Add network pillar guidance for Global Secure Access AI protection and Explicit Forward Proxy (#1455)

## Summary

Adds four new Network pillar workshop guidance files covering Global
Secure Access (GSA) AI protection and clientless traffic acquisition.
Each file follows the existing SWG guidance structure (title,
Implementation Effort, User Impact, Overview, Reference) with a concise
Zero Trust overview, numbered key steps, and links to the Microsoft
Learn documentation for detailed implementation.

## Files added

| File | Title |
|------|-------|
| `NET_103.md` | Enable and Configure Explicit Forward Proxy |
| `NET_104.md` | Protect Microsoft Copilot Studio agents |
| `NET_105.md` | Review Generative AI Insights |
| `NET_106.md` | Review MCP traffic logs |

## Notes

- Content grounded in official Microsoft Learn documentation (Global
Secure Access / Power Platform).
- Markdown lint issues (MD009 trailing spaces, MD012 multiple blank
lines) validated and resolved.

Author: astaykov

src/react/docs/workshop-guidance/network/NET_103.md

@@ -0,0 +1,24 @@
+# Enable and Configure Explicit Forward Proxy
+
+**Implementation Effort:** Medium
+
+**User Impact:** Medium
+
+## Overview
+
+In a Zero Trust model, all internet traffic should be authenticated, authorized, and inspected regardless of the device or platform it originates from—but installing an endpoint client isn't always possible. Explicit Forward Proxy is a traffic acquisition mechanism for Global Secure Access that protects browser-based internet traffic in scenarios where the Global Secure Access client is difficult or impossible to deploy, such as multi-session virtual desktop infrastructure (VDI), kiosks, browsers on Linux desktops, lightly managed devices, and bring-your-own devices using Microsoft Edge with Intune app policies.
+
+Explicit Forward Proxy uses proxy automatic configuration (PAC) files to point browsers at Microsoft Entra Internet Access, and the HTTP CONNECT protocol to broker the connection. It leverages Microsoft Entra ID and Conditional Access to authenticate and authorize each user before applying Microsoft Entra Internet Access security policies to the request. All processed traffic is TLS terminated so it can be inspected, extending consistent Zero Trust enforcement to clientless and unmanaged endpoints.
+
+Enabling and configuring Explicit Forward Proxy follows these key steps. See the linked documentation for detailed implementation instructions.
+
+1. **Enable Explicit Forward Proxy** — Turn on Explicit Forward Proxy in the Microsoft Entra admin center. Smart session management is enabled by default and relies on Explicit Forward Proxy PAC file hosting to assign each user a unique proxy address so user-specific security profiles can be applied.
+2. **Configure PAC file hosting** — Configure browsers to retrieve the proxy configuration at startup, using either Microsoft-hosted tenant-specific PAC file URLs (required for smart session management features) or self-hosted PAC files when you need to customize contents or exclude destinations from TLS termination.
+3. **Configure session management** — Rely on smart session management and, optionally, header-based session affinity (sending the user's private IP in an HTTP header) to maintain user-specific enforcement. If neither is available, Explicit Forward Proxy falls back to source IP affinity and applies only the baseline profile.
+4. **Configure Conditional Access** — Because session affinity anchors on IP address, create a Conditional Access policy that restricts Explicit Forward Proxy use to trusted company networks and enforces access through Explicit Forward Proxy as the network channel.
+
+## Reference
+
+- [Explicit Forward Proxy overview](https://learn.microsoft.com/en-us/entra/global-secure-access/concept-explicit-forward-proxy)
+- [Explicit Forward Proxy (preview) session management](https://learn.microsoft.com/en-us/entra/global-secure-access/concept-explicit-forward-proxy-session-management)
+- [Configure a Microsoft Entra Conditional Access policy for Explicit Forward Proxy (preview)](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-conditional-access-policy-for-explicit-forward-proxy)

src/react/docs/workshop-guidance/network/NET_104.md

@@ -0,0 +1,23 @@
+# Protect Microsoft Copilot Studio agents
+
+**Implementation Effort:** Medium
+
+**User Impact:** Low
+
+## Overview
+
+As organizations adopt autonomous and interactive AI agents to perform tasks previously handled by humans, administrators often lose the visibility and control they traditionally have over user network activity. In a Zero Trust model, agents must be treated as identities whose traffic is never implicitly trusted and is continuously verified against security policy—just like users and devices.
+
+Global Secure Access (GSA) for agents extends Microsoft Entra network security controls to Microsoft Copilot Studio agents. You forward agent traffic to Global Secure Access's globally distributed proxy service, where each request is evaluated in real time against your configured policies. This lets you apply web content filtering, threat intelligence filtering, and network file filtering to agent traffic—regulating how agents use knowledge, tools, and actions to reach external resources, just as you govern user traffic. Enforcement uses the tenant-level baseline profile; security profiles linked to Conditional Access policies aren't currently supported for agents. Network controls for agents require Microsoft Entra Internet Access (included in the Microsoft Entra Suite or licensed separately) together with the appropriate Microsoft Agent 365 licensing.
+
+Protecting Copilot Studio agents follows these key steps. See the linked documentation for detailed implementation instructions.
+
+1. **Enable network controls** — In the Power Platform admin center, enable Global Secure Access for Agents on a per-environment or per-environment-group basis so agent traffic (HTTP node, custom connectors, MCP servers, custom tools, and supported connectors) is forwarded to Global Secure Access. Ensure the tenant is onboarded to Global Secure Access first, and re-save any existing custom connectors so their traffic routes through the service.
+2. **Create and apply security policies** — In the Microsoft Entra admin center, create web content filtering, threat intelligence, and network file filtering policies to enforce least-privilege access for agents, then link them to the baseline profile to apply them tenant-wide.
+3. **Monitor and maintain** — Regularly review Global Secure Access traffic logs for blocked or anomalous agent activity, update filtering policies as connectors and requirements evolve, and test policy changes in a development environment before production.
+
+## Reference
+
+- [Learn about Secure Web and AI Gateway for Microsoft Copilot Studio agents](https://learn.microsoft.com/en-us/entra/global-secure-access/concept-secure-web-ai-gateway-agents)
+- [Configure Secure Web and AI Gateway for Microsoft Copilot Studio agents](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-secure-web-ai-gateway-agents)
+- [Global Secure Access for Copilot Studio agents](https://learn.microsoft.com/en-us/power-platform/admin/security/secure-web-ai-gateway-agents)

src/react/docs/workshop-guidance/network/NET_105.md

@@ -0,0 +1,23 @@
+# Review Generative AI Insights
+
+**Implementation Effort:** Low
+
+**User Impact:** Low
+
+## Overview
+
+A core Zero Trust principle is to assume breach and continuously monitor activity so you can verify what users, devices, and agents are actually doing. As generative AI adoption grows, organizations need visibility into the prompts sent to AI applications and the Model Context Protocol (MCP) traffic exchanged between AI agents and remote MCP servers. Generative AI Insights in Microsoft Entra Global Secure Access provides a unified surface for reviewing this activity flowing through Internet Access, so you can detect risky usage, discover shadow MCP servers, and correlate AI activity with the user, destination, and transaction behind each event.
+
+Reviewing Generative AI Insights follows these key steps. See the linked documentation for detailed implementation instructions.
+
+1. **Confirm prerequisites** — Ensure you have a Global Secure Access license, the Global Secure Access Administrator or Log Reader role, Internet Access traffic forwarding enabled for the users or devices you want to monitor, and TLS inspection enabled (required for prompt logging and for MCP logging on end-user devices).
+2. **Open the Generative AI Insights logs page** — In the Microsoft Entra admin center, browse to **Global Secure Access** > **Monitor** > **Generative AI Insights** to review GenAI prompt and MCP events, with the most recent events at the top.
+3. **Filter and inspect events** — Narrow the view by Activity (Prompt or MCP), Sub-activity, Destination URL, or User, then select a row to open the details pane and view the full payload plus the Event, Session, and Transaction IDs used to correlate a request with its response and pivot to the related traffic log.
+4. **Discover shadow MCP servers** — Set Activity to MCP and review unique Destination URL values to identify previously unknown, private, or shadow MCP servers, then use URL filtering to block traffic to any risky server.
+5. **Export and retain** — Export the current filtered view (up to 100,000 records) for offline analysis, and stream events to Microsoft Sentinel or Azure Monitor Log Analytics using the `NetworkAccessGenerativeAIInsights` diagnostic settings category for long-term retention and detection.
+
+## Reference
+
+- [View Generative AI Insights logs in Global Secure Access (preview)](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-view-generative-ai-insights-logs)
+- [Generative AI Insights in Global Secure Access](https://learn.microsoft.com/en-us/entra/global-secure-access/concept-generative-ai-insights)
+- [Microsoft Sentinel integration](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-sentinel-integration)

src/react/docs/workshop-guidance/network/NET_106.md

@@ -0,0 +1,23 @@
+# Review MCP traffic logs
+
+**Implementation Effort:** Low
+
+**User Impact:** Low
+
+## Overview
+
+Zero Trust requires continuous visibility into how AI agents communicate with the tools and resources they use. As agents increasingly rely on the Model Context Protocol (MCP) to reach remote MCP servers, organizations need to know which servers are in use, what tools and resources they expose, and how those tools are invoked. Global Secure Access MCP traffic logging uses deep packet inspection to identify MCP traffic by the protocol itself—rather than a predefined cloud app catalog—so it can surface previously unknown, private, and shadow MCP servers and help you enforce stronger governance over agent communications.
+
+Reviewing MCP traffic logs follows these key steps. See the linked documentation for detailed implementation instructions.
+
+1. **Confirm prerequisites** — Ensure you have a Global Secure Access license and the Global Secure Access Administrator or Log Reader role. For end-user devices, the Global Secure Access client must be installed with Internet Access traffic forwarding and TLS inspection enabled (MCP data is in the encrypted payload). For Copilot Studio agents, enabling the Global Secure Access integration logs MCP traffic without requiring TLS inspection. Only traffic to **remote** MCP servers is captured.
+2. **View MCP traffic logs** — In the Microsoft Entra admin center, browse to **Global Secure Access** > **Monitor** > **Generative AI Insights**, then set the **Activity** filter to **MCP** to see only MCP traffic events.
+3. **Inspect event details** — Select any log entry to open the details pane and view the full MCP payload, including the sub-activity type (such as `initialize`, `tools/list`, or `tools/call`), the request or response content, and server-reported tool descriptions and capabilities in `initialize` responses. Use the Event ID to match a request with its response and the Transaction ID to correlate with network-level traffic logs.
+4. **Filter and sort** — Narrow the view by Sub-activity (for example, `tools/call` to focus on tool invocations), Destination URL, or User to understand which servers and tools are being used, and export the filtered results for offline analysis.
+5. **Discover MCP servers** — Review unique values in the **Destination URL** column (the reliable identifier for an MCP server) to identify shadow or unknown servers, select an `initialize` response to review advertised tools and capabilities, and use URL filtering to block traffic to any risky server.
+
+## Reference
+
+- [How to view Model Context Protocol (MCP) traffic logs in Global Secure Access (Preview)](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-view-model-context-protocol-logging)
+- [View Generative AI Insights logs in Global Secure Access (preview)](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-view-generative-ai-insights-logs)
+- [Configure web content filtering](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-web-content-filtering)