Transport Layer Security
Doc updateThe TLS inspection documentation now explains how to configure either a Microsoft-managed certificate or your own certificate authority.
Keep up with Microsoft Entra
Daily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
Day in brief
Global Secure Access documents a preview Microsoft-managed TLS inspection certificate path
Global Secure Access was the sole focus of the period, centered on TLS inspection. A new preview guide covers a tenant-specific Microsoft-managed root CA for Microsoft Entra Internet Access TLS inspection, while related guidance separates managed-certificate and customer-provided certificate procedures. The remaining custom-header update only standardized spacing in domain lists.
- Microsoft-managed root CA guidance enters preview
Global Secure Access · SecurityThe new guide explains how to create a tenant-specific Microsoft-managed root CA, deploy its public certificate to client devices, and enable it for Microsoft Entra Internet Access TLS inspection. The private key remains protected by Microsoft.
- TLS inspection guidance now separates certificate choicesGlobal Secure Access · Security
The main TLS inspection page now explains how to configure TLS inspection with either a Microsoft-managed certificate or an administrator-provided certificate.
- Bring-your-own-CA instructions spell out the certificate workflowGlobal Secure Access · Security
The updated guide focuses on creating a certificate signing request, having it signed by the organization’s PKI, and uploading the resulting certificate, while linking to the separate Microsoft-managed certificate guidance.
- Prompt-injection protection guidance adds both TLS certificate optionsGlobal Secure Access · Security
The guidance now explains that TLS inspection for enterprise generative AI app prompt-injection protection can use either a Microsoft-managed certificate or an administrator-provided certificate before TLS inspection policies are configured.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
7 updates
Microsoft Entra Global Secure Access
7 updatesConfigure TLS inspection with a Microsoft-managed certificate
New featureAction requiredThe guide explains how to create a tenant-specific Microsoft-managed root CA, deploy its public certificate to client devices, and enable it for Microsoft Entra Internet Access TLS inspection. The capability is in preview, and the private key remains protected by Microsoft.
The article now focuses on bringing your own certificate authority for TLS inspection, including CSR creation, PKI signing, and certificate upload. It also links to separate Microsoft-managed certificate guidance.
The AI prompt injection protection documentation now explains that TLS inspection can use either a Microsoft-managed certificate or an administrator-provided certificate before configuring TLS inspection policies.
The documentation now provides separate links for configuring TLS inspection with a Microsoft-managed certificate and with your own certificate.
Configure Custom Headers
Doc updateConsistent spacing was added to domain lists for Claude, GitHub, Slack, Dropbox, and YouTube entries. Header names and descriptions are unchanged.
Troubleshoot Transport Layer Security
Doc updateThe troubleshooting page now links to separate guides for Microsoft-managed certificates and customer-provided certificates, and its publication date was updated.