You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
## Process minimumlicense - split by comma and trim spaces MF: We don't use doc metadata for minimum license in the current implementation, so skipping for now.
When the Global Secure Access client is not deployed to managed endpoints, those devices operate outside the organization's Security Service Edge controls. Threat actors can exploit unprotected endpoints to establish initial access through phishing or drive-by downloads, then move laterally or exfiltrate data without triggering network-level security policies.
1
+
Comprehensive deployment of the Global Secure Access client is foundational to achieving Zero Trust network security. If you don't deploy the Global Secure Access client to managed endpoints, those devices operate outside the organization's Security Service Edge controls. Threat actors can exploit unprotected endpoints to establish initial access, move laterally, or exfiltrate data without triggering network-level security policies.
2
2
3
-
Devices lacking the Global Secure Access client cannot benefit from compliant network checks in Conditional Access policies, source IP restoration for accurate sign-in logging, or tenant restrictions that prevent unauthorized access to external organizations. Credential theft and token replay attacks become more difficult to detect when traffic from these endpoints bypasses the security perimeter. Organizations with incomplete client deployment create a fragmented security posture where protected and unprotected devices coexist, allowing threat actors to identify and target the weakest links.
3
+
Without the Global Secure Access client:
4
4
5
-
The gap between managed device counts (Entra ID joined and Hybrid joined devices) and Global Secure Access active device counts represents the attack surface that remains unmonitored. Managed endpoints that lack the client also cannot access private applications through Microsoft Entra Private Access, potentially driving users to insecure workarounds. Ensuring comprehensive client deployment is foundational to achieving Zero Trust network security—without the client, the security controls cannot be enforced regardless of how well policies are configured.
5
+
- Devices can't benefit from compliant network checks in Conditional Access policies, source IP restoration, or tenant restrictions.
6
+
- Credential theft and token replay attacks are more difficult to detect when traffic bypasses the security perimeter.
7
+
- Managed endpoints can't access private applications through Microsoft Entra Private Access.
6
8
7
9
**Remediation action**
8
10
- Install the Global Secure Access client:
@@ -13,3 +15,4 @@ The gap between managed device counts (Entra ID joined and Hybrid joined devices
13
15
- Monitor the Global Secure Access client health and connection status by using the [Global Secure Access dashboard](https://learn.microsoft.com/entra/global-secure-access/concept-traffic-dashboard?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
When TLS inspection is enabled in Global Secure Access, traffic passing through the Security Service Edge undergoes decryption to enable deep packet inspection, URL categorization, and threat detection. Bypass rules are sometimes necessary for traffic that cannot be inspected due to technical constraints (certificate pinning) or compliance requirements. However, without regular review, bypass rules accumulate over time as temporary exceptions become permanent, applications are decommissioned while their bypass rules remain, or initial justifications become obsolete. Threat actors specifically target uninspected traffic channels, knowing that malware command-and-control communications, data exfiltration, and credential theft over HTTPS will evade detection when traffic bypasses TLS inspection. A policy that has not been modified in over 90 days may contain stale bypass rules that no longer serve a valid business purpose, effectively creating blind spots in the organization's network security posture. Organizations should maintain a review cadence where TLS inspection policies are audited quarterly at minimum, validating that each bypass rule remains necessary and appropriately scoped.
1
+
Transport Layer Security (TLS) inspection bypass rules create exceptions where encrypted traffic skips deep packet inspection. Without regular review, bypass rules accumulate as temporary exceptions become permanent, applications are decommissioned while their rules remain, or initial justifications become obsolete. Threat actors target uninspected traffic channels. They know that malware command-and-control communications, data exfiltration, and credential theft over HTTPS evade detection when traffic bypasses TLS inspection. Policies not modified in over 90 days might contain stale bypass rules that create blind spots in your network security posture.
2
2
3
3
**Remediation action**
4
4
5
-
1.[Review and manage TLS inspection policies in the Microsoft Entra admin center under Global Secure Access > Secure > TLS inspection](https://learn.microsoft.com/en-us/graph/api/resources/networkaccess-tlsinspectionpolicy)
6
-
2.[Understand TLS inspection rule configuration and bypass actions](https://learn.microsoft.com/en-us/graph/api/resources/networkaccess-tlsinspectionrule)
7
-
3. Establish a quarterly review process for TLS inspection bypass rules, documenting business justification for each bypass rule and removing rules that are no longer necessary
8
-
4. Required role: Global Secure Access Administrator or Security Administrator
9
-
5
+
- Establish a quarterly review process for TLS inspection bypass rules, document a business justification for each bypass rule, and remove rules that are no longer necessary.
6
+
-[Review and manage TLS inspection policies](https://learn.microsoft.com/graph/api/resources/networkaccess-tlsinspectionpolicy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) in the Microsoft Entra admin center under **Global Secure Access** > **Secure** > **TLS inspection**.
7
+
- Review the steps in [Configure Transport Layer Security inspection policies](https://learn.microsoft.com/entra/global-secure-access/how-to-transport-layer-security?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to understand how to modify or remove bypass rules as part of the review process.
TLS inspection enables Global Secure Access to decrypt and analyze encrypted HTTPS traffic for threats, malicious content, and policy violations. When TLS inspection fails for a connection, that traffic bypasses security controls entirely, allowing potential malware delivery, command-and-control communications, or data exfiltration to proceed undetected. Failure rates above 1% indicate systemic issues such as certificate trust problems on endpoints, incompatible applications using certificate pinning without proper bypass rules, or certificate authority configuration errors. Threat actors may intentionally craft connections designed to cause TLS inspection failures, knowing the resulting traffic will evade detection. A sustained high failure rate represents an expanding blind spot in the organization's security posture, as each failed inspection is a missed opportunity to detect and block malicious activity. Organizations should monitor TLS inspection success rates and investigate the root causes of failures to maintain comprehensive visibility into encrypted traffic.
1
+
By using Transport Layer Security (TLS) inspection, Global Secure Access can decrypt encrypted HTTPS traffic and check it for threats, malicious content, and policy violations. If TLS inspection fails for a connection, that traffic bypasses security controls. Inspection failures can let potential malware delivery, command-and-control communications, or data exfiltration go undetected.
2
2
3
-
**Remediation action**
3
+
Failure rates above 1% point to systemic problems. These problems include certificate trust issues on endpoints, incompatible applications that use certificate pinning without proper bypass rules, or certificate authority configuration errors. Threat actors can also intentionally create connections that cause TLS inspection failures.
4
4
5
-
-[Configure diagnostic settings to export traffic logs to Log Analytics](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-view-traffic-logs#configure-diagnostic-settings-to-export-logs)
6
-
-[Review TLS inspection concepts and troubleshooting](https://learn.microsoft.com/en-us/entra/global-secure-access/concept-transport-layer-security)
7
-
-[For destinations with certificate pinning, add TLS bypass rules](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-transport-layer-security)
5
+
**Remediation action**
8
6
7
+
-[Configure diagnostic settings to export traffic logs](https://learn.microsoft.com/entra/global-secure-access/how-to-view-traffic-logs?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#configure-diagnostic-settings-to-export-logs) to a Log Analytics workspace. Use these logs to monitor TLS inspection success rates and investigate the root causes of failures.
8
+
- Follow the steps in [Troubleshoot Global Secure Access Transport Layer Security inspection errors](https://learn.microsoft.com/entra/global-secure-access/troubleshoot-transport-layer-security?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to resolve common inspection failures.
9
+
- For destinations with certificate pinning, [add TLS bypass rules](https://learn.microsoft.com/entra/global-secure-access/how-to-transport-layer-security?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to reduce failure rates while keeping inspection for other traffic.
Global Secure Access maintains a system bypass list of destinations that are automatically excluded from TLS inspection due to known incompatibilities such as certificate pinning, mutual TLS requirements, or other technical constraints. When administrators create custom bypass rules that duplicate destinations already covered by the system bypass list, these rules are redundant and serve no functional purpose. Redundant rules consume policy capacity (TLS inspection supports up to 1,000 rules and 8,000 destinations per tenant), create administrative overhead during policy reviews, and may cause confusion about which rules are actually necessary for the organization's specific requirements versus which are duplicating built-in protections. Maintaining a clean policy configuration with only necessary custom bypass rules improves manageability, makes security audits more straightforward, and ensures that policy capacity is available for legitimate business requirements rather than duplicated system functionality.
1
+
Global Secure Access maintains a system bypass list of destinations that are automatically excluded from Transport Layer Security (TLS) inspection. These bypass destinations represent known incompatibilities such as certificate pinning, mutual TLS requirements, or other technical constraints. Custom bypass rules that duplicate destinations in the system bypass list are redundant and serve no functional purpose.
2
2
3
-
**Remediation action**
4
-
5
-
Review and remove redundant custom bypass rules in the Microsoft Entra admin center under Global Secure Access > Secure > TLS inspection policies
3
+
Redundant rules consume policy capacity, create administrative overhead, and can cause confusion about which rules are necessary. TLS inspection supports up to 1,000 rules and 8,000 destinations per tenant. Maintaining a clean policy configuration with only necessary custom bypass rules improves manageability, simplifies security audits, and ensures that policy capacity is available for legitimate business requirements.
6
4
7
-
Reference the current system bypass list:
8
-
-[FAQ: What destinations are included in the system bypass?](https://learn.microsoft.com/en-us/entra/global-secure-access/faq-transport-layer-security#what-destinations-are-included-in-the-system-bypass)
5
+
**Remediation action**
9
6
7
+
- Review and remove redundant custom TLS inspection bypass rules in the Microsoft Entra admin center. Navigate to **Global Secure Access** > **Secure** > **TLS inspection policies**.
8
+
- Review [the destinations included in the system bypass list](https://learn.microsoft.com/entra/global-secure-access/faq-transport-layer-security?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#what-destinations-are-included-in-the-system-bypass).
0 commit comments