Check my allow list

Paste the destinations from a Global Secure Access web filtering policy, a firewall or a proxy. ChangeIntel sorts them by what it can trace: documented by Microsoft or a vendor, taken by a Microsoft profile before web filtering, or in no source it follows. It also lists what the bundles you pick require and your list doesn't allow.

Nothing you paste is stored, logged or sent anywhere; the comparison runs once for this page. Information, not advice: a destination in no source may still be needed (you may have found it in traffic traces), and Microsoft publishes no host list for its GSA profiles.

How this works

Destinations can be separated by commas, semicolons, spaces or lines; bullets, quotes and Markdown links are tidied. A leading *. wildcard is treated as matching subdomains only, not the bare domain, as Microsoft documents for GSA V1 domain rules; V2 URL rules, firewalls and proxies may differ. A URL covers a requirement only when the full destination matches exactly; an unrestricted host rule can cover URLs on that host. URL paths retain their case. IP ranges are compared exactly. Up to 3,000 destinations are read.