Global Secure Access traffic forwarding profiles

@@ -1,8 +1,8 @@ --- title: Global Secure Access traffic forwarding profiles-description: Learn about how traffic forwarding profiles for Global Secure Access streamline how you route traffic through your network.+description: Learn how Global Secure Access traffic forwarding profiles route traffic and how multiple Private Access profiles provide granular application and assignment control. ms.topic: concept-article-ms.date: 03/12/2026+ms.date: 09/20/2026 ms.reviewer: katabish ai-usage: ai-assisted ---@@ -11,21 +11,30 @@ ai-usage: ai-assisted  ## Overview -You use traffic forwarding profiles in Global Secure Access to apply policies to the network traffic that your organization wants to secure and manage. Network traffic is evaluated against the traffic forwarding policies you configure. The profiles are applied and the traffic goes through the service to the appropriate apps and resources. +You use traffic forwarding profiles in Global Secure Access to apply policies to the network traffic that your organization wants to secure and manage. Network traffic is evaluated against the traffic forwarding profiles you configure. The applicable profile is applied, and traffic is forwarded through the service to the appropriate applications and resources.  This article describes the traffic forwarding profiles and how they work.  ## Traffic forwarding -**Traffic forwarding** enables you to configure the type of network traffic to tunnel through the Microsoft Entra Private Access and Microsoft Entra Internet Access services. You set up profiles to manage how specific types of traffic are managed. +**Traffic forwarding** enables you to configure the type of network traffic to tunnel through Microsoft Entra Private Access and Microsoft Entra Internet Access. You set up profiles to manage how specific types of traffic are handled. -When traffic comes through Global Secure Access, the service evaluates the type of traffic first through the **Microsoft access profile**,  then through the **Private access profile**, and finally through the **Internet access profile**. Any traffic that doesn't match these three profiles isn't forwarded to Global Secure Access. +When traffic comes through Global Secure Access, the service evaluates the traffic type first through the **Microsoft access profile**, then through the **Private access profile**, and finally through the **Internet access profile**. Traffic that doesn't match these profile types isn't forwarded to Global Secure Access.  For each traffic forwarding profile, you can configure: -- Which users receive the traffic forwarding profile and how your users connect to the service-- Which traffic to forward to the service-- What Conditional Access policies to apply+- Which users and devices receive the profile.+- Which device platforms receive the profile.+- Which traffic is forwarded to the service.+- Which Conditional Access policies apply to the resources.++## Profile priority and assignment++You can assign traffic forwarding profiles to users, groups, devices, and device platforms. User and device assignments are evaluated together with device-platform assignments.++When multiple enabled profiles for the same traffic type apply to a user and device, only the applicable profile with the highest priority is used by the client.++For assignment details and examples, see [Assign users and devices to traffic forwarding profiles](how-to-manage-users-groups-assignment.md).  ## Microsoft traffic @@ -43,9 +52,18 @@ Microsoft traffic profile requires the following licenses:  ## Private access -With the Private Access profile, you can route traffic to your private resources. This traffic forwarding profile requires configuring Quick Access, which includes the fully qualified domain names (FQDNs) and IP addresses of the private apps and resources you want to forward to the service. +Private Access traffic forwarding profiles route traffic to private resources through the Global Secure Access client. Private resource definitions come from Quick Access and Private Access enterprise applications.++Every tenant has a default Private Access profile. You can also create custom Private Access profiles to:++- Provide different application sets to different users or devices.+- Separate traffic acquisition by device platform, such as desktop and mobile platforms.+- Gradually deploy Private Access to selected users, groups, or devices.+- Exclude privileged or sensitive applications from a broadly assigned profile.++Each custom profile has its own acquisition rules, assignments, status, and priority. During preview, you can create up to 10 custom Private Access profiles. -Private access traffic can be forwarded to the service by connecting through the [Global Secure Access desktop client](how-to-install-windows-client.md).+Private access traffic is forwarded by the [Global Secure Access client](concept-clients.md).  ### Licensing @@ -87,7 +105,10 @@ Key characteristics: ## Next steps  - [Learn more about the Microsoft traffic profile](concept-microsoft-traffic-profile.md)+- [Create a Private Access traffic forwarding profile](how-to-create-traffic-forwarding-profile.md)+- [Delete a Private Access traffic forwarding profile](how-to-delete-traffic-forwarding-profile.md) - [Manage the Microsoft traffic profile](how-to-manage-microsoft-profile.md) - [Manage the Internet access traffic profile](how-to-manage-internet-access-profile.md)-- [Manage the Private access traffic profile](how-to-manage-private-access-profile.md)+- [Manage Private Access traffic forwarding profiles](how-to-manage-private-access-profile.md)+- [Assign users and devices to traffic forwarding profiles](how-to-manage-users-groups-assignment.md) - [Configure Quick Access](how-to-configure-quick-access.md)