Daily.Entra.News
Aboutmerill.net
Microsoft Entra Global Secure Access
General

Install the Global Secure Access Client for Windows

7 November 2026Feature updateAction required+59 / −46 lines

In brief

The documentation now directs administrators to keep browser QUIC enabled and use Custom Acquire with a cloud firewall Block rule for UDP 443. DNS over HTTPS must remain disabled for FQDN-based acquisition. QUIC acquisition and blocking are in preview and do not provide end-to-end QUIC forwarding.

What Entra admins need to know

Configure and link the traffic-acquisition and firewall policies, apply them through Conditional Access, and remove existing browser QUIC-disabling policies after verification.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Configure settings forControl QUIC with cloud firewall

Keep QUIC enabled in users' browsers. To prevent QUIC connections from bypassing Microsoft Entra Internet Access byinspection, use Custom Acquire to acquire UDP traffic on destination port 443 for the intended destinations, and use a cloud firewall Block rule for the same traffic. Keep Default Acquire enabled for TCP ports 80 and 443 so that applications that support fallback can connect over HTTPS using Intune

Microsoft Entra Internet AccessTCP.

Link the cloud firewall policy to a security profile, enable the policy link, and apply the profile to the intended users through Conditional Access. Creating a firewall rule alone doesn' browsers. The following instructions provide guidance on how to enforce these controls by using Intune.

Disable QUIC in Microsoft Edget configure traffic acquisition. For configuration and Chrome by using Intune

  1. In the Microsoft Intune admin center, select Devices > Manage devices > Configuration.

  2. On the Configuration settings tab:

    1. Select + Add settings.
    2. In Settings picker, search for QUIC.
    3. From the search results:
      1. Select Microsoft Edge, and then select the Allow QUIC protocol setting.
      2. Select Google Chrome, and then select the Allow QUIC protocol setting.
    4. In Settings picker, search for DNS-over-HTTPS.
    5. From the search results:
      1. Select Microsoft Edge, and then select the Control the mode of DNS-over-HTTPS setting.
      2. Select Google Chrome, and then select the Control the mode of DNS-over-HTTPS setting.
    6. Close Settings picker.

  3. For Google Chrome, set both toggles to Disabled.

  4. For Microsoft Edge, set both toggles to Disabledverification steps, see Control QUIC traffic on UDP port 443.

    :::image type="content" source="media/how-to-install-windows-client/edge-chrome-profile.png" alt-text="Screenshot of the tabIf you previously disabled browser QUIC specifically for configuring Microsoft EdgeGlobal Secure Access, remove that browser configuration after you verify Custom Acquire and Chrome settings." lightbox="media/how-to-install-windows-client/edge-chrome-profile.png":::cloud firewall blocking. Review other organizational requirements before changing existing browser policies.

  5. Select Next twice.

Configure Firefox browser settings

Admins can use remediation scripts

Configure settings for Microsoft Entra Internet Access by using Intune

The Global Secure Access Windows client requires DNS over HTTPS to be disabled for FQDN-based traffic acquisition. Use the following Intune instructions to configure DNS over HTTPS separately from QUIC. Don't disable QUIC in the browser for this configuration.

Disable DNS over HTTPS in Microsoft Edge and Chrome by using Intune

  1. In the Microsoft Intune admin center, select Devices > Manage devices > Configuration.

  2. On the Configuration settings tab:

    1. Select + Add settings.
    2. In Settings picker, search for DNS-over-HTTPS.
    3. From the search results:
      1. Select Microsoft Edge, and then select the Control the mode of DNS-over-HTTPS setting.
      2. Select Google Chrome, and then select the Control the mode of DNS-over-HTTPS setting.
    4. Close Settings picker.

  3. For Google Chrome, set Control the mode of DNS-over-HTTPS to Disabled.

  4. For Microsoft Edge, set Control the mode of DNS-over-HTTPS to Disabled.

  5. Select Next twice.

Configure Firefox browser settings

Admins can use remediation scripts in Intune to disable DNS over HTTPS and QUIC protocols in the Firefox browser.

Make sure to configure these scripts to run in 64-bit PowerShell.

# Define the path to the Firefox policies.json file

$destination = "C:\Program Files\Mozilla Firefox\distribution\policies.json"
$compliant = $false

# Check if the file exists

if (Test-Path $destination) {
    try {
        # Read the file content $fileContent = Get-Content $destination -Raw -ErrorAction Stop
        if ($fileContent -and $fileContent.Trim().Length -gt 0) {
            # Parse JSON content $json = $fileContent | ConvertFrom-Json -ErrorAction Stop

       # Check if Preferences exist under policies
        if ($json.policies -and $json.policies.Preferences) {
                $prefs = $temp
            }

            # Initialize compliance flags
            $quicCompliant = $falseflag
            $dohCompliant = $false

            # Check if QUIC is disabled and locked
            if ($prefs.ContainsKey("network.http.http3.enable")) {
                $val = $prefs["network.http.http3.enable"]
                if ($val.Value -eq $false -and $val.Status -eq "locked") {
                    $quicCompliant = $true
                }
            }

            # Check if DNS over HTTPS is disabled and locked
            if ($prefs.ContainsKey("network.trr.mode")) {
                $val = $prefs["network.trr.mode"]
                }
            }

            # Set overall compliance if both settings are correct
            if ($quicCompliant -and $dohCompliant)dohCompliant) {
                $compliant = $true
            }
        }

# Output compliance result

if ($compliant) {
    Write-Output "Compliant"
    Exitexit 0
} else {
    Write-Output "Non-compliant"
    Exitexit 1
}
```powershell # Define paths

$distributionDirErrorActionPreference = 'Stop' $distributionDir = "C:\Program Files\Mozilla Firefox\distribution" $destination = Join-Path $distributionDir "policies.json" $backup = "$destination.bak"

Initialize variable for existing JSON

Try to read and parse existing policies.json

if (Test-Path $destination) { $fileContent = Get-Content $destination -Raw if ($fileContent -and $fileContent.Trim().Length -gt 0) { try { $existingJson = $fileContent | ConvertFrom-Json } catch { Write-Warning "ExistingFailed to parse existing policies.json is malformed. Starting fresh.json. No browser settings were changed: $_" exit 1 } } }

#Create a new JSON structure if none exists

Ensure policies and Preferences nodes exist

if (-not $existingJson.policies) { $existingJson | Add-Member -MemberType NoteProperty -Name policies -Value ([PSCustomObject]@{}) } if (-not $existingJson.policies.Preferences) { $existingJson.policies | Add-Member -MemberType NoteProperty -Name Preferences -Value @{} }

Convert Preferences to hashtable if needed

if ($existingJson.policies.Preferences -isnot [hashtable]) { $prefs = @{}; $existingJson.policies.Preferences.psobject.Properties | ForEach-Object { $prefs[$.Name] = $.$.Value }}; $existingJson.policies.Preferences = $prefs }

$prefObj = $existingJson.policies.Preferences $updated = $false

Ensure QUIC is disabled and locked

if (-not $prefObj.ContainsKey("network.http.http3.enable") -or $prefObj["network.http.http3.enable"].Value -ne $false -or $prefObj["network.http.http3.enable"].Status -ne "locked") {

$prefObj["network.http.http3.enable"] = @{ Value = $false Status = "locked" } $updated = $true

}

Ensure DNS over HTTPS is disabled and locked

If any updates were made, back up and write the new JSON

if ($updated) { New-Item -ItemType Directory -Path $distributionDir -Force | Out-Null if (Test-Path $destination) { Copy-Item $destination $backup -Force }

$jsonOut = $existingJson | ConvertTo-Json -Depth 10 -Compress $utf8NoBomEncoding = New-Object System.Text.UTF8Encoding($false)

Daily Entra.News

Get daily email updates

Get a concise summary of the latest Microsoft Entra updates delivered straight to your inbox.

Loading the secure signup form…