📋 Microsoft Entra Documentation Changes

ms.topic: article

ms.date: 03/18/2026

ms.author: sarahlipsey

author: shlipsey3

manager: pmwongera

Every day, Microsoft processes more than 100 trillion security signals from endpoints, cloud services, identity systems, and more. We use this data shape how we respond to threats and inform how we innovate to help build a safer digital future. Read about the work we're doing in the [Microsoft Digital Defense Report](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf#page=1).

As part of this work, Microsoft-managed policies are available in Microsoft Entra tenants around the world. These [simplified Conditional Access policies](#what-is-conditional-access) require multifactor authentication, which continues to reduce the risk of compromise by more than 99%.

:::image type="content" source="media/managed-policies/microsoft-managed-policy.png" alt-text="Screenshot of a Microsoft-managed Conditional Access policy in the Microsoft Entra admin center." lightbox="media/managed-policies/microsoft-managed-policy-expanded.png":::

## Prerequisites

description: "Learn how to deploy Microsoft Global Secure Access alongside Zscaler Private Access and Internet Access. Covers four integration scenarios with step-by-step configuration, verification, and traffic testing procedures."

ms.date: 03/18/2026

### Prerequisites for Microsoft Global Secure Access

To set up Microsoft Entra Global Secure Access and test all four scenarios described in this article:

ms.date: 03/18/2026

1. Select **+ New configuration**.

* Non-specific tenant URL : `{OTDS URL}/scim/{partitionName}`

* Specific tenant URL : `{OTDS URL}/otdstenant/{tenantID}/scim/{partitionName}`

7. Select **OAuth2 Client Credentials Grant** as the Authentication Method.

1. Enter the **Client ID** and **Client Secret** retrieved from Step 2.

ms.date: 03/18/2026

- **Layer 1: Context-aware network security** This outermost layer routes internet traffic through the SWG and applies identity- and context-aware policy enforcement. Without this layer, traffic bypasses all downstream inspection.

- **Layer 2: TLS inspection, web content, and threat intelligence filtering** TLS inspection decrypts encrypted traffic so that all downstream web content filtering and DLP inspection operates on plaintext payloads. Web content filtering blocks access to malicious, inappropriate, or policy-violating destinations. Threat intelligence filtering blocks connections to known-malicious infrastructure.

- **Layer 3: AI Gateway, content filtering, and network DLP** AI Gateway controls govern user interactions with generative AI services to prevent prompt injection and data leakage. Content filtering and network DLP inspect file transfers and payloads to prevent sensitive data exfiltration.

- **Layer 5: Advanced threat protection** This innermost layer is reserved for future capabilities including anti-malware scanning, intrusion detection and prevention (IDPS), and anomaly detection. No active checks are configured in this layer yet.

description: "Configure Microsoft Global Secure Access and Cisco Secure Access for unified SASE capabilities. Covers deployment steps, FQDN and IP bypasses, and client configuration."

ms.date: 03/18/2026

## Supported coexistence scenarios

#### Configure Global Secure Access

ms.date: 03/18/2026

1. Select your **Virtual network**.

Creating a local network gateway is completed in the Azure portal. Several details from the remote network configuration (Microsoft gateway endpoint, ASN, and BGP address) are needed to complete this step.

If you selected **No redundancy** when creating device links in the Microsoft Entra admin center, create one local network gateway.

description: "Configure Microsoft Global Secure Access alongside Cisco AnyConnect and ASA VPNs for unified SASE. Covers deployment scenarios with step-by-step configuration for private access, Microsoft 365 traffic, and internet access."

ms.date: 03/18/2026

1. Add an Internet Access traffic forwarding profile custom bypass to exclude Cisco Secure Access VPNaaS service. Add a custom bypass rule for `*.vpn.sse.cisco.com` in the Internet Access profile. For detailed steps, see [Adding a custom bypass](#adding-a-custom-bypass).

1. Add an Internet Access traffic forwarding profile custom bypass to exclude the Cisco Secure Access VPNaaS endpoint. Add a custom bypass rule for `*.vpn.sse.cisco.com` in the Internet Access profile. For detailed steps, see [Adding a custom bypass](#adding-a-custom-bypass).

ms.date: 03/18/2026

ms.reviewer: yukarppa

# Share accounts with Microsoft Entra ID

description: "Modify remote network configurations, delete unused networks, and manage device links and traffic profile assignments for Global Secure Access."

ms.date: 03/18/2026

#### Update basic settings

#### Update device links

description: "View performance, experience, and availability insights for Microsoft 365 apps routed through Microsoft Entra Internet Access. Integrate enriched log data with Log Analytics or Microsoft Sentinel for network diagnostics and security analysis."

ms.date: 03/18/2026

### Required roles and permissions

### Required configurations

* If not, [enroll the device in Intune](/intune/intune-service/fundamentals/deployment-guide-enrollment).

* If not, open the **Company Portal** app on the client device and follow the steps to [remediate the issue](/intune/intune-service/user-help/check-device-access-windows-cpapp).

> We strongly recommend creating a custom application. Bynder now supports SCIM provisioning, which is available only for custom applications. Using the Bynder application from the gallery will limit the availability of this functionality for your integration.

> [!NOTE]

1. Select **+ New configuration**.

1. Select **Properties** on the **Overview** page.

1. Select the **Edit** icon to edit the properties. Enable notification emails and provide an email to receive quarantine emails. Enable accidental deletions prevention. Select **Apply** to save the changes.

1. Select **+ New configuration**.

1. Select **Properties** on the **Overview** page.

1. Select the **Edit** icon to edit the properties. Enable notification emails and provide an email to receive quarantine emails. Enable accidental deletions prevention. Select **Apply** to save the changes.

1. Select **+ New configuration**.

1. Select **Properties** on the **Overview** page.

1. Select the **Edit** icon to edit the properties. Enable notification emails and provide an email to receive quarantine emails. Enable accidental deletions prevention. Select **Apply** to save the changes.