{
  "format": "changeintel.gsa-web-filtering-v2",
  "graphShapeDocumented": false,
  "note": "Neutral review format. Create the rule in the Microsoft Entra admin center: Global Secure Access \u003E Secure \u003E Web Filtering Policies (V2).",
  "rules": [
    {
      "name": "ChangeIntel Configuration Manager internet access",
      "action": "Allow",
      "destinations": [
        {
          "type": "url",
          "value": "*.akamaiedge.net",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of akamaiedge.net but not akamaiedge.net itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "*.akamaitechnologies.com",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of akamaitechnologies.com but not akamaitechnologies.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "*.manage.microsoft.com",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of manage.microsoft.com but not manage.microsoft.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Public material indicates the Microsoft traffic profile takes this before Internet Access (indicated, not confirmed), so this rule is probably redundant. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "go.microsoft.com",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "download.microsoft.com",
          "purpose": "Updates and servicing; Windows servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing",
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#windows-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "download.windowsupdate.com",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "In Microsoft 365 Intune (MEM) endpoint set 164 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "download.visualstudio.microsoft.com",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "definitionupdates.microsoft.com",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "configmgrbits.azureedge.net",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "configmgrbits.cdn.manage.microsoft.com",
          "purpose": "Important This Azure endpoint only supports TLS 1.2 with specific cipher suites. Make sure your environment supports these Azure configurations. For more information, see Azure Front Door: TLS configuration FAQ",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Public material indicates the Microsoft traffic profile takes this before Internet Access (indicated, not confirmed), so this rule is probably redundant. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "cmbitsstore.blob.core.windows.net",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "ceuswatcab01.blob.core.windows.net",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "ceuswatcab02.blob.core.windows.net",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "eaus2watcab01.blob.core.windows.net",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "eaus2watcab02.blob.core.windows.net",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "weus2watcab01.blob.core.windows.net",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "weus2watcab02.blob.core.windows.net",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "umwatsonc.events.data.microsoft.com",
          "purpose": "Updates and servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#updates-and-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "dl.delivery.mp.microsoft.com",
          "purpose": "Windows servicing",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#windows-servicing"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "officecdn.microsoft.com",
          "purpose": "to synchronize the software update point for Microsoft 365 Apps for enterprise client updates",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#manage-microsoft-365-apps"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "config.office.com",
          "purpose": "to create custom configurations for Microsoft 365 Apps for enterprise deployments",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#manage-microsoft-365-apps"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "In Microsoft 365 Common endpoint set 147 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "contentstorage.osi.office.net",
          "purpose": "to support the evaluation of Office add-in readiness",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#manage-microsoft-365-apps"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "In Microsoft 365 Common endpoint set 47 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "clients.config.office.net",
          "purpose": "to retrieve the names of the files needed for a particular Microsoft 365 Apps update. For more information, see Using the Microsoft 365 Apps file list API",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#manage-microsoft-365-apps"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "In Microsoft 365 Common endpoint set 47 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "http://windowsupdate.microsoft.com",
          "purpose": "Software updates",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#software-updates"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "http://*.windowsupdate.microsoft.com",
          "purpose": "Software updates",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#software-updates"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "https://*.windowsupdate.microsoft.com",
          "purpose": "Software updates",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#software-updates"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "http://*.update.microsoft.com",
          "purpose": "Software updates",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#software-updates"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "https://*.update.microsoft.com",
          "purpose": "Software updates",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#software-updates"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "http://*.windowsupdate.com",
          "purpose": "Software updates",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#software-updates"
          ],
          "caveats": [
            "In Microsoft 365 Intune (MEM) endpoint set 164 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "http://download.windowsupdate.com",
          "purpose": "Software updates",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#software-updates"
          ],
          "caveats": [
            "In Microsoft 365 Intune (MEM) endpoint set 164 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "http://download.microsoft.com",
          "purpose": "Software updates",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#software-updates"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "http://*.download.windowsupdate.com",
          "purpose": "Software updates",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#software-updates"
          ],
          "caveats": [
            "In Microsoft 365 Intune (MEM) endpoint set 164 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "http://ntservicepack.microsoft.com",
          "purpose": "Software updates",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#software-updates"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "https://clients.config.office.net",
          "purpose": "and https://go.microsoft.com/fwlink/?linkid=2190568 to support deploying updates for Microsoft 365 Apps for enterprise",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#manage-microsoft-365-apps"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 47 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "https://omex.cdn.office.net/mirrored/sccmreadiness/SOT_SCCM_AddinReadiness.CAB",
          "purpose": "Starting March 2, 2021",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#manage-microsoft-365-apps"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 47 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "https://contentstorage.osi.office.net/sccmreadinessppe/sot_sccm_addinreadiness.cab",
          "purpose": "Location before March 2, 2021",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#manage-microsoft-365-apps"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 47 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "https://aka.ms/configmgrgateway",
          "purpose": "Tenant attach",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#tenant-attach"
          ],
          "caveats": [
            "In Microsoft 365 Teams / Skype endpoint set 17 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "https://*.manage.microsoft.com",
          "purpose": "for Azure public cloud customers; Used to synch device collection and devices with Endpoint analytics on Configuration Manager server role only. For more information, see Configure the proxy for a site system server.",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#tenant-attach",
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#endpoints-required-for-configuration-manager-managed-devices"
          ],
          "caveats": [
            "Public material indicates the Microsoft traffic profile takes this before Internet Access (indicated, not confirmed), so this rule is probably redundant. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "https://*.manage.microsoft.us",
          "purpose": "for US Government cloud customers on version 2107 or later",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#tenant-attach"
          ],
          "caveats": []
        },
        {
          "type": "url",
          "value": "https://dc.services.visualstudio.com",
          "purpose": "Tenant attach",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#tenant-attach"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 75 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "http://crl3.digicert.com",
          "purpose": "Tenant attach",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#tenant-attach"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 125 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "http://crl4.digicert.com",
          "purpose": "Tenant attach",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#tenant-attach"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 125 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "http://ocsp.digicert.com",
          "purpose": "Tenant attach",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#tenant-attach"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 125 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "http://www.d-trust.net",
          "purpose": "Tenant attach",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#tenant-attach"
          ],
          "caveats": [
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "http://root-c3-ca2-2009.ocsp.d-trust.net",
          "purpose": "Tenant attach",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#tenant-attach"
          ],
          "caveats": [
            "Looks like a certificate validation host and isn\u0027t in the Microsoft 365 list. Microsoft documents that the Entra system profile covers certificate validation but lists no hosts, so this can go either way. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "http://crl.microsoft.com",
          "purpose": "Tenant attach",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#tenant-attach"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "http://oneocsp.microsoft.com",
          "purpose": "Tenant attach",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#tenant-attach"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "http://ocsp.msocsp.com",
          "purpose": "Tenant attach",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#tenant-attach"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 125 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "http://www.microsoft.com/pkiops",
          "purpose": "Tenant attach",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#tenant-attach"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "https://graph.windows.net",
          "purpose": "Used to automatically retrieve settings when attaching your hierarchy to Endpoint analytics on Configuration Manager server role. For more information, see Configure the proxy for a site system server.",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/network/internet-endpoints#endpoints-required-for-configuration-manager-managed-devices"
          ],
          "caveats": [
            "Public material indicates the Microsoft Entra system profile takes this before Internet Access (indicated, not confirmed), so this rule is probably redundant. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        }
      ]
    }
  ],
  "notes": [
    "In V2 a security profile contains exactly one web filtering policy. Each rule carries its own Allow or Block action and the policy has a default action (Allow, Block, or the preview Continue Evaluation).",
    "V2 has no standalone FQDN type: FQDNs are expressed as URL destinations, and a URL destination matches the address and its sub-paths.",
    "A former exact-host FQDN evaluated with URL logic can match sub-paths of the address rather than only the exact host; review destinations to confirm they match the intended traffic.",
    "V2 runs before V1. A V2 Block is terminal; a V2 Allow isn\u0027t, so a V1 policy can still block the same traffic.",
    "Without TLS inspection, HTTPS traffic is evaluated by Server Name Indication (SNI); only unencrypted HTTP exposes the full URL."
  ]
}