Microsoft Entra Internet Access
GeneralConfigure Cloud Firewall Clients
In brief
The documentation now states that Internet Access traffic forwarding does not acquire DNS traffic in preview, including with wildcard rules. Cloud Firewall cannot filter DNS queries; FQDN rules apply to connections to named destinations.
What Entra admins need to know
Administrators should not rely on Cloud Firewall to filter DNS traffic.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Preview considerations
The Internet Access traffic forwarding profile doesn't acquire DNS traffic in this preview, including with wildcard acquisition rules. Cloud firewall therefore doesn't support filtering DNS traffic. FQDN-based firewall rules match connections to named destinations; they don't filter DNS queries.
The examples in this article cover IPv4 traffic over TCP and UDP. The 0.0.0.0/0 acquisition destination doesn't include IPv6, and these instructions don't configure IPv6 protection.
QUIC acquisition and blocking are supported; end-to-end QUIC forwarding isn't supported in this preview. FQDN rules require a destination name at the time of the firewall decision and don't replace IP-based restrictions.
@@ -3,7 +3,7 @@ title: Configure cloud firewall for Global Secure Access clients (preview) description: Learn how to configure cloud firewall for traffic from Global Secure Access clients and verify Allow and Block decisions in Microsoft Entra Internet Access. ms.topic: how-to ms.subservice: entra-internet-access-ms.date: 10/26/2026+ms.date: 10/27/2026 ms.custom: it-pro ai-usage: ai-generated @@ -265,6 +265,8 @@ For more information, see [Global Secure Access network traffic logs](how-to-vie ## Preview considerations +The Internet Access traffic forwarding profile doesn't acquire DNS traffic in this preview, including with wildcard acquisition rules. Cloud firewall therefore doesn't support filtering DNS traffic. FQDN-based firewall rules match connections to named destinations; they don't filter DNS queries.+ The examples in this article cover IPv4 traffic over TCP and UDP. The `0.0.0.0/0` acquisition destination doesn't include IPv6, and these instructions don't configure IPv6 protection. QUIC acquisition and blocking are supported; end-to-end QUIC forwarding isn't supported in this preview. FQDN rules require a destination name at the time of the firewall decision and don't replace IP-based restrictions.