{
  "format": "changeintel.gsa-web-filtering-v2",
  "graphShapeDocumented": false,
  "note": "Neutral review format. Create the rule in the Microsoft Entra admin center: Global Secure Access \u003E Secure \u003E Web Filtering Policies (V2).",
  "rules": [
    {
      "name": "ChangeIntel Apple devices",
      "action": "Allow",
      "destinations": [
        {
          "type": "url",
          "value": "albert.apple.com",
          "purpose": "Device activation",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicesetup"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "captive.apple.com",
          "purpose": "Internet connectivity validation for networks that use captive portals",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicesetup"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "gs.apple.com",
          "purpose": "iOS, iPadOS, tvOS, macOS, and visionOS; iOS, iPadOS, tvOS, watchOS, and macOS updates",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicesetup",
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "humb.apple.com",
          "purpose": "iOS, iPadOS, tvOS, macOS, and visionOS",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicesetup"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "static.ips.apple.com",
          "purpose": "iOS, iPadOS, tvOS, macOS, and visionOS",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicesetup"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "sq-device.apple.com",
          "purpose": "eSIM activation",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicesetup"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "tbsc.apple.com",
          "purpose": "iOS, iPadOS, tvOS, macOS, and visionOS",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicesetup"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "time-ios.apple.com",
          "purpose": "Used by devices to set their date and time",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicesetup"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Web filtering assumes ports 80 and 443; port 123 traffic needs a firewall rule instead.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "time.apple.com",
          "purpose": "Used by devices to set their date and time",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicesetup"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Web filtering assumes ports 80 and 443; port 123 traffic needs a firewall rule instead.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "time-macos.apple.com",
          "purpose": "Used by devices to set their date and time",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicesetup"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Web filtering assumes ports 80 and 443; port 123 traffic needs a firewall rule instead.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "*.push.apple.com",
          "purpose": "Push notifications",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicemanagement"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of push.apple.com but not push.apple.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Web filtering assumes ports 80 and 443; port 2197, 5223 traffic needs a firewall rule instead."
          ]
        },
        {
          "type": "url",
          "value": "deviceenrollment.apple.com",
          "purpose": "DEP provisional enrollment",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicemanagement"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "deviceservices-external.apple.com",
          "purpose": "Used by an device management service to disable Activation Lock on managed devices",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicemanagement"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "gdmf.apple.com",
          "purpose": "Used by an device management service to identify which software updates are available to devices that use managed software updates; Software update catalog",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicemanagement",
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "identity.apple.com",
          "purpose": "APNs certificate request portal",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicemanagement"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "iprofiles.apple.com",
          "purpose": "Hosts enrollment profiles used when devices enroll in Apple School Manager or Apple Business through Device Enrollment",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicemanagement"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "mdmenrollment.apple.com",
          "purpose": "Device management services to upload enrollment profiles used by clients enrolling through Device Enrollment in Apple School Manager or Apple Business, and to look up devices and accounts",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicemanagement"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "setup.icloud.com",
          "purpose": "Required to log in to a Managed Apple Account on Shared iPad",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicemanagement"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "vpp.itunes.apple.com",
          "purpose": "Device management services to perform operations related to Apps and Books, like assigning or revoking licenses on a device",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicemanagement"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "*.appattest.apple.com",
          "purpose": "Managed device attestation; App validation, Touch ID and Face ID authentication for websites",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicemanagement",
            "https://support.apple.com/en-us/101555#appscontent"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of appattest.apple.com but not appattest.apple.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "axm-servicediscovery.apple.com",
          "purpose": "Service discovery for account-driven enrollments",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#devicemanagement"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "axm-adm-enroll.apple.com",
          "purpose": "DEP enrollment server",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#abdm"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "axm-adm-mdm.apple.com",
          "purpose": "Device management service",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#abdm"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "axm-adm-scep.apple.com",
          "purpose": "SCEP server",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#abdm"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "axm-app.apple.com",
          "purpose": "View and manage apps and devices",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#abdm"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "*.apple-mapkit.com",
          "purpose": "View the location of devices in Managed Lost Mode",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#abdm"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of apple-mapkit.com but not apple-mapkit.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Looks like a certificate validation host and isn\u0027t in the Microsoft 365 list. Microsoft documents that the Entra system profile covers certificate validation but lists no hosts, so this can go either way. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "icons.axm-usercontent-apple.com",
          "purpose": "Custom Package icons",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#abdm"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "appldnld.apple.com",
          "purpose": "iOS, iPadOS, and watchOS updates",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "configuration.apple.com",
          "purpose": "Rosetta 2 updates",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "gg.apple.com",
          "purpose": "iOS, iPadOS, tvOS, watchOS, and macOS updates",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "ig.apple.com",
          "purpose": "macOS updates",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "mesu.apple.com",
          "purpose": "Hosts software update catalogs",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "oscdn.apple.com",
          "purpose": "macOS Recovery",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "osrecovery.apple.com",
          "purpose": "macOS Recovery",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "skl.apple.com",
          "purpose": "macOS updates",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "swcdn.apple.com",
          "purpose": "macOS updates",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "swdist.apple.com",
          "purpose": "macOS updates",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "swdownload.apple.com",
          "purpose": "macOS updates",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "swscan.apple.com",
          "purpose": "macOS updates",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "updates-http.cdn-apple.com",
          "purpose": "Software update downloads",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "updates.cdn-apple.com",
          "purpose": "Software update downloads",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "xp.apple.com",
          "purpose": "iOS, iPadOS, tvOS, macOS, and visionOS",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "gdmf-ados.apple.com",
          "purpose": "Software update catalog for additional components",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "gsra.apple.com",
          "purpose": "OS updates for additional components",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "wkms-public.apple.com",
          "purpose": "Installing iOS, iPadOS, or macOS on an attached device",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "fcs-keys-pub-prod.cdn-apple.com",
          "purpose": "Installing iOS, iPadOS, or macOS on an attached device",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#software"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "*.itunes.apple.com",
          "purpose": "Store content such as apps, books, and music",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appscontent"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of itunes.apple.com but not itunes.apple.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "*.apps.apple.com",
          "purpose": "Store content such as apps, books, and music",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appscontent"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of apps.apple.com but not apps.apple.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "*.mzstatic.com",
          "purpose": "Store content such as apps, books, and music, and apps from websites and alternative marketplaces",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appscontent"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of mzstatic.com but not mzstatic.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "itunes.apple.com",
          "purpose": "iOS, iPadOS, tvOS, macOS, and visionOS",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appscontent"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "ppq.apple.com",
          "purpose": "Enterprise App validation",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appscontent"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "api.apple-cloudkit.com",
          "purpose": "App notarization",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appscontent"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "*.apps-marketplace.apple.com",
          "purpose": "Installing apps from websites and alternative marketplaces",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appscontent"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of apps-marketplace.apple.com but not apps-marketplace.apple.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "audiocontentdownload.apple.com",
          "purpose": "GarageBand downloadable content",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appscontent"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "devimages-cdn.apple.com",
          "purpose": "Xcode downloadable components",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appscontent"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "download.developer.apple.com",
          "purpose": "Xcode downloadable components",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appscontent"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "playground-assets-cdn.apple.com",
          "purpose": "Swift Playground",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appscontent"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "playground-cdn.apple.com",
          "purpose": "Swift Playground",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appscontent"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "sylvan.apple.com",
          "purpose": "Aerial screen savers and wallpaper",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appscontent"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "gateway.icloud.com",
          "purpose": "CloudKit content including XProtect updates and Voice Control assets",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appscontent"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "certs.apple.com",
          "purpose": "Certificate validation",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#certificate"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "crl.apple.com",
          "purpose": "Certificate validation",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#certificate"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Looks like a certificate validation host and isn\u0027t in the Microsoft 365 list. Microsoft documents that the Entra system profile covers certificate validation but lists no hosts, so this can go either way. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "crl3.digicert.com",
          "purpose": "Certificate validation",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#certificate"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "In Microsoft 365 Common endpoint set 125 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "crl4.digicert.com",
          "purpose": "Certificate validation",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#certificate"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "In Microsoft 365 Common endpoint set 125 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "ocsp.apple.com",
          "purpose": "Certificate validation",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#certificate"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Looks like a certificate validation host and isn\u0027t in the Microsoft 365 list. Microsoft documents that the Entra system profile covers certificate validation but lists no hosts, so this can go either way. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "ocsp.digicert.cn",
          "purpose": "Certificate validation in China",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#certificate"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Looks like a certificate validation host and isn\u0027t in the Microsoft 365 list. Microsoft documents that the Entra system profile covers certificate validation but lists no hosts, so this can go either way. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "ocsp.digicert.com",
          "purpose": "Certificate validation",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#certificate"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "In Microsoft 365 Common endpoint set 125 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "ocsp2.apple.com",
          "purpose": "Certificate validation",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#certificate"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Looks like a certificate validation host and isn\u0027t in the Microsoft 365 list. Microsoft documents that the Entra system profile covers certificate validation but lists no hosts, so this can go either way. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "valid.apple.com",
          "purpose": "Certificate validation",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#certificate"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "account.apple.com",
          "purpose": "Apple Account authentication in Settings and System Preferences",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appleaccount"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "appleid.cdn-apple.com",
          "purpose": "Apple Account authentication in Settings and System Preferences",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appleaccount"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "idmsa.apple.com",
          "purpose": "Apple Account authentication",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appleaccount"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "gsa.apple.com",
          "purpose": "Apple Account authentication",
          "required": true,
          "sources": [
            "https://support.apple.com/en-us/101555#appleaccount"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        }
      ]
    }
  ],
  "notes": [
    "In V2 a security profile contains exactly one web filtering policy. Each rule carries its own Allow or Block action and the policy has a default action (Allow, Block, or the preview Continue Evaluation).",
    "V2 has no standalone FQDN type: FQDNs are expressed as URL destinations, and a URL destination matches the address and its sub-paths.",
    "A former exact-host FQDN evaluated with URL logic can match sub-paths of the address rather than only the exact host; review destinations to confirm they match the intended traffic.",
    "V2 runs before V1. A V2 Block is terminal; a V2 Allow isn\u0027t, so a V1 policy can still block the same traffic.",
    "Without TLS inspection, HTTPS traffic is evaluated by Server Name Indication (SNI); only unencrypted HTTP exposes the full URL."
  ]
}