in the **Internet Access policies** section, select the **View** link
42
−1. Expand the **Custom Bypass** policy.
43
−1. Select **Add rule**.
44
−1. Choose a destination type, such as Fully Qualified Domain Name (FQDN). You can add multiple comma-separated destination values. Don't add whitespace. For example, `contoso.com,fabrikam.com` or `10.0.0.1/32,10.0.0.2/32`. Ports, protocol, and action are always fixed and can't be changed.
45
−1. Enter a valid destination.
46
−1. Select **Save**.
43
+2. Browse to **Global Secure Access** > **Connect** > **Traffic forwarding**.
44
+3. In the Internet Access traffic forwarding profile area, in the **Internet Access policies** section, select the **View** link
45
+4. Expand the **Custom Bypass** policy.
46
+5. Select **Add rule**.
47
+6. Choose a **destination type**: Fully Qualified Domain Name (FQDN), IP address, IP subnet, or IP range. You can add multiple comma-separated destination values. Don't add whitespace. For example, `chat.com,contoso.com` or `10.0.0.1/32,10.0.0.2/32`.
48
+7. Enter a valid **destination** and specify the **ports** and **protocol** (TCP or UDP) to bypass.
49
+8. Select **Save**.
4750
51
+## How to add a custom acquire policy
52
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Secure Access Administrator](/en-us/azure/active-directory/roles/permissions-reference#global-secure-access-administrator).
53
+2. Browse to **Global Secure Access** > **Connect** > **Traffic forwarding**.
54
+3. In the Internet Access traffic forwarding profile area, in the **Internet Access policies** section, select the **View** link.
55
+4. Expand the **Custom Acquire** policy.
56
+5. Select **Add rule**.
57
+6. Choose a **destination type**: Fully Qualified Domain Name (FQDN), IP address, IP subnet, or IP range. You can add multiple comma-separated destination values. Don't add whitespace. For example, `chat.com,contoso.com` or `10.0.0.1/32,10.0.0.2/32`.
58
+7. Enter a valid **destination** and specify the **ports** and **protocol** (TCP or UDP) to acquire.
59
+8. Disable the **Default Acquire** policy using the toggle next to it. Click **OK** when prompted.
60
+9. Select **Save**.
61
+
4862
> [!NOTE]
4963
> Traffic is evaluated from top to bottom, which means it only gets acquired by the Internet traffic profile if it’s not being bypassed in one of the bypass rules.
5064
65
+## How to enable agentic acquire policy
66
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Secure Access Administrator](/en-us/azure/active-directory/roles/permissions-reference#global-secure-access-administrator).
67
+2. Browse to **Global Secure Access** > **Connect** > **Traffic forwarding**.
68
+3. In the Internet Access traffic forwarding profile area, in the **Internet Access policies** section, select the **View** link.
69
+4. For first time setup, click the **Create Agentic Acquire** button to create the policy. If policy is already created, use the toggle to enable it. Click **OK** when prompted.
70
+5. Disable the **Custom Acquire** and **Default Acquire** policy using the toggles next to them. Click **OK** when prompted.
71
+
72
+> [!NOTE]
73
+> Agentic Acquire is only supported on Windows and Mac platforms. Minimum required client version for Windows is **2.31.125** and for Mac is **1.1.26030604**.
74
+
5175
## User and group assignments
5276
You can scope the Internet Access profile to specific users and groups.
5377
⋯ 18 unchanged lines
7296
1. Open a web browser and navigate to a destination on the internal network. Confirm that traffic isn't being captured.
7397
1. Open a web browser and navigate to a destination that is bypassed. Confirm that traffic isn't being captured.
7498
1. Open a web browser and navigate to a public destination that is acquired by the profile. Confirm the traffic is being acquired under the **Internet channel**.
75
−
76
−
77
−
7899
79100
## Next steps
80101
- [Learn about traffic forwarding](concept-traffic-forwarding.md)
⋯ 2 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:44 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.