MODIFIED docs/global-secure-access/how-to-zscaler-coexistence.md

Modified by Ken Withee on Mar 13, 2026 4:18 PM
📖 View on learn.microsoft.com

+8 / -8 lines changed

Commit: Editorial pass: GSA remaining 35 articles - compliance audit

Changes:

Before

After

description: "Learn how to configure Microsoft and Zscaler SSE for unified SASE solutions to enhance security and connectivity in your organization."
#customer intent: As a network administrator, I want to configure Microsoft and Zscaler SSE for unified SASE solutions so that I can enhance security and connectivity in my organization.  
ms.topic: how-to
ms.date: 10/07/2025
ms.subservice: entra-private-access
ms.reviewer: shkhalid
ai-usage: ai-assisted
 
To set up Microsoft Entra Global Secure Access and test all scenarios in this documentation:
- Enable and disable different Microsoft Global Secure Access traffic forwarding profiles for your Microsoft Entra tenant. For more information about enabling and disabling profiles, see [Global Secure Access traffic forwarding profiles](concept-traffic-forwarding.md).
- Install and configure the Microsoft Entra private network connector. To learn how to install and configure the connector, see [How to configure connectors](how-to-configure-connectors.md).
    > [!NOTE]
    > Private Network Connectors are required for Microsoft Entra Private Access applications.
- Configure Quick Access to your private resources and set up Private Domain Name System (DNS) and DNS suffixes. To learn how to configure Quick Access, see [How to configure Quick Access](how-to-configure-quick-access.md).
- Install and configure the Global Secure Access client on end-user devices. For more information about clients, see [Global Secure Access clients](concept-clients.md). To learn how to install the Windows client, see [Global Secure Access client for Windows](how-to-install-windows-client.md). For macOS, see [Global Secure Access Client for macOS](how-to-install-macos-client.md).
 
### Zscaler Private Access and Internet Access
 
To integrate Zscaler Private Access and Zscaler Internet Access with Microsoft Global Secure Access, make sure you complete the following prerequisites. These steps ensure smooth integration, better traffic management, and improved security.
- Configure Zscaler Internet Access. To learn more about configuring Zscaler, see [Step-by-Step Configuration Guide for ZIA](https://help.zscaler.com/zia/step-step-configuration-guide-zia).

description: "Learn how to configure Microsoft and Zscaler SSE for unified SASE solutions to enhance security and connectivity in your organization."
#customer intent: As a network administrator, I want to configure Microsoft and Zscaler SSE for unified SASE solutions so that I can enhance security and connectivity in my organization.  
ms.topic: how-to
ms.date: 03/13/2026
ms.subservice: entra-private-access
ms.reviewer: shkhalid
ai-usage: ai-assisted
 
To set up Microsoft Entra Global Secure Access and test all scenarios in this documentation:
- Enable and disable different Microsoft Global Secure Access traffic forwarding profiles for your Microsoft Entra tenant. For more information about enabling and disabling profiles, see [Global Secure Access traffic forwarding profiles](concept-traffic-forwarding.md).
- Install and configure the Microsoft Entra private network connector. For information on how to install and configure the connector, see [How to configure connectors](how-to-configure-connectors.md).
    > [!NOTE]
    > Private Network Connectors are required for Microsoft Entra Private Access applications.
- Configure Quick Access to your private resources and set up Private Domain Name System (DNS) and DNS suffixes. For information on how to configure Quick Access, see [How to configure Quick Access](how-to-configure-quick-access.md).
- Install and configure the Global Secure Access client on end-user devices. For more information about clients, see [Global Secure Access clients](concept-clients.md). For information on how to install the Windows client, see [Global Secure Access client for Windows](how-to-install-windows-client.md). For macOS, see [Global Secure Access Client for macOS](how-to-install-macos-client.md).
 
### Zscaler Private Access and Internet Access
 
To integrate Zscaler Private Access and Zscaler Internet Access with Microsoft Global Secure Access, make sure you complete the following prerequisites. These steps ensure smooth integration, better traffic management, and improved security.
- Configure Zscaler Internet Access. For more information about configuring Zscaler, see [Step-by-Step Configuration Guide for ZIA](https://help.zscaler.com/zia/step-step-configuration-guide-zia).

MODIFIED docs/global-secure-access/how-to-configure-web-content-filtering.md

Modified by Ken Withee on Mar 13, 2026 4:18 PM
📖 View on learn.microsoft.com

+7 / -7 lines changed

Commit: Editorial pass: GSA remaining 35 articles - compliance audit

Changes:

Before

After

title: How to configure Global Secure Access web content filtering
description: Learn how to configure web content filtering in Microsoft Entra Internet Access.
ms.topic: how-to
ms.date: 02/21/2026
ms.subservice: entra-internet-access 
ms.reviewer: frankgomulka
ai-usage: ai-assisted
1. [Assign users or groups to the traffic forwarding profile.](#user-and-group-assignments)
 
## Enable internet traffic forwarding
The first step is to enable the Internet Access traffic forwarding profile. To learn more about the profile and how to enable it, see [How to manage the Internet Access traffic forwarding profile](how-to-manage-internet-access-profile.md).
 
## Create a web content filtering policy
 
In this step, you create a security profile to group filtering policies. Then you assign, or link, the security profiles with a Conditional Access policy to make them user or context aware.
 
> [!NOTE]
> To learn more about Microsoft Entra Conditional Access policies, see [Building a Conditional Access policy](/azure/active-directory/conditional-access/concept-conditional-access-policies).
 
1. Browse to **Global Secure Access** > **Secure** > **Security profiles**.

title: How to configure Global Secure Access web content filtering
description: Learn how to configure web content filtering in Microsoft Entra Internet Access.
ms.topic: how-to
ms.date: 03/13/2026
ms.subservice: entra-internet-access 
ms.reviewer: frankgomulka
ai-usage: ai-assisted
1. [Assign users or groups to the traffic forwarding profile.](#user-and-group-assignments)
 
## Enable internet traffic forwarding
The first step is to enable the Internet Access traffic forwarding profile. For more information about the profile and how to enable it, see [How to manage the Internet Access traffic forwarding profile](how-to-manage-internet-access-profile.md).
 
## Create a web content filtering policy
 
In this step, you create a security profile to group filtering policies. Then you assign, or link, the security profiles with a Conditional Access policy to make them user or context aware.
 
> [!NOTE]
> For more information about Microsoft Entra Conditional Access policies, see [Building a Conditional Access policy](/azure/active-directory/conditional-access/concept-conditional-access-policies).
 
1. Browse to **Global Secure Access** > **Secure** > **Security profiles**.

MODIFIED docs/global-secure-access/how-to-netskope-coexistence.md

Modified by Ken Withee on Mar 13, 2026 4:18 PM
📖 View on learn.microsoft.com

+6 / -6 lines changed

Commit: Editorial pass: GSA remaining 35 articles - compliance audit

Changes:

Before

After

description: Learn how to configure and deploy Microsoft Entra and Netskope Security Service Edge (SSE) solutions together for optimized security and connectivity across private applications, Microsoft 365, and internet access.
contributors:
ms.topic: concept-article
ms.date: 10/07/2025
ms.reviewer: shkhalid
ai-usage: ai-assisted
---
To set up Global Secure Access and test all scenarios in this documentation:
 
1. Enable and disable different Microsoft Global Secure Access traffic forwarding profiles for your Microsoft Entra tenant. For more information about enabling and disabling profiles, see [Global Secure Access traffic forwarding profiles](/entra/global-secure-access/concept-traffic-forwarding).
1. Install and configure the Microsoft Entra private network connector. To learn how to install and configure the connector, see [How to configure connectors](/entra/global-secure-access/how-to-configure-connectors).
    > [!NOTE]
    > Private Network Connectors are required for Microsoft Entra Private Access applications.
1. Configure Quick Access to your private resources and set up Private Domain Name System (DNS) and DNS suffixes. To learn how to configure Quick Access, see [How to configure Quick Access](/entra/global-secure-access/how-to-configure-quick-access).
1. Install and configure the Global Secure Access client on end-user devices. For more information about clients, see [Global Secure Access clients](/entra/global-secure-access/concept-clients). To learn how to install the Windows client, see [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client). For macOS, see [Global Secure Access Client for macOS](/entra/global-secure-access/how-to-install-macos-client).
 
## Netskope Private Access and Internet Access
 
1. Configure Netskope Private Apps. To learn more about configuring Netskope Private Access, see [Netskope One Private Access](https://docs.netskope.com/en/netskope-private-access) documentation.
1. Configure Netskope Steering Configurations for Private and Internet Access. To learn more about configuring Netskope, see [Netskope Traffic Steering documentation](https://docs.netskope.com/en/creating-a-steering-configuration/). The steps for creating the required steering configurations for each scenario are listed.

description: Learn how to configure and deploy Microsoft Entra and Netskope Security Service Edge (SSE) solutions together for optimized security and connectivity across private applications, Microsoft 365, and internet access.
contributors:
ms.topic: concept-article
ms.date: 03/13/2026
ms.reviewer: shkhalid
ai-usage: ai-assisted
---
To set up Global Secure Access and test all scenarios in this documentation:
 
1. Enable and disable different Microsoft Global Secure Access traffic forwarding profiles for your Microsoft Entra tenant. For more information about enabling and disabling profiles, see [Global Secure Access traffic forwarding profiles](/entra/global-secure-access/concept-traffic-forwarding).
1. Install and configure the Microsoft Entra private network connector. For information on how to install and configure the connector, see [How to configure connectors](/entra/global-secure-access/how-to-configure-connectors).
    > [!NOTE]
    > Private Network Connectors are required for Microsoft Entra Private Access applications.
1. Configure Quick Access to your private resources and set up Private Domain Name System (DNS) and DNS suffixes. For information on how to configure Quick Access, see [How to configure Quick Access](/entra/global-secure-access/how-to-configure-quick-access).
1. Install and configure the Global Secure Access client on end-user devices. For more information about clients, see [Global Secure Access clients](/entra/global-secure-access/concept-clients). For information on how to install the Windows client, see [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client). For macOS, see [Global Secure Access Client for macOS](/entra/global-secure-access/how-to-install-macos-client).
 
## Netskope Private Access and Internet Access
 
1. Configure Netskope Private Apps. For more information about configuring Netskope Private Access, see [Netskope One Private Access](https://docs.netskope.com/en/netskope-private-access) documentation.
1. Configure Netskope Steering Configurations for Private and Internet Access. For more information about configuring Netskope, see [Netskope Traffic Steering documentation](https://docs.netskope.com/en/creating-a-steering-configuration/). The steps for creating the required steering configurations for each scenario are listed.

MODIFIED docs/global-secure-access/how-to-palo-alto-coexistence.md

Modified by Ken Withee on Mar 13, 2026 4:18 PM
📖 View on learn.microsoft.com

+5 / -5 lines changed

Commit: Editorial pass: GSA remaining 35 articles - compliance audit

Changes:

Before

After

title: Learn about Security Service Edge (SSE) coexistence with Microsoft and Palo Alto Networks.
description: Microsoft and Palo Alto Network’s Security Service Edge (SSE) coexistence solution guide.
ms.topic: how-to
ms.date: 10/07/2025
ms.subservice: entra-private-access 
ms.reviewer: shkhalid
ai-usage: ai-assisted
 
- Enable and disable different Global Secure Access traffic forwarding profiles for your Microsoft Entra tenant. For more information about enabling and disabling profiles, see [Global Secure Access traffic forwarding profiles](/entra/global-secure-access/concept-traffic-forwarding).
 
- Install and configure the Microsoft Entra private network connector. To learn how to install and configure the connector, see [How to configure connectors](/entra/global-secure-access/how-to-configure-connectors).
 
> [!NOTE]
> Private Network Connectors are required for Microsoft Entra Private Access applications.
 
- Configure Quick Access to your private resources and set up Private Domain Name System (DNS) and DNS suffixes. To learn how to configure Quick Access, see [How to configure Quick Access](/entra/global-secure-access/how-to-configure-quick-access).
- Install and configure the Global Secure Access client on end-user devices. For more information about clients, see [Global Secure Access clients](/entra/global-secure-access/concept-clients). To learn how to install the Windows client, see [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client). For macOS, see [Global Secure Access Client for macOS](/entra/global-secure-access/how-to-install-macos-client).
 
**Palo Alto Prisma Access**
 

title: Learn about Security Service Edge (SSE) coexistence with Microsoft and Palo Alto Networks.
description: Microsoft and Palo Alto Network’s Security Service Edge (SSE) coexistence solution guide.
ms.topic: how-to
ms.date: 03/13/2026
ms.subservice: entra-private-access 
ms.reviewer: shkhalid
ai-usage: ai-assisted
 
- Enable and disable different Global Secure Access traffic forwarding profiles for your Microsoft Entra tenant. For more information about enabling and disabling profiles, see [Global Secure Access traffic forwarding profiles](/entra/global-secure-access/concept-traffic-forwarding).
 
- Install and configure the Microsoft Entra private network connector. For information on how to install and configure the connector, see [How to configure connectors](/entra/global-secure-access/how-to-configure-connectors).
 
> [!NOTE]
> Private Network Connectors are required for Microsoft Entra Private Access applications.
 
- Configure Quick Access to your private resources and set up Private Domain Name System (DNS) and DNS suffixes. For information on how to configure Quick Access, see [How to configure Quick Access](/entra/global-secure-access/how-to-configure-quick-access).
- Install and configure the Global Secure Access client on end-user devices. For more information about clients, see [Global Secure Access clients](/entra/global-secure-access/concept-clients). For information on how to install the Windows client, see [Global Secure Access client for Windows](/entra/global-secure-access/how-to-install-windows-client). For macOS, see [Global Secure Access Client for macOS](/entra/global-secure-access/how-to-install-macos-client).
 
**Palo Alto Prisma Access**
 

MODIFIED docs/identity-platform/reference-native-authentication-api.md

Modified by Henry Mbugua on Mar 13, 2026 10:00 AM
📖 View on learn.microsoft.com

+5 / -5 lines changed

Commit: Fix 5 inaccuracies in native authentication API reference

Changes:

Before

After

|-----------------------|-------------------------|------------------------|
| `tenant_subdomain`  |   Yes |  The subdomain of the external tenant that you created. In the URL, replace `{tenant_subdomain}` with the Directory (tenant) subdomain. For example, if your tenant's primary domain is *contoso.onmicrosoft.com*, use *contoso*. If you don't have your tenant subdomain, [learn how to read your tenant details](../external-id/customers/how-to-create-external-tenant-portal.md#get-the-external-tenant-details).|
| `client_id`         |   Yes    | The Application (client) ID of the app you registered in the Microsoft Entra admin center.|
| `challenge_type`    |   No  | A space-separated list of authorization [challenge type](#sign-in-challenge-types) strings that the app supports such as `oob password redirect`. The list must always include the `redirect` challenge type. The value is expected to `oob redirect` for email one-time passcode and `oob password redirect` for email with password authentication method.|
|`continuation_token`| Yes |[Continuation token](#continuation-token) that Microsoft Entra returned in the previous request.|
 
#### Success response
 
##### User attributes required
 
This response requests the app to submit values for *name*, *age, and *phone* attributes.
 
```http
HTTP/1.1 400 Bad Request
Content-Type: application/x-www-form-urlencoded
&client_id=00001111-aaaa-2222-bbbb-3333cccc4444 
&grant_type=attributes 
&attributes={"displayName": "{given_name}", "extension_2588abcdwhtfeehjjeeqwertc_age": "{user_age}", "postaCode": "{postal_code}"}
&continuation_token=AQABAAEAAAAtn...
```

|-----------------------|-------------------------|------------------------|
| `tenant_subdomain`  |   Yes |  The subdomain of the external tenant that you created. In the URL, replace `{tenant_subdomain}` with the Directory (tenant) subdomain. For example, if your tenant's primary domain is *contoso.onmicrosoft.com*, use *contoso*. If you don't have your tenant subdomain, [learn how to read your tenant details](../external-id/customers/how-to-create-external-tenant-portal.md#get-the-external-tenant-details).|
| `client_id`         |   Yes    | The Application (client) ID of the app you registered in the Microsoft Entra admin center.|
| `challenge_type`    |   No  | A space-separated list of authorization [challenge type](#sign-up-challenge-types) strings that the app supports such as `oob password redirect`. The list must always include the `redirect` challenge type. The value is expected to `oob redirect` for email one-time passcode and `oob password redirect` for email with password authentication method.|
|`continuation_token`| Yes |[Continuation token](#continuation-token) that Microsoft Entra returned in the previous request.|
 
#### Success response
 
##### User attributes required
 
This response requests the app to submit values for *name*, *age*, and *phone* attributes.
 
```http
HTTP/1.1 400 Bad Request
Content-Type: application/x-www-form-urlencoded
&client_id=00001111-aaaa-2222-bbbb-3333cccc4444 
&grant_type=attributes 
&attributes={"displayName": "{given_name}", "extension_2588abcdwhtfeehjjeeqwertc_age": "{user_age}", "postalCode": "{postal_code}"}
&continuation_token=AQABAAEAAAAtn...
```

MODIFIED docs/global-secure-access/troubleshoot-connectors.md

Modified by Ken Withee on Mar 13, 2026 4:18 PM
📖 View on learn.microsoft.com

+4 / -4 lines changed

Commit: Editorial pass: GSA remaining 35 articles - compliance audit

Changes:

Before

After

title: Troubleshoot problems installing the Microsoft Entra private network connector
description: Troubleshoot problems installing the Microsoft Entra private network connector.
ms.topic: troubleshooting
ms.date: 02/24/2026
ms.reviewer: ashishj,dhruvinshah
ai-usage: ai-assisted
---
Register-MicrosoftEntraPrivateNetworkConnector
```
 
To learn more about the `Register-MicrosoftEntraPrivateNetworkConnector` command, see [Create an unattended installation script for the Microsoft Entra private network connector](how-to-register-connector-powershell.md).
 
## Verify admin is used to install the connector
 
 
| Step | Action | Description |
|---------|---------|---------|
|1 | Find the connector group assigned to the app | You probably have a connector installed on multiple servers, in which case the connectors should be assigned to a connector group. To learn more about connector groups, see [Understand Microsoft Entra private network connector groups](concept-connector-groups.md).|
|2 | Install the connector and assign a group | If you don't have a connector installed, see [configure connectors](how-to-configure-connectors.md).<br></br> If the connector isn't assigned to a group, see [Assign the connector to a group](concept-connector-groups.md).<br></br>If the application isn't assigned to a connector group, see [Assign the application to a connector group](concept-connector-groups.md#assignment-of-applications-to-your-connector-groups).|
|3 | Run a port test on the connector server | On the connector server, run a port test by using [telnet](/windows-server/administration/windows-commands/telnet) or other port testing tool to check if ports are configured correctly. To learn more, see [configure connectors](how-to-configure-connectors.md).|

title: Troubleshoot problems installing the Microsoft Entra private network connector
description: Troubleshoot problems installing the Microsoft Entra private network connector.
ms.topic: troubleshooting
ms.date: 03/13/2026
ms.reviewer: ashishj,dhruvinshah
ai-usage: ai-assisted
---
Register-MicrosoftEntraPrivateNetworkConnector
```
 
For more information about the `Register-MicrosoftEntraPrivateNetworkConnector` command, see [Create an unattended installation script for the Microsoft Entra private network connector](how-to-register-connector-powershell.md).
 
## Verify admin is used to install the connector
 
 
| Step | Action | Description |
|---------|---------|---------|
|1 | Find the connector group assigned to the app | You probably have a connector installed on multiple servers, in which case the connectors should be assigned to a connector group. For more information about connector groups, see [Understand Microsoft Entra private network connector groups](concept-connector-groups.md).|
|2 | Install the connector and assign a group | If you don't have a connector installed, see [configure connectors](how-to-configure-connectors.md).<br></br> If the connector isn't assigned to a group, see [Assign the connector to a group](concept-connector-groups.md).<br></br>If the application isn't assigned to a connector group, see [Assign the application to a connector group](concept-connector-groups.md#assignment-of-applications-to-your-connector-groups).|
|3 | Run a port test on the connector server | On the connector server, run a port test by using [telnet](/windows-server/administration/windows-commands/telnet) or other port testing tool to check if ports are configured correctly. For more information, see [configure connectors](how-to-configure-connectors.md).|

MODIFIED docs/global-secure-access/how-to-manage-internet-access-profile.md

Modified by Ken Withee on Mar 13, 2026 4:18 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Editorial pass: GSA remaining 35 articles - compliance audit

Changes:

Before

After

title: How to manage the Internet Access profile
description: Learn how to manage the Internet Access traffic forwarding profile for Microsoft Entra Internet Access.
ms.topic: how-to
ms.date: 02/21/2025
ms.subservice: entra-internet-access 
ms.reviewer: katabish
ai-usage: ai-assisted
## User and group assignments
You can scope the Internet Access profile to specific users and groups.
 
To learn more about user and group assignment, see [How to assign and manage users and groups with traffic forwarding profiles](how-to-manage-users-groups-assignment.md).
 
## Enable the Internet Access traffic forwarding profile
 
1. Set policies on the traffic profile. For example, set a custom bypass rule to exclude specific traffic.
1. Enable the **Internet access profile**. Internet traffic starts forwarding from all client devices to Microsoft's Security Service Edge (SSE) proxy, where you configure granular security policies.
    > [!NOTE]
    > When you enable the Internet Access forwarding profile, you should also enable the Microsoft traffic forwarding profile for optimal routing of Microsoft traffic. You enable the **Microsoft traffic profile** by selecting the profile checkbox on the same page where you enable the Internet Access traffic forwarding profile. To learn more about the Microsoft traffic forwarding profile, see [How to enable and manage the Microsoft profile](how-to-manage-microsoft-profile.md).
 
## Validate the Internet Access traffic forwarding profile

title: How to manage the Internet Access profile
description: Learn how to manage the Internet Access traffic forwarding profile for Microsoft Entra Internet Access.
ms.topic: how-to
ms.date: 03/13/2026
ms.subservice: entra-internet-access 
ms.reviewer: katabish
ai-usage: ai-assisted
## User and group assignments
You can scope the Internet Access profile to specific users and groups.
 
For more information about user and group assignment, see [How to assign and manage users and groups with traffic forwarding profiles](how-to-manage-users-groups-assignment.md).
 
## Enable the Internet Access traffic forwarding profile
 
1. Set policies on the traffic profile. For example, set a custom bypass rule to exclude specific traffic.
1. Enable the **Internet access profile**. Internet traffic starts forwarding from all client devices to Microsoft's Security Service Edge (SSE) proxy, where you configure granular security policies.
    > [!NOTE]
    > When you enable the Internet Access forwarding profile, you should also enable the Microsoft traffic forwarding profile for optimal routing of Microsoft traffic. You enable the **Microsoft traffic profile** by selecting the profile checkbox on the same page where you enable the Internet Access traffic forwarding profile. For more information about the Microsoft traffic forwarding profile, see [How to enable and manage the Microsoft profile](how-to-manage-microsoft-profile.md).
 
## Validate the Internet Access traffic forwarding profile

MODIFIED docs/global-secure-access/how-to-manage-private-access-profile.md

Modified by Ken Withee on Mar 13, 2026 4:18 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Editorial pass: GSA remaining 35 articles - compliance audit

Changes:

Before

After

title: How to Manage the Private Access Profile
description: Learn how to manage the Private Access traffic forwarding profile for Microsoft Entra Private Access.
ms.topic: how-to
ms.date: 02/21/2025
ms.subservice: entra-private-access
ms.reviewer: katabish
ai-usage: ai-assisted
 
## Private Access policies
 
To enable the Private Access traffic forwarding profile, we recommend you first configure Quick Access. Quick Access includes the IP addresses, IP ranges, and fully qualified domain names (FQDNs) for the private resources you want to include in the policy. For more information, see [Configure Quick Access](how-to-configure-quick-access.md).
 
You can also configure per-app access to your private resources by creating a Private Access app. Similar to Quick Access, you create a new Enterprise app, which can then be assigned to the Private Access traffic forwarding profile. Quick Access contains the main group of private resources you always want to route through the service. Private Access apps can be enabled and disabled as needed without impacting the FQDNs and IP addresses included in Quick Access.
 
## User and group assignments
You can scope the Private Access profile to specific users and groups. The users and groups must be assigned to both the Private Access apps and the traffic forwarding profile.
 
To learn more about user and group assignment, see [How to assign and manage users and groups with traffic forwarding profiles](how-to-manage-users-groups-assignment.md).
 
 

title: How to Manage the Private Access Profile
description: Learn how to manage the Private Access traffic forwarding profile for Microsoft Entra Private Access.
ms.topic: how-to
ms.date: 03/13/2026
ms.subservice: entra-private-access
ms.reviewer: katabish
ai-usage: ai-assisted
 
## Private Access policies
 
To enable the Private Access traffic forwarding profile, it's recommended to first configure Quick Access. Quick Access includes the IP addresses, IP ranges, and fully qualified domain names (FQDNs) for the private resources you want to include in the policy. For more information, see [Configure Quick Access](how-to-configure-quick-access.md).
 
You can also configure per-app access to your private resources by creating a Private Access app. Similar to Quick Access, you create a new Enterprise app, which can then be assigned to the Private Access traffic forwarding profile. Quick Access contains the main group of private resources you always want to route through the service. Private Access apps can be enabled and disabled as needed without impacting the FQDNs and IP addresses included in Quick Access.
 
## User and group assignments
You can scope the Private Access profile to specific users and groups. The users and groups must be assigned to both the Private Access apps and the traffic forwarding profile.
 
For more information about user and group assignment, see [How to assign and manage users and groups with traffic forwarding profiles](how-to-manage-users-groups-assignment.md).
 
 

MODIFIED docs/global-secure-access/reference-version-history.md

Modified by Ken Withee on Mar 13, 2026 4:18 PM
📖 View on learn.microsoft.com

+3 / -3 lines changed

Commit: Editorial pass: GSA remaining 35 articles - compliance audit

Changes:

Before

After

title: Microsoft Entra private network connector version release notes
description: This article lists all releases of Microsoft Entra private network connector and describes new features and fixed issues.
ms.topic: reference
ms.date: 02/21/2025
ms.reviewer: ashishj
ai-usage: ai-assisted
---
 
- Increased the number of HTTP headers supported on HTTP requests from 41 to 60.
- Improved error handling of TLS failures between the connector and Azure services.
- Updated the default connection limit to 200 for connector traffic when going through outbound proxy. To learn more about outbound proxy, see [Work with existing on-premises proxy servers](../identity/app-proxy/application-proxy-configure-connectors-with-proxy-servers.md#use-the-outbound-proxy-server).
- Deprecated the use of Active Directory Authentication Library (ADAL) and implemented Microsoft Authentication Library (MSAL) as part of the connector installation flow.
 
### Fixed issues
 
### New features and improvements
 
- Added WebSocket support for the QlikSense application. To learn more about how to integrate QlikSense with application proxy, see this [walkthrough](../identity/app-proxy/application-proxy-qlik.md). 
- Improved the installation wizard to make it easier to configure an outbound proxy. 
- Set TLS 1.2 as the default protocol for connectors. 

title: Microsoft Entra private network connector version release notes
description: This article lists all releases of Microsoft Entra private network connector and describes new features and fixed issues.
ms.topic: reference
ms.date: 03/13/2026
ms.reviewer: ashishj
ai-usage: ai-assisted
---
 
- Increased the number of HTTP headers supported on HTTP requests from 41 to 60.
- Improved error handling of TLS failures between the connector and Azure services.
- Updated the default connection limit to 200 for connector traffic when going through outbound proxy. For more information about outbound proxy, see [Work with existing on-premises proxy servers](../identity/app-proxy/application-proxy-configure-connectors-with-proxy-servers.md#use-the-outbound-proxy-server).
- Deprecated the use of Active Directory Authentication Library (ADAL) and implemented Microsoft Authentication Library (MSAL) as part of the connector installation flow.
 
### Fixed issues
 
### New features and improvements
 
- Added WebSocket support for the QlikSense application. For more information about how to integrate QlikSense with application proxy, see this [walkthrough](../identity/app-proxy/application-proxy-qlik.md). 
- Improved the installation wizard to make it easier to configure an outbound proxy. 
- Set TLS 1.2 as the default protocol for connectors. 

MODIFIED docs/identity/authentication/concept-system-preferred-multifactor-authentication.md

Modified by vimrang on Mar 13, 2026 6:22 PM
📖 View on learn.microsoft.com

+4 / -1 lines changed

Commit: Update MFA process details and CBA status

Changes:

Before

After

 
### How does system-preferred MFA determine the most secure method?
 
When a user signs in, the authentication process checks which authentication methods are registered for the user. The user is prompted to sign-in with the most secure method according to the following order. The order of authentication methods is dynamic. It's updated as the security landscape changes, and as better authentication methods emerge. Due to known issues with certificate-based authentication (CBA) and system-preferred MFA, we moved CBA to the bottom of the list. Click the link for more information about each method.
 
1. [Temporary Access Pass](howto-authentication-temporary-access-pass.md)
1. [Passkey (FIDO2)](concept-authentication-passwordless.md#passkeys-fido2)

 
### How does system-preferred MFA determine the most secure method?
 
When a user signs in, the authentication process checks which authentication methods are registered for the user. The user is prompted to sign-in with the most secure method according to the following order. The order of authentication methods is dynamic. It's updated as the security landscape changes, and as better authentication methods emerge. Users can always cancel and choose a different available sign in method if needed. If your organization has Conditional Access policies that require specific authentication methods, those policies will continue to take priority over the system preferred MFA order. Click the link for more information about each method.
 
>[!IMPORTANT]
>Certificate Based Authentication (CBA) was previously placed last in the system preferred MFA order due to known issues with CBA and system preferred MFA. Now that those issues are resolved, starting March 18th, 2026, Certificate-based authentication(CBA) will move to the third position in the authentication order. Once the rollout is complete, we will update the ordering of methods in the documentation.
 
1. [Temporary Access Pass](howto-authentication-temporary-access-pass.md)
1. [Passkey (FIDO2)](concept-authentication-passwordless.md#passkeys-fido2)

MODIFIED docs/global-secure-access/how-to-manage-microsoft-profile.md

Modified by Ken Withee on Mar 13, 2026 4:18 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Editorial pass: GSA remaining 35 articles - compliance audit

Changes:

Before

After

title: How to Enable and Manage the Microsoft Profile
description: Learn how to enable and manage the Microsoft traffic forwarding profile for Global Secure Access.
ms.topic: how-to
ms.date: 02/21/2025
ms.subservice: entra-internet-access
ai-usage: ai-assisted
---
1. Select a remote network from the list and select **Add**.
 
## User and group assignments
You can scope the Microsoft profile to specific users and groups instead of applying the traffic profile to all users. To learn more about user and group assignment, see [How to assign and manage users and groups with traffic forwarding profiles](how-to-manage-users-groups-assignment.md).
 
 
## Next steps

title: How to Enable and Manage the Microsoft Profile
description: Learn how to enable and manage the Microsoft traffic forwarding profile for Global Secure Access.
ms.topic: how-to
ms.date: 03/13/2026
ms.subservice: entra-internet-access
ai-usage: ai-assisted
---
1. Select a remote network from the list and select **Add**.
 
## User and group assignments
You can scope the Microsoft profile to specific users and groups instead of applying the traffic profile to all users. For more information about user and group assignment, see [How to assign and manage users and groups with traffic forwarding profiles](how-to-manage-users-groups-assignment.md).
 
 
## Next steps

MODIFIED docs/global-secure-access/how-to-manage-users-groups-assignment.md

Modified by Ken Withee on Mar 13, 2026 4:18 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Editorial pass: GSA remaining 35 articles - compliance audit

Changes:

Before

After

title: Assign users and groups to traffic forwarding profiles
description: Learn how to roll out traffic forwarding profiles to users and groups with Global Secure Access
ms.topic: how-to
ms.date: 02/21/2025
ai-usage: ai-assisted
---
# How to assign users and groups to traffic forwarding profiles
 
### Automatic assignment through user attributes
 
You can create and assign a dynamic group of users to the profile who satisfy specific criteria. To learn more about automatic assignment using user attributes, see [Create or update a dynamic group in Microsoft Entra ID](../identity/users/groups-create-rule.md).
 
## Assign the traffic profile to all users
 

title: Assign users and groups to traffic forwarding profiles
description: Learn how to roll out traffic forwarding profiles to users and groups with Global Secure Access
ms.topic: how-to
ms.date: 03/13/2026
ai-usage: ai-assisted
---
# How to assign users and groups to traffic forwarding profiles
 
### Automatic assignment through user attributes
 
You can create and assign a dynamic group of users to the profile who satisfy specific criteria. For more information about automatic assignment using user attributes, see [Create or update a dynamic group in Microsoft Entra ID](../identity/users/groups-create-rule.md).
 
## Assign the traffic profile to all users
 

MODIFIED docs/global-secure-access/overview-what-is-global-secure-access.md

Modified by Ken Withee on Mar 13, 2026 4:18 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Editorial pass: GSA remaining 35 articles - compliance audit

Changes:

Before

After

title: What is Global Secure Access?
description: Learn how Microsoft's Security Service Edge (SSE) solution, Global Secure Access, provides network access control and visibility to users and devices inside and outside a traditional office.
ms.topic: overview
ms.date: 12/12/2025
ms.custom: references_regions
ai-usage: ai-assisted
 
 
**Remote Network licensing**
 
The remote network (branch connectivity) feature is included in both the Microsoft Entra ID P1 license for Microsoft traffic, and the Microsoft Entra Internet Access license for Internet Traffic (coming soon). You must have a combined total of at least 50 licenses from Microsoft Entra ID P1 and Microsoft Entra Internet Access to enable  remote network connectivity. For details on how much bandwidth is allocated, see [Understand remote network connectivity](concept-remote-network-connectivity.md#how-much-bandwidth-will-be-allocated-per-tenant). To learn more about remote networks, see [How to create a remote network with Global Secure Access](how-to-create-remote-networks.md).
 
 
## Related content

title: What is Global Secure Access?
description: Learn how Microsoft's Security Service Edge (SSE) solution, Global Secure Access, provides network access control and visibility to users and devices inside and outside a traditional office.
ms.topic: overview
ms.date: 03/13/2026
ms.custom: references_regions
ai-usage: ai-assisted
 
 
**Remote Network licensing**
 
The remote network (branch connectivity) feature is included in both the Microsoft Entra ID P1 license for Microsoft traffic, and the Microsoft Entra Internet Access license for Internet Traffic (coming soon). You must have a combined total of at least 50 licenses from Microsoft Entra ID P1 and Microsoft Entra Internet Access to enable  remote network connectivity. For details on how much bandwidth is allocated, see [Understand remote network connectivity](concept-remote-network-connectivity.md#how-much-bandwidth-will-be-allocated-per-tenant). For more information about remote networks, see [How to create a remote network with Global Secure Access](how-to-create-remote-networks.md).
 
 
## Related content

MODIFIED docs/global-secure-access/partner-ecosystems-overview.md

Modified by Ken Withee on Mar 13, 2026 4:18 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Editorial pass: GSA remaining 35 articles - compliance audit

Changes:

Before

After

title: Partner Ecosystem Overview
description: Learn about the Microsoft Secure Access Service Edge (SASE) partner ecosystem. Learn about partner integrations and partner coexistence.
ms.topic: overview
ms.date: 10/31/2025
ms.reviewer: abhijeetsinha
ai-usage: ai-assisted
#customer intent: As an administrator, I want to understand the Microsoft SASE partner ecosystem so that I can choose the best approach for my organization's security needs.
 
## Partner service offerings
 
Microsoft works with many service partners. To learn more, see [Find a Microsoft services partner](how-to-find-microsoft-services-partners.md).

title: Partner Ecosystem Overview
description: Learn about the Microsoft Secure Access Service Edge (SASE) partner ecosystem. Learn about partner integrations and partner coexistence.
ms.topic: overview
ms.date: 03/13/2026
ms.reviewer: abhijeetsinha
ai-usage: ai-assisted
#customer intent: As an administrator, I want to understand the Microsoft SASE partner ecosystem so that I can choose the best approach for my organization's security needs.
 
## Partner service offerings
 
Microsoft works with many service partners. For more information, see [Find a Microsoft services partner](how-to-find-microsoft-services-partners.md).

MODIFIED docs/global-secure-access/quickstart-access-admin-center.md

Modified by Ken Withee on Mar 13, 2026 4:18 PM
📖 View on learn.microsoft.com

+2 / -2 lines changed

Commit: Editorial pass: GSA remaining 35 articles - compliance audit

Changes:

Before

After

title: "Quickstart: Access the Global Secure Access area of the Microsoft Entra admin center"
description: Learn how to access the Global Secure Access area of the Microsoft Entra admin center.
ms.topic: quickstart
ms.date: 02/21/2025
ai-usage: ai-assisted
 
#customer intent: As a decision maker, I want learn how to access the Global Secure Access area of the Microsoft Entra admin center so that I can understand how to configure and use the product.
 
This quickstart shows you where to find the Global Secure Access area of the Microsoft Entra admin center. 
 
Global Secure Access is the unifying term used for both Microsoft Entra Internet Access and Microsoft Entra Private Access. Global Secure Access is the unified location in the Microsoft Entra admin center. Microsoft Entra Internet Access and Microsoft Entra Private Access comprise Microsoft's Security Service Edge (SSE) solution. To learn more about Global Secure Access, see [What is Global Secure Access?](overview-what-is-global-secure-access.md)
 
## Prerequisites
 

title: "Quickstart: Access the Global Secure Access area of the Microsoft Entra admin center"
description: Learn how to access the Global Secure Access area of the Microsoft Entra admin center.
ms.topic: quickstart
ms.date: 03/13/2026
ai-usage: ai-assisted
 
#customer intent: As a decision maker, I want learn how to access the Global Secure Access area of the Microsoft Entra admin center so that I can understand how to configure and use the product.
 
This quickstart shows you where to find the Global Secure Access area of the Microsoft Entra admin center. 
 
Global Secure Access is the unifying term used for both Microsoft Entra Internet Access and Microsoft Entra Private Access. Global Secure Access is the unified location in the Microsoft Entra admin center. Microsoft Entra Internet Access and Microsoft Entra Private Access comprise Microsoft's Security Service Edge (SSE) solution. For more information about Global Secure Access, see [What is Global Secure Access?](overview-what-is-global-secure-access.md)
 
## Prerequisites
 

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files