Configure Custom Headers
Monitoring
The configuration guide no longer includes the note that a special Entra Admin Center link might be needed during the September 2026 rollout to view custom header details in Global Secure Access traffic logs.
Product
Microsoft Entra Global Secure Access
Track documentation and Message Center changes for Microsoft Entra Global Secure Access.
Microsoft Learn documentation ↗Latest Microsoft Entra Global Secure Access changes
How to configure custom headers
General
The article title and preview notice for configuring custom headers were removed.
Web Filtering
Fundamentals
The documentation now consistently labels the Continue default action as “in preview” and describes how unmatched traffic passes to the next applicable security profile.
Configure Explicit Forward Proxy
General
The configuration instructions now direct administrators to Global Secure Access > Connect > Explicit Forward Proxy instead of Session management.
Configure Explicit Forward Proxy Headers
General
The documented path changed from Global Secure Access > Session management > Explicit Forward Proxy to Global Secure Access > Connect > Explicit Forward Proxy.
Custom Proxy File Hosting
Monitoring
The instructions now direct administrators to Global Secure Access > Connect > Explicit Forward Proxy, replacing the previous Session Management path and tab selection.
Netskope Coexistence
Developer
The fifth Netskope coexistence scenario is now correctly numbered as item 5.
Global Secure Access Client Release Notes
General
The release notes now document Web sign-in support, Conditional Access sign-in frequency for Private Access applications, updated firewall behavior, clearer forwarding-profile names, private-network bypass changes, and other improvements.
Connector Groups
Authentication
The documentation adds Performance mode, which routes user traffic to the connector with the lowest measured network latency. It also clarifies that connector load balancing applies only to Microsoft Entra Private Access applications, not application proxy applications.
2) Detect browsers via registry only
Fundamentals
The PowerShell prompt now correctly refers to the `IPv4Preferred` registry key instead of `IPv4Preffered`.
AI agent discovery in Global Secure Access (preview)
Fundamentals
The page no longer includes the `author` and `ms.author` metadata fields.
Generative AI Insights in Global Secure Access (preview)
Fundamentals
The documentation no longer includes the `author` and `ms.author` fields.
Global Secure Access egress IP ranges
General
The page no longer includes the `author` and `ms.author` metadata fields.
Learn about Secure Web and AI Gateway for Microsoft Copilot Studio agents
Fundamentals
The article metadata field was corrected from `ms.reviwer` to `ms.reviewer`; the topic classification remains unchanged.
Secure Web Ai Gateway Agents
Security
The documentation corrects “Web respositories” to “Web repositories” in an example of security rules.
View Generative AI Insights logs in Global Secure Access (preview)
Monitoring
The page’s `author` and `ms.author` metadata fields were removed.
Known limitations for Global Secure Access
General
The known limitations article now states that the client doesn't support Secure DNS variants such as DoH, DoT, or DNSSEC, and that the macOS client bypasses Secure DNS to enforce FQDN-based tunneling.
Configure Connectors
Monitoring
The connector configuration guidance now refers to configuring dynamic and AutoReuse TCP port ranges instead of extending TCP and UDP ephemeral ports.
Connectors
Fundamentals
The documentation specifies non-overlapping dynamic TCP ports 49152–65535 and AutoReuse TCP ports 10000–49151, with new configuration and verification commands. It also adds Windows Server 2016+ prerequisites and clarifies that AutoReuse applies only to TCP.
Create content policies for network content filtering
Developer
The documentation now clarifies Basic content filtering and Scan with Purview descriptions, including that scanning can audit or block selected file and text content based on conditions.
Create content policies for network content filtering
Developer
The documentation now describes real-time controls for content shared with generative AI applications, unmanaged cloud apps, and other internet destinations. It adds details about Basic content filtering and Purview-based inspection of files and text.
Network Content Filtering
Security
The documentation replaces the Source type condition with Session type, adds a known internet access limitations reference, and revises guidance for WebSocket filtering, API rate limiting, and Purview inspection failures.
Network Content Filtering
Security
The documentation now describes Basic content filtering for supported file and text types using Allow or Block without Purview. It adds a warning that blocking HTML or JSON can disrupt normal web and API traffic, and updates the stated coverage from HTTP/1.1 to HTTP/S.
Assign users and devices to traffic forwarding profiles
General
The article now documents assigning users, groups, devices, and device platforms to traffic forwarding profiles, including custom Private Access profiles. It also explains that user/device and platform conditions are evaluated together and that the highest-priority applicable profile is used.
How to configure custom HTTP headers in Global Secure Access
General
The documentation now states that custom headers are available only with Web Filtering (v2) policies and links to the related guidance.
Learn about Universal Continuous Evaluation
Fundamentals
The documentation now covers preview device signals for deleted, disabled, or noncompliant devices. It also specifies reauthentication through a GSA client notification and tunnel disconnection after two minutes if reauthentication is incomplete.
How to investigate the Global Secure Access remote network connectivity
Troubleshooting
The article now distinguishes tunnel and BGP connectivity scenarios and adds investigation steps, licensing requirements, least-privilege roles, and Microsoft Graph permissions for viewing and managing signals and alerts.
Generative Ai Insights
Fundamentals
The documentation now refers to “Microsoft Copilot” instead of “Microsoft 365 Copilot.”
How to configure custom headers (preview)
General
The page now explains how to find modified-header transactions in Global Secure Access traffic logs and add the Custom Headers column. During the September 2026 rollout, a special Entra Admin Center link may be needed to view these details.
Configure Custom Headers
General
Consistent spacing was added to domain lists for Claude, GitHub, Slack, Dropbox, and YouTube entries. Header names and descriptions are unchanged.
Configure TLS inspection with a Microsoft-managed certificate
Security
The guide explains how to create a tenant-specific Microsoft-managed root CA, deploy its public certificate to client devices, and enable it for Microsoft Entra Internet Access TLS inspection. The capability is in preview, and the private key remains protected by Microsoft.
Configure TLS inspection with your own certificate
Security
The article now focuses on bringing your own certificate authority for TLS inspection, including CSR creation, PKI signing, and certificate upload. It also links to separate Microsoft-managed certificate guidance.
How to configure custom headers (preview)
General
The page title now marks custom headers as preview and notes that rollout is expected to complete by September 10, 2026.
Protect enterprise generative AI apps with prompt injection protection
Security
The AI prompt injection protection documentation now explains that TLS inspection can use either a Microsoft-managed certificate or an administrator-provided certificate before configuring TLS inspection policies.
Transport Layer Security
Security
The TLS inspection documentation now explains how to configure either a Microsoft-managed certificate or your own certificate authority.
Troubleshoot App Access
Troubleshooting
The app-access troubleshooting guide now recommends enabling session persistence after confirming the application works through a single connector, keeping the same user and device routed through that connector during the session.
Troubleshoot Transport Layer Security
Troubleshooting
The troubleshooting page now links to separate guides for Microsoft-managed certificates and customer-provided certificates, and its publication date was updated.
What is Transport Layer Security Inspection?
Fundamentals
The documentation now provides separate links for configuring TLS inspection with a Microsoft-managed certificate and with your own certificate.
How to configure custom HTTP headers in Global Secure Access
General
New documentation describes adding custom HTTP headers to matching outbound web requests through Web Content Filtering v2 rules. The capability is currently in preview and supports tenant restrictions and other header-aware services.
Version History
General
The version-history section is now titled “Unsupported versions,” and guidance for version 1.5.612.0 or earlier recommends immediately updating to a newer version.
Version History
General
The version history marks versions 1.5.612.0, 1.5.402.0, 1.5.132.0, and 1.5.36.0 as deprecated and instructs users of 1.5.612.0 or earlier to update immediately.
Current Known Limitations
General
The documentation now uses the full names for GCC and GCC-H and clarifies that Global Secure Access is available in GCC but not yet supported in GCC-H, Department of Defense, or other government or sovereign cloud environments.
Current Known Limitations
General
The documentation received a minor formatting change with no substantive content changes identified.
Current Known Limitations
General
The documentation now explicitly states that Global Secure Access is available in GCC, but not supported in GCC-H, Department of Defense, or other government and sovereign cloud environments.
Global Secure Access Client Release Notes
General
Starting in November 2026, eligible Windows clients automatically receive Global Secure Access upgrades through Windows Update. Version 2.32.294 also adds Prefer local network, faster tunnel creation, and other fixes and improvements.
Netskope Integration
Fundamentals
The Netskope integration example now uses different values for the tenantId and userId fields.
Global Secure Access Client for macOS Release Notes
General
The August 21, 2026 release adds Home Network traffic controls, a Connections page, agentic detection support, and Secure DNS bypass. It also includes connectivity, sign-in, tunnel, cache-reset, and crash fixes.
Install the Global Secure Access Client for macOS
General
The documentation now states that version 1.1.26060207 includes com.microsoft.autoupdate2 and that an existing installation may conflict with Intune detection rules. It also advises optionally removing that app from the Included apps list.
Macos Client Release History
General
The release history now lists the macOS client as available for download on August 24, 2026, instead of August 21, 2026.
Global Secure Access Client for macOS Release Notes
General
The release-history page no longer includes version 1.1.26060207 or its listed changes, and its document date changed from August 21, 2026, to April 16, 2026.
Global Secure Access Client for macOS Release Notes
General
The release notes now document version 1.1.26060207, released August 21, 2026, with Home Network traffic control, a Connections page, agentic detection support, Secure DNS bypass, and several fixes.
Install Macos Client
General
The documentation now warns that, starting with version 1.1.26060207, including the already-installed com.microsoft.autoupdate2 application in Intune detection rules might cause a conflict.
Install Macos Client
General
The macOS client installation guidance now clarifies that, starting with version 1.1.26060207, administrators can optionally remove `com.microsoft.autoupdate2` from Intune detection rules.
Install Macos Client
General
The macOS client installation guidance now states that removing `com.microsoft.autoupdate2` from Intune detection rules is optional.
Install the Global Secure Access Client for macOS
General
The page no longer includes the note about `com.microsoft.autoupdate2` or the optional instruction to remove it from Intune detection rules. The metadata date and custom tag were also reverted.
Install the Global Secure Access Client for macOS
General
Starting with version 1.1.26060207, the app package includes com.microsoft.autoupdate2 for future use cases.
Macos Client Release History
General
The macOS client release history now says administrators can optionally remove `com.microsoft.autoupdate2` from Intune detection rules; the app package includes this application.
Migrate Web Content Filtering Policies
Security
The guide now presents the V1-to-V2 migration procedure and migration options as numbered steps.
Migrate web content filtering policies from V1 to V2
General
A new how-to article explains the guided Global Secure Access migration experience. It covers eligible and ineligible security profiles, migration steps, policy and rule naming, and how V1 policies become rules in a single enabled V2 policy while preserving destinations, actions, and priorities.
Web Filtering
Fundamentals
The web filtering documentation now links to an article explaining how to migrate web content filtering policies from V1 to V2.
Manage Microsoft Profile
General
The instructions now refer to the “Remote network assignments” section instead of “Remove network assignments.”
Manage Microsoft Profile
General
The step now refers to the **Remote network assignments** section instead of **Remove network assignments** when selecting the profile’s **View** link.
Configure Global Secure Access MCP firewall to secure Model Context Protocol traffic
Monitoring
Microsoft added a how-to article for configuring the Global Secure Access MCP firewall to inspect, audit, and allow or block Model Context Protocol traffic. It covers server, primitive, method, and protocol-version controls for supported MCP traffic.
Network Content Filtering
General
The documentation now states that **Agent** matches traffic classified as AI agent traffic, while traffic not classified as agent traffic is treated as **User** traffic. If the condition is omitted, the rule applies to all traffic. The condition remains in preview.
Global Secure Access and Universal Tenant Restrictions
General
Learn about how Global Secure Access helps secure access to your corporate network by restricting access to external tenants.
Configure Per App Access
Microsoft identity platform
Replace `{appRegistrationObjectId}` with the application registration's object ID. You can find this value in the Microsoft Entra admin center under **Identity** > **Applications** > **App registrations** by selecting the app registration for your Global Secure Access application and copying the **Object ID** from the **Overview** page. To return to the default behavior, set `trafficRoutingMethod` to `random`. For more information, see [Update application](/graph/api/application-update?view=graph-rest-beta&preserve-view=true).
Global Secure Access egress IP ranges
General
Reference list of the egress IP ranges that Global Secure Access uses for outbound internet traffic, so you can allowlist them on target services.
Configure Web Content Filtering
General
Web content filtering also supports two optional rule conditions that enable traffic-aware policy enforcement:
Universal Tenant Restrictions
Authentication
- They work with all Microsoft Entra-integrated third-party apps at the authentication plane during sign-in.
Configure HTTP header session management (preview)
Authentication
You can configure Explicit Forward Proxy (preview) to rely on the private IP addresses of devices on your network to associate authenticated users with their devices. To use HTTP header session management with Explicit Forward Proxy, you need to securely communicate the private IP address of the device to the Explicit Forward Proxy feature.
Configure Microsoft Edge with Explicit Forward Proxy by using an Intune application management policy
Developer
You can automatically deliver proxy settings and certificate authority trust settings in Microsoft Edge by using an Intune mobile application management (MAM) policy. The policy can take advantage of the Explicit Forward Proxy feature of Global Secure Access.
Explicit Forward Proxy overview
Fundamentals
Explicit Forward Proxy is a traffic acquisition mechanism that's useful in scenarios where installation of the Global Secure Access client is difficult or not possible. Explicit Forward Proxy helps protect internet traffic when users use browsers to access resources from:
Explicit Forward Proxy session management
Conditional Access
Explicit Forward Proxy uses Microsoft Entra ID authentication and authorization to validate user access before allowing network traffic. This validation method allows for adaptive policies in Microsoft Entra Conditional Access, modern credentials like passkeys, and Continuous Access Evaluation with session revocation. Classic proxy authorization methods, such as basic, digest, NTLM, or Kerberos, aren't supported.
Proxy Automatic Configuration Files
Fundamentals
For unmanaged devices, you can instruct users to manually enter the PAC file location in browser settings or rely on a network-provided configuration. A network-provided configuration might be Dynamic Host Configuration Protocol (DHCP) or Web Proxy Auto-Discovery (WPAD).
Ai Prompt Injection Protection
Fundamentals
- [Global Secure Access traffic forwarding profiles](concept-traffic-forwarding.md)
Configure Web Content Filtering
General
- **HTTP method request filtering (preview)**: Block or allow specific HTTP methods, such as GET, POST, PUT, PATCH, and DELETE.
Create content policies for network content filtering
Security
Discover how to configure network content filtering with Global Secure Access to enforce data protection policies for files and text content in real time.
Tutorial: Configure universal tenant restrictions
General
Learn how to configure universal tenant restrictions with Global Secure Access for Microsoft traffic.
Tutorial: Enable source IP restoration
Authentication
Learn how to enable source IP restoration for Microsoft traffic in Global Secure Access and validate Microsoft Entra sign-in logs.
Tutorial: Enable the compliant network check
Conditional Access
Learn how to configure a Conditional Access policy that requires a compliant network with Global Secure Access.
Tutorial: Enable the Microsoft traffic profile
General
Learn how to enable the Microsoft traffic profile in Global Secure Access, assign users, install the client, and verify traffic forwarding.
Tutorial: Get started with Microsoft traffic labs
General
Learn about Microsoft traffic labs for Global Secure Access, including source IP restoration, compliant network checks, and universal tenant restrictions.
How to view Model Context Protocol (MCP) traffic logs in Global Secure Access (Preview)
Monitoring
Learn how to monitor and analyze Model Context Protocol (MCP) traffic between AI agents and remote MCP servers using the Global Secure Access Generative AI Insights page.
PowerShell sample - Calculate the alert noise ratio for Microsoft Entra Global Secure Access detections
General
Calculate the Microsoft Sentinel alert noise ratio for Global Secure Access detections and send an alert when false positives or informational closures exceed your threshold.
PowerShell sample - Check Microsoft Entra Global Secure Access role assignment reviews
General
Check Global Secure Access-related administrator role assignments and identify accounts that need quarterly review.
PowerShell sample - List Microsoft Entra Backup and Recovery snapshots for Global Secure Access recovery
Governance
List Microsoft Entra Backup and Recovery snapshots that can help recover directory objects used by Global Secure Access.
PowerShell sample - Preview a Microsoft Entra recovery for Global Secure Access objects
General
Create a non-destructive Microsoft Entra recovery preview job scoped to directory objects that affect Global Secure Access.
PowerShell sample - Run a Microsoft Entra recovery for Global Secure Access objects
General
Run a Microsoft Entra recovery job for directory objects that affect Global Secure Access after reviewing a recovery preview.
PowerShell sample - Shared helper functions for Microsoft Entra Global Secure Access operations
Authentication
Use shared helper functions for authentication and alert email in Global Secure Access operations automation scripts.
PowerShell sample - Verify Microsoft Entra Global Secure Access configuration backup compliance
General
Verify that your Global Secure Access configuration backup runbook ran successfully. Send an alert when the runbook fails or misses a scheduled run.
PowerShell samples for Global Secure Access
Monitoring
Use these PowerShell samples to automate common Global Secure Access tasks, including connector registration, client install, traffic forwarding bypasses, break glass scenarios, TLS certificate creation, operations monitoring, and recovery.
Security Operations
Security
- [Microsoft Entra Security Operations Guide](https://aka.ms/AzureADSecOps)
Gsa Deployment Guide Microsoft Traffic
Architecture
1. Create end user communications to set expectations and provide an escalation path.
Universal Tenant Restrictions
General
- [Enable Global Secure Access signaling for Microsoft Entra ID and Microsoft Graph](how-to-source-ip-restoration.md#enable-global-secure-access-signaling-for-microsoft-entra-id-and-microsoft-graph)
Universal Tenant Restrictions
General
- [Enable Global Secure Access signaling for Microsoft Entra ID and Microsoft Graph](how-to-source-ip-restoration.md#enable-global-secure-access-signaling-for-microsoft-entra-id-and-microsoft-graph)
AI agent discovery in Global Secure Access (preview)
Fundamentals
Learn how AI agent discovery in Global Secure Access provides network-level visibility into managed and shadow AI agents reaching the internet from your environment.
Ai Prompt Injection Protection
Security
Protect your enterprise generative AI apps from prompt injection attacks with Microsoft's AI Gateway prompt injection protection.
Application Discovery
Developer
Use Application discovery to detect the applications accessed by users and create separate private applications.
Application Usage Analytics Overview
Fundamentals
Gain visibility into application traffic to gain insights into app categories, risk scores, transactions, and organizational usage patterns.
Configure a Microsoft Entra Conditional Access policy for Explicit Forward Proxy (preview)
Conditional Access
Learn how to configure a Conditional Access policy for Explicit Forward Proxy.
Configure HTTP header session management
General
Learn how to configure HTTP header session management for Explicit Forward Proxy.
Configure Microsoft Edge with Explicit Forward Proxy (preview) by using an Intune application management policy
Developer
A Microsoft Entra documentation page was updated: Configure Microsoft Edge with Explicit Forward Proxy (preview) by using an Intune application management policy.
Configure Secure Web and AI Gateway for Microsoft Copilot Studio agents
General
Learn how to configure Secure Web and AI Gateway for Microsoft Copilot Studio agents using Global Secure Access.
Configure Transport Layer Security Inspection Policies
Security
Learn how to configure a Transport Layer Security inspection policy and assign it to users in your organization.
Configure Transport Layer Security Inspection Settings
Security
Learn how to configure a Transport Layer Security inspection certificate authority
Create a custom Data Loss Prevention profile with the Global Secure Access and Netskope integration
Security
Learn how to protect your organization with a custom Data Loss Prevention (DLP) profile powered by Netskope.
Create a remote network with a custom IKE policy
General
Learn how to set up the bidirectional communication tunnel between Global Secure Access and your router.
Customer intent: As an IT admin, I want to deploy the Global Secure Access client on macOS devices so that my organization's network traffic is prote…
General
The Global Secure Access client helps secure network traffic at the user device. This article describes how to download and install the macOS client.
Customer intent: As an IT administrator, I want to simulate a virtual wide area network to connect resources in Azure so I can better understand how…
General
Use Global Secure Access to configure Azure and Microsoft Entra resources to create a virtual wide area network to connect to your resources in Azure.
Customer intent: I want to troubleshoot the Global Secure Access client using the Advanced diagnostics utility.
Troubleshooting
Troubleshoot the Global Secure Access client using the health check tab in the advanced diagnostics utility.
Customer intent: I want to troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.
Troubleshooting
Troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.
EDR and antivirus coexistence with Global Secure Access client
General
Learn about endpoint detection and response and antivirus solution coexistence with Global Secure Access client.