Manage Private Access traffic forwarding profiles
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 3938e78 · +71 −31 lines · also on GitHub
11
---
2
−title: How to Manage the Private Access Profile
3
−description: "Configure the Private Access traffic forwarding profile to provide secure, VPN-less access to internal resources through Global Secure Access."
2
+title: Manage Private Access traffic forwarding profiles
3
+description: Configure and manage default and custom Private Access traffic forwarding profiles in Global Secure Access.
44
ms.topic: how-to
5
−ms.date: 03/25/2026
5
+ms.date: 09/20/2026
66
ms.subservice: entra-private-access
77
ms.reviewer: katabish
88
ai-usage: ai-assisted
9
−ms.custom: sfi-image-nochange
10
−# Customer intent: As an IT admin, I need to enable and manage the Private Access traffic forwarding profile so that the private access apps I configured can forward traffic according to the profile.
9
+# Customer intent: As an IT admin, I need to manage Private Access traffic forwarding profiles so that the appropriate private applications are available to specific users and devices.
1110
---
1211
13
−# How to manage the Private Access traffic forwarding profile
12
+# Manage Private Access traffic forwarding profiles
1413
1514
## Overview
1615
17
−The Private Access traffic forwarding profile routes traffic to your private network through the Global Secure Access Client. Enabling this traffic forwarding profile allows remote workers to connect to internal resources without a VPN. With the features of Microsoft Entra Private Access, you can control which private resources to tunnel through the service and apply Conditional Access policies to secure access to those services. Once your configurations are in place, you can view and manage all of those configurations from one place.
16
+Private Access traffic forwarding profiles route traffic from the Global Secure Access client to private resources. Enabling this traffic forwarding profile allows remote workers to connect to internal resources without a VPN. With the features of Microsoft Entra Private Access, you can control which private resources to tunnel through the service and apply Conditional Access policies to secure access to those services. You can use the default Private Access profile or create custom profiles with different applications, assignments, device platforms, priorities, and status.
1817
18
+Multiple profiles let you provide different private application access to internal and external users, desktop and mobile devices, or other groups with distinct access requirements.
19
+
1920
## Prerequisites
2021
21
−To enable the Private Access forwarding profile for your tenant, you must have:
22
+To manage Private Access traffic forwarding profiles, you must have:
2223
2324
- A [Global Secure Access Administrator](../identity/role-based-access-control/permissions-reference.md#global-secure-access-administrator) role in Microsoft Entra ID.
24
− - A [Conditional Access Administrator](../identity/role-based-access-control/permissions-reference.md#conditional-access-administrator) role to create and interact with Conditional Access policies.
25
−- The product requires licensing. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
25
+- An [Application Administrator](../identity/role-based-access-control/permissions-reference.md#application-administrator) role to manage Private Access applications.
26
+- A [Conditional Access Administrator](../identity/role-based-access-control/permissions-reference.md#conditional-access-administrator) role to create and manage Conditional Access policies.
27
+- Microsoft Entra Private Access or Microsoft Entra Suite licensing. For more information, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md).
2628
2729
### Known limitations
2830
2931
[!INCLUDE [known-limitations-include](../includes/known-limitations-include.md)]
3032
31
−## Enable the Private Access traffic forwarding profile
33
+During preview:
3234
33
−1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Secure Access Administrator](../identity/role-based-access-control/permissions-reference.md#global-secure-access-administrator).
35
+- You can create up to 10 custom Private Access traffic forwarding profiles.
36
+- A Private Access application must be included in the default Private Access profile before it can be selected for a custom profile.
37
+
38
+## View Private Access profiles
39
+
40
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a Global Secure Access Administrator.
3441
1. Browse to **Global Secure Access** > **Connect** > **Traffic forwarding**.
35
−1. Select the checkbox for **Private Access profile**.
3642
37
−## Private Access policies
43
+The page displays the system-created profiles and any custom profiles. Select a profile name to manage its **Basics**, **Acquisition rules**, and **Assignments**.
3844
39
−To enable the Private Access traffic forwarding profile, it's recommended to first configure Quick Access. Quick Access includes the IP addresses, IP ranges, and fully qualified domain names (FQDNs) for the private resources you want to include in the policy. For more information, see [Configure Quick Access](how-to-configure-quick-access.md).
45
+To add a custom profile, see [Create a Private Access traffic forwarding profile](how-to-create-traffic-forwarding-profile.md).
4046
41
−You can also configure per-app access to your private resources by creating a Private Access app. Similar to Quick Access, you create a new Enterprise app, which can then be assigned to the Private Access traffic forwarding profile. Quick Access contains the main group of private resources you always want to route through the service. Private Access apps can be enabled and disabled as needed without impacting the FQDNs and IP addresses included in Quick Access.
47
+## Manage profile settings
4248
43
−To manage the details included in the Private Access traffic forwarding policy, select the **View** link for **Private Access policies**.
49
+Select **Basics** to update the custom profile's name, description, priority, or status.
4450
45
−
51
+Priority determines which profile is effective if multiple Private Access profiles apply to the same user and device. Only the applicable profile with the highest priority is used by the client.
4652
47
−Details of your Quick Access and enterprise apps for Private Access are displayed. Select the link for the application to view the details from the Enterprise applications area of Microsoft Entra ID.
53
+## Manage acquisition rules
4854
49
−## Linked Conditional Access policies
55
+Acquisition rules determine which private resources are included in a profile.
5056
51
−Conditional Access policies for Private Access are configured at the application level for each app. Conditional Access policies can be created and applied to the application from two places:
57
+1. Select the Private Access profile.
58
+1. Select **Acquisition rules**.
59
+1. Configure whether the profile includes Quick Access.
60
+1. Select the applications link to add or remove Private Access applications.
5261
53
−- Go to **Global Secure Access** > **Applications** > **Enterprise applications**. Select an application and then select **Conditional Access** from the side menu.
54
−- Go to **Entra ID** > **Conditional Access** > **Policies**. Select **+ Create new policy**.
62
+ 
5563
56
−For more information, see [Apply Conditional Access policies to Private Access apps](how-to-target-resource-private-access-apps.md).
64
+Use **Select all** to include all available applications, and then remove the applications that shouldn't be part of the profile.
5765
58
−## User and group assignments
59
−You can scope the Private Access profile to specific users and groups. The users and groups must be assigned to both the Private Access apps and the traffic forwarding profile.
66
+### Associate an application with multiple profiles
6067
61
−For more information about user and group assignment, see [How to assign and manage users and groups with traffic forwarding profiles](how-to-manage-users-groups-assignment.md).
68
+You can also manage profile associations from the Private Access application:
6269
70
+1. Browse to **Global Secure Access** > **Applications** > **Enterprise applications**.
71
+1. Select the application, and then select **Network access properties**.
72
+1. Select **Manage attached profiles**.
73
+1. Select one or more profiles, and then select **Save**.
6374
75
+An application can be associated with multiple Private Access traffic forwarding profiles.
6476
65
−## Next steps
77
+## Manage profile assignments
6678
67
−The next step for getting started with Microsoft Entra Internet Access is to [install and configure the Global Secure Access Client on end-user devices](how-to-install-windows-client.md).
79
+Select **Assignments** to configure:
6880
69
−For more information about Private Access, see the following articles:
70
−- [Learn about traffic forwarding](concept-traffic-forwarding.md)
81
+- **User and device assignments**: Assign no users or devices, all users and devices, or selected users, groups, and devices.
82
+- **Device platform assignments**: Select the device platforms that receive the profile.
83
+
84
+ 
85
+
86
+The two assignment conditions are evaluated together. For example, if a profile is assigned to selected users and the Android platform, only Android devices used by those selected users receive the profile.
87
+
88
+For detailed steps and assignment examples, see [Assign users and devices to traffic forwarding profiles](how-to-manage-users-groups-assignment.md).
89
+
90
+## Linked Conditional Access policies
91
+
92
+Conditional Access policies for Private Access are configured at the application level. You can create and apply a Conditional Access policy from either location:
93
+
94
+- Browse to **Global Secure Access** > **Applications** > **Enterprise applications**. Select an application, and then select **Conditional Access**.
95
+- Browse to **Entra ID** > **Conditional Access** > **Policies**, and then select **New policy**.
96
+
97
+For more information, see [Apply Conditional Access policies to Private Access applications](how-to-target-resource-private-access-apps.md).
98
+
99
+## Delete a custom profile
100
+
101
+Custom Private Access profiles can be deleted. The system-created default profile can't be deleted. Deleted custom profiles can't be restored.
102
+
103
+For detailed steps, see [Delete a Private Access traffic forwarding profile](how-to-delete-traffic-forwarding-profile.md).
104
+
105
+## Next steps
106
+
107
+- [Create a Private Access traffic forwarding profile](how-to-create-traffic-forwarding-profile.md)
108
+- [Delete a Private Access traffic forwarding profile](how-to-delete-traffic-forwarding-profile.md)
109
+- [Assign users and devices to traffic forwarding profiles](how-to-manage-users-groups-assignment.md)
71110
- [Configure Quick Access](how-to-configure-quick-access.md)
111
+- [Install and configure the Global Secure Access client](how-to-install-windows-client.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:06 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.