📋 Microsoft Entra Documentation Changes

ms.reviewer: alexpav

---

 

 

You can automatically deliver proxy settings and certificate authority trust settings in Microsoft Edge by using an Intune mobile application management (MAM) policy. The policy can take advantage of the Explicit Forward Proxy feature of Global Secure Access.

 

## Prerequisites

 

- A Microsoft Entra identity with at least the Global Secure Access Administrator Reader role and Intune Administrator role.

ms.reviewer: alexpav

---

 

 

Explicit Forward Proxy is a traffic acquisition mechanism that's useful in scenarios where installation of the Global Secure Access client is difficult or not possible. Explicit Forward Proxy helps protect internet traffic when users use browsers to access resources from:

 

 

Explicit Forward Proxy relies on proxy automatic configuration (PAC) files to configure browsers for Microsoft Entra Internet Access connectivity. It uses the HTTP CONNECT protocol to facilitate network communication between the user and the Microsoft Entra Internet Access service. It uses Microsoft Entra ID and Microsoft Entra Conditional Access to authenticate and authorize user access to internet resources.

 

## Traffic flow

 

| Step | Details |

ms.reviewer: alexpav

---

 

 

Explicit Forward Proxy uses Microsoft Entra ID authentication and authorization to validate user access before allowing network traffic. This validation method allows for adaptive policies in Microsoft Entra Conditional Access, modern credentials like passkeys, and Continuous Access Evaluation with session revocation. Classic proxy authorization methods, such as basic, digest, NTLM, or Kerberos, aren't supported.

 

## Session management settings

 

Explicit Forward Proxy supports smart session management (enabled by default), HTTP header-based session affinity (can be enabled), IP-based session affinity (enabled by default), and cookie-based session affinity. Available capabilities depend on the affinity method.

 

For unmanaged devices, you can instruct users to manually enter the PAC file location in browser settings or rely on a network-provided configuration. A network-provided configuration might be Dynamic Host Configuration Protocol (DHCP) or Web Proxy Auto-Discovery (WPAD).

 

## Related content

 

- [Learn how to configure Explicit Forward Proxy](how-to-configure-explicit-forward-proxy.md)

ms.reviewer: alexpav

---

 

 

You can configure Explicit Forward Proxy (preview) to rely on the private IP addresses of devices on your network to associate authenticated users with their devices. To use HTTP header session management with Explicit Forward Proxy, you need to securely communicate the private IP address of the device to the Explicit Forward Proxy feature.

 

> [!IMPORTANT]

 

## Prerequisites