Microsoft Entra Global Secure Access

How to configure custom headers (preview)

11 September 2026Doc update+7 / −2 lines

In brief

The page now explains how to find modified-header transactions in Global Secure Access traffic logs and add the Custom Headers column. During the September 2026 rollout, a special Entra Admin Center link may be needed to view these details.

What Entra admins need to know

Administrators can use Traffic Logs > Transactions to inspect custom header modifications; no required configuration change is stated.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

How to configure custom headers (preview)

Note
This feature is being rolled out with the expected completion date of September 10, 2026.

Custom headers in Global Secure Access (GSA) lets you add custom HTTP headers to outbound web requests for specific destinations. You configure headers as part of a web filtering policy rule, so the headers are added only to traffic that matches the fully qualified domain names (FQDNs) that you select.

Important
To restrict access to Microsoft Entra tenants, use universal tenant restrictions
Custom headers in Global Secure Access (GSA) lets you add custom HTTP headers to outbound web requests for specific destinations. You configure headers as part of a web filtering policy rule, so the headers are added only to traffic that matches the fully qualified domain names (FQDNs) that you select.

Important
To restrict access to Microsoft Entra tenants, use universal tenant restrictions instead of custom headers.

Custom headers in traffic logs

Note
While this feature is rolling out in September 2026, you may need to use this special Entra Admin Center link to see custom header details in Global Secure Access logs.
You can review the Global Secure Access traffic logs to identify specific transactions with header modifications. To do that, navigate to the Entra Admin Center / Global Secure Access / Monitor / Traffic Logs. Click on the Transactions tab and add the Custom Headers column to the view.
Related content

How to configure Global Secure Access web content filtering

@@ -11,8 +11,6 @@ ai-usage: ai-assisted  # How to configure custom headers (preview) -> [!NOTE]-> This feature is being rolled out with the expected completion date of September 10, 2026.   Custom headers in Global Secure Access (GSA) lets you add custom HTTP headers to outbound web requests for specific destinations. You configure headers as part of a web filtering policy rule, so the headers are added only to traffic that matches the fully qualified domain names (FQDNs) that you select. @@ -105,6 +103,13 @@ Custom headers works with any service that supports header-based tenant restrict > [!IMPORTANT] > To restrict access to Microsoft Entra tenants, use [universal tenant restrictions](how-to-universal-tenant-restrictions.md) instead of custom headers. +## Custom headers in traffic logs++> [!NOTE]+> While this feature is rolling out in September 2026, you may need to use this [special Entra Admin Center link](https://entra.microsoft.com/?Microsoft_Azure_Network_Access_customheadersfields=true#view/Microsoft_Azure_Network_Access/TrafficLogs.ReactView) to see custom header details in Global Secure Access logs.++You can review the Global Secure Access traffic logs to identify specific transactions with header modifications. To do that, navigate to the Entra Admin Center / Global Secure Access / Monitor / Traffic Logs. Click on the Transactions tab and add the Custom Headers column to the view.+ ## Related content  - [How to configure Global Secure Access web content filtering](how-to-configure-web-content-filtering.md)