Internet Access web content filtering
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit deb73db · +7 −11 lines · also on GitHub
⋯ 1 unchanged line
22
title: How to configure Global Secure Access web content filtering
33
description: Learn how to configure web content filtering in Microsoft Entra Internet Access.
44
ms.topic: how-to
5
−ms.date: 03/04/2026
5
+ms.date: 03/13/2026
66
ms.subservice: entra-internet-access
77
ms.reviewer: frankgomulka
88
ai-usage: ai-assisted
⋯ 7 unchanged lines
1616
1717
The web filtering feature currently supports user- and context-aware Uniform Resource Locator (URL)-based web category filtering, URL filtering, and FQDN filtering.
1818
19
−> [!TIP]
20
−> For file type-based filtering (MIME types) and integration with Microsoft Purview for data loss prevention, see [Create a file policy to filter network file content](how-to-network-content-filtering.md).
21
−
2219
## Prerequisites
2320
2421
- Administrators who interact with **Global Secure Access** features must have one or more of the following role assignments depending on the tasks they're performing.
⋯ 20 unchanged lines
4542
1. [Assign users or groups to the traffic forwarding profile.](#user-and-group-assignments)
4643
4744
## Enable internet traffic forwarding
48
−The first step is to enable the Internet Access traffic forwarding profile. To learn more about the profile and how to enable it, see [How to manage the Internet Access traffic forwarding profile](how-to-manage-internet-access-profile.md).
45
+The first step is to enable the Internet Access traffic forwarding profile. For more information about the profile and how to enable it, see [How to manage the Internet Access traffic forwarding profile](how-to-manage-internet-access-profile.md).
4946
5047
## Create a web content filtering policy
5148
⋯ 16 unchanged lines
6865
In this step, you create a security profile to group filtering policies. Then you assign, or link, the security profiles with a Conditional Access policy to make them user or context aware.
6966
7067
> [!NOTE]
71
−> To learn more about Microsoft Entra Conditional Access policies, see [Building a Conditional Access policy](/azure/active-directory/conditional-access/concept-conditional-access-policies).
68
+> For more information about Microsoft Entra Conditional Access policies, see [Building a Conditional Access policy](/azure/active-directory/conditional-access/concept-conditional-access-policies).
7269
7370
1. Browse to **Global Secure Access** > **Secure** > **Security profiles**.
7471
1. Select **Create profile**.
⋯ 6 unchanged lines
8178
8279
## Create and link Conditional Access policy
8380
84
−Create a Conditional Access policy for end users or groups and deliver your security profile through Conditional Access Session controls. Conditional Access is the delivery mechanism for user and context awareness for Internet Access policies. To learn more about session controls, see [Conditional Access: Session](/azure/active-directory/conditional-access/concept-conditional-access-session).
81
+Create a Conditional Access policy for end users or groups and deliver your security profile through Conditional Access Session controls. Conditional Access is the delivery mechanism for user and context awareness for Internet Access policies. For more information about session controls, see [Conditional Access: Session](/azure/active-directory/conditional-access/concept-conditional-access-session).
8582
8683
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../identity/role-based-access-control/permissions-reference.md#conditional-access-administrator).
8784
1. Browse to **Entra ID** > **Conditional Access** > **Policies**.
8885
1. Select **New policy**.
89
−1. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
86
+1. Give your policy a name. Organizations should create a meaningful standard for the names of their policies.
9087
1. Under **Assignments**, select **Users or workload identities**.
9188
1. Under **Include**, select **All users**
9289
1. Select **Target resources** and **All internet resources with Global Secure Access**.
⋯ 4 unchanged lines
9794
9895
## Enable web content filtering for remote network traffic
9996
100
−Remote network connectivity allows you to connect branch offices and other remote locations to Global Secure Access without installing the client on individual devices. To learn more about remote network connectivity, see [Global Secure Access remote network connectivity](concept-remote-network-connectivity.md).
97
+Remote network connectivity allows you to connect branch offices and other remote locations to Global Secure Access without installing the client on individual devices. For more information about remote network connectivity, see [Global Secure Access remote network connectivity](concept-remote-network-connectivity.md).
10198
10299
You can use the baseline security profile to apply tenant-wide web content filtering policies to all remote network traffic. The baseline profile enforces policies at the lowest priority in the policy stack and applies to all Internet Access traffic routed through the service, making it ideal for securing remote network locations.
103100
⋯ 91 unchanged lines
195192
> Applying a new security profile can take up to 60-90 minutes due to security profile enforcement with access tokens. The user must receive a new access token with the new security profile ID as a claim before it takes effect. Changes to existing security profiles start being enforced much more quickly.
196193
197194
## User and group assignments
198
−You can scope the Internet Access profile to specific users and groups. To learn more about user and group assignment, see [How to assign and manage users and groups with traffic forwarding profiles](how-to-manage-users-groups-assignment.md).
195
+You can scope the Internet Access profile to specific users and groups. For more information about user and group assignment, see [How to assign and manage users and groups with traffic forwarding profiles](how-to-manage-users-groups-assignment.md).
199196
200197
## Verify end user policy enforcement
201198
⋯ 20 unchanged lines
222219
223220
## Next steps
224221
225
−- [Create a file policy to filter network file content](how-to-network-content-filtering.md)
226222
- [Learn about the traffic dashboard](concept-traffic-dashboard.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:37 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.