Daily.Entra.News
Aboutmerill.net
Microsoft Entra Internet Access

How to manage the Internet Access profile

3 August 2026Updated+38 / −17 lines

In brief

The article now describes traffic forwarding through the Global Secure Access client and remote networks, six policies instead of three, Microsoft Traffic Bypass, Custom Acquire, and Agentic Acquire. It also expands Custom Bypass configuration steps to cover destination types, ports, and protocols.

What Entra admins need to know

Administrators should review the updated policy model and configuration guidance, particularly if they need to define custom acquired or bypassed traffic.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

Open on Microsoft Learn ↗

The comparison below is an extract of the Microsoft Learn article showing only the changed content. Open the full article for complete context.

Overview

The Internet Access traffic forwarding profile routes internet traffic through the Global Secure Access client.client and remote networks. Enabling this traffic forwarding profile allows remote workersusers to connect to the internet in a controlled and secure way. With the features of Microsoft Entra Internet Access, you can control which internet sites can be accessed. You can also configure which traffic to include or exclude from Global Secure Access based on IP addresses, IP address ranges, IP subnets, and Fully Qualified Domain Names (FQDNs). You can also deploy Global Secure Access side by side with another Secure Web Gateway (SWG) vendor by using the Custom Acquire policy to selectively acquire specific traffic, or the Agentic Acquire policy to acquire traffic from local AI agents (such as GitHub Copilot CLI or Claude CLI), while using other vendors for rest of the internet.

Prerequisites

Internet Access traffic forwarding profile policies

View the policies that relate to the Internet Access traffic forwarding profile. There are threesix policies by default.in total. To view them:

  1. Sign in to the Microsoft Entra admin center as a Global Secure Access Administrator.
  2. Browse to Global Secure Access > Connect > Traffic forwarding.
  3. Select the View link in the Internet Access policies section.

The default Internet Access policies include:

  • Custom Bypass Contains user-defined traffic/endpoints that are excluded from the Internet traffic profile. In other words, you define the traffic that the profile shouldn't acquire. You might typically exclude traffic such as your VPN endpoints, private IP ranges, and squat IP ranges, and endpoints that leverage a network Access Control List (ACL).
  • Default Bypass Contains predefined traffic that the Internet traffic profile doesn't acquire. For example, private IP ranges. You can't change rules in this policy.
  • Microsoft Traffic Bypass Contains predefined Microsoft endpoints that are explicitly excluded from the Internet traffic profile and are instead acquired using Microsoft traffic profile. You can't change rules in this policy.
  • Custom Acquire Contains user-defined traffic/endpoints that are explicitly acquired by the Internet traffic profile. Unlike the Default Acquire Definespolicy, which is limited to ports 80 and 443 over TCP, Custom Acquire lets you selectively acquire traffic for specific IP addresses, IP address ranges, IP subnets, and Fully Qualified Domain Names (FQDNs) on any ports and protocol (TCP or UDP) you specify. This lets you deploy Global Secure Access side by side with another Secure Web Gateway (SWG) vendor: Global Secure Access acquires the traffic you specify (for example, chat.com), while the other vendor covers the rest of your internet traffic.
  • Default Acquire Contains predefined traffic that gets acquired by the Internet traffic profile. Currently, it’s allThis includes internet traffic on ports 80, 443 over Transmission Control Protocol (TCP).TCP. The policy takes lowest precedence after all bypass and custom acquire rules are evaluated. You can't change rules in this policy.
  • Agentic Acquire A special policy that signals the Global Secure Access client to acquire all web traffic that originates from local AI agents running on the device, such as GitHub Copilot CLI, Claude CLI, and similar local agents. Enable it to deploy Global Secure Access for agentic (AI agent) protection side by side with another SWG vendor that covers user traffic. You can't change rules in this policy.

Example of adding

How to add a custom bypass policy:policy

  1. Sign in to the Microsoft Entra admin center as a Global Secure Access Administrator.
  2. Browse to Global Secure Access > Connect > Traffic forwarding.
  3. In the Internet Access traffic forwarding profile area, in the Internet Access policies section, select the View link
  4. Expand the Custom Bypass policy.
  5. Select Add rule.
  6. Choose a destination type, such astype: Fully Qualified Domain Name (FQDN)., IP address, IP subnet, or IP range. You can add multiple comma-separated destination values. Don't add whitespace. For example, chat.com,contoso.com,fabrikam.com or 10.0.0.1/32,10.0.0.2/32. Ports, protocol, and action are always fixed and can't be changed.
  7. Enter a valid destination.destination and specify the ports and protocol (TCP or UDP) to bypass.
  8. Select Save.

How to add a custom acquire policy

  1. Sign in to the Microsoft Entra admin center as a Global Secure Access Administrator.
  2. Browse to Global Secure Access > Connect > Traffic forwarding.
  3. In the Internet Access traffic forwarding profile area, in the Internet Access policies section, select the View link.
  4. Expand the Custom Acquire policy.
  5. Select Add rule.
  6. Choose a destination type: Fully Qualified Domain Name (FQDN), IP address, IP subnet, or IP range. You can add multiple comma-separated destination values. Don't add whitespace. For example, chat.com,contoso.com or 10.0.0.1/32,10.0.0.2/32.
  7. Enter a valid destination and specify the ports and protocol (TCP or UDP) to acquire.
  8. Disable the Default Acquire policy using the toggle next to it. Click OK when prompted.
  9. Select Save.

How to enable agentic acquire policy

  1. Sign in to the Microsoft Entra admin center as a Global Secure Access Administrator.
  2. Browse to Global Secure Access > Connect > Traffic forwarding.
  3. In the Internet Access traffic forwarding profile area, in the Internet Access policies section, select the View link.
  4. For first time setup, click the Create Agentic Acquire button to create the policy. If policy is already created, use the toggle to enable it. Click OK when prompted.
  5. Disable the Custom Acquire and Default Acquire policy using the toggles next to them. Click OK when prompted.

User and group assignments

You can scope the Internet Access profile to specific users and groups.

  1. Open a web browser and navigate to a destination that is bypassed. Confirm that traffic isn't being captured.
  2. Open a web browser and navigate to a public destination that is acquired by the profile. Confirm the traffic is being acquired under the Internet channel.

Next steps