{
  "format": "changeintel.gsa-web-filtering-v2",
  "graphShapeDocumented": false,
  "note": "Neutral review format. Create the rule in the Microsoft Entra admin center: Global Secure Access \u003E Secure \u003E Web Filtering Policies (V2).",
  "rules": [
    {
      "name": "ChangeIntel Entra Connect Health agent",
      "action": "Allow",
      "destinations": [
        {
          "type": "url",
          "value": "*.blob.core.windows.net",
          "purpose": "General public",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-agent-install#outbound-connectivity-to-azure-service-endpoints"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of blob.core.windows.net but not blob.core.windows.net itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Broader than the Microsoft 365 entries it includes (such as set 182): those parts are expected to go to a Microsoft profile and the rest to Internet Access. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "*.aadconnecthealth.azure.com",
          "purpose": "General public",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-agent-install#outbound-connectivity-to-azure-service-endpoints"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of aadconnecthealth.azure.com but not aadconnecthealth.azure.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "*.servicebus.windows.net",
          "purpose": "General public Port: 5671 (If 5671 is blocked, the agent falls back to 443, but we recommend that you use port 5671. This endpoint isn\u0027t required in the latest version of the agent.)",
          "required": false,
          "sources": [
            "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-agent-install#outbound-connectivity-to-azure-service-endpoints"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of servicebus.windows.net but not servicebus.windows.net itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Web filtering assumes ports 80 and 443; port 5671 traffic needs a firewall rule instead."
          ]
        },
        {
          "type": "url",
          "value": "*.adhybridhealth.azure.com",
          "purpose": "General public",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-agent-install#outbound-connectivity-to-azure-service-endpoints"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of adhybridhealth.azure.com but not adhybridhealth.azure.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "https://management.azure.com",
          "purpose": "General public",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-agent-install#outbound-connectivity-to-azure-service-endpoints"
          ],
          "caveats": []
        },
        {
          "type": "url",
          "value": "https://login.windows.net",
          "purpose": "General public",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-agent-install#outbound-connectivity-to-azure-service-endpoints"
          ],
          "caveats": [
            "Public material indicates the Microsoft Entra system profile takes this before Internet Access (indicated, not confirmed), so this rule is probably redundant. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "https://login.microsoftonline.com",
          "purpose": "General public",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-agent-install#outbound-connectivity-to-azure-service-endpoints"
          ],
          "caveats": [
            "Public material indicates the Microsoft Entra system profile takes this before Internet Access (indicated, not confirmed), so this rule is probably redundant. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "https://secure.aadcdn.microsoftonline-p.com",
          "purpose": "General public",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-agent-install#outbound-connectivity-to-azure-service-endpoints"
          ],
          "caveats": [
            "Public material indicates the Microsoft Entra system profile takes this before Internet Access (indicated, not confirmed), so this rule is probably redundant. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "https://www.office.com",
          "purpose": "General public This endpoint is used only for discovery purposes during registration.",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-agent-install#outbound-connectivity-to-azure-service-endpoints"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 147 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "https://aadcdn.msftauth.net",
          "purpose": "General public",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-agent-install#outbound-connectivity-to-azure-service-endpoints"
          ],
          "caveats": [
            "Public material indicates the Microsoft Entra system profile takes this before Internet Access (indicated, not confirmed), so this rule is probably redundant. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "https://aadcdn.msauth.net",
          "purpose": "General public",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-agent-install#outbound-connectivity-to-azure-service-endpoints"
          ],
          "caveats": [
            "Public material indicates the Microsoft Entra system profile takes this before Internet Access (indicated, not confirmed), so this rule is probably redundant. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "https://autoupdate.msappproxy.net",
          "purpose": "General public",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-agent-install#outbound-connectivity-to-azure-service-endpoints"
          ],
          "caveats": []
        },
        {
          "type": "url",
          "value": "http://www.microsoft.com",
          "purpose": "General public",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-agent-install#outbound-connectivity-to-azure-service-endpoints"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.",
            "HTTP only: published for port 80."
          ]
        },
        {
          "type": "url",
          "value": "https://www.microsoft.com",
          "purpose": "General public",
          "required": true,
          "sources": [
            "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-agent-install#outbound-connectivity-to-azure-service-endpoints"
          ],
          "caveats": [
            "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        }
      ]
    }
  ],
  "notes": [
    "In V2 a security profile contains exactly one web filtering policy. Each rule carries its own Allow or Block action and the policy has a default action (Allow, Block, or the preview Continue Evaluation).",
    "V2 has no standalone FQDN type: FQDNs are expressed as URL destinations, and a URL destination matches the address and its sub-paths.",
    "A former exact-host FQDN evaluated with URL logic can match sub-paths of the address rather than only the exact host; review destinations to confirm they match the intended traffic.",
    "V2 runs before V1. A V2 Block is terminal; a V2 Allow isn\u0027t, so a V1 policy can still block the same traffic.",
    "Without TLS inspection, HTTPS traffic is evaluated by Server Name Indication (SNI); only unencrypted HTTP exposes the full URL."
  ]
}