Transport Layer Security
Doc updateThe TLS inspection documentation now explains how to configure either a Microsoft-managed certificate or your own certificate authority.
1 September 2026
MondayMon
TuesdayTue
WednesdayWed
ThursdayThu
FridayFri
SaturdaySat
SundaySun
2414
2514
26292714
2841
2912303122172
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
1
2
3
4
Month in brief
Global Secure Access documents preview workflow for Microsoft-managed TLS certificates
September’s substantive Global Secure Access work centered on TLS inspection certificate choices. A new guide documents a preview Microsoft-managed root CA path, while existing pages now separate that route from customer-provided PKI and carry the distinction into prompt-injection protection guidance. The remaining unrelated edit added consistent spacing to custom-header domain lists, with no administrator action indicated.
- New preview guide documents the Microsoft-managed root CA path
Global Secure Access · SecurityThe new Global Secure Access guide explains how to create a tenant-specific Microsoft-managed root CA, deploy its public certificate to client devices, and enable it for Microsoft Entra Internet Access TLS inspection. It states that the private key remains protected by Microsoft and identifies the capability as preview.
- TLS inspection guidance now separates the two certificate paths
Global Secure Access · FundamentalsThe TLS inspection fundamentals page now provides separate links for configuring inspection with a Microsoft-managed certificate and with an administrator’s own certificate, helping administrators select the applicable workflow.
- Bring-your-own-CA guidance details CSR, signing, and upload stepsGlobal Secure Access · Security
The own-certificate article now focuses on bringing your own certificate authority and covers certificate signing request creation, PKI signing, and certificate upload, while linking to the separate Microsoft-managed certificate guidance.
- Prompt-injection protection guidance names both TLS certificate optionsGlobal Secure Access · Security
The guidance for protecting enterprise generative AI apps now explains that TLS inspection can use either a Microsoft-managed certificate or an administrator-provided certificate before TLS inspection policies are configured.
For Entra administrators
Administrators choosing the Microsoft-managed certificate path must create the tenant-specific root CA and deploy its public certificate to client devices before enabling TLS inspection to avoid certificate errors; MDM solutions such as Intune can be used. Administrators using their own PKI can follow the clarified CSR, PKI-signing, and certificate-upload workflow, selecting the guide that matches their certificate choice.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
7 updates by product
Microsoft Entra Global Secure Access
7 updatesConfigure TLS inspection with a Microsoft-managed certificate
New featureAction requiredThe guide explains how to create a tenant-specific Microsoft-managed root CA, deploy its public certificate to client devices, and enable it for Microsoft Entra Internet Access TLS inspection. The capability is in preview, and the private key remains protected by Microsoft.
1 September 2026
The article now focuses on bringing your own certificate authority for TLS inspection, including CSR creation, PKI signing, and certificate upload. It also links to separate Microsoft-managed certificate guidance.
1 September 2026
The AI prompt injection protection documentation now explains that TLS inspection can use either a Microsoft-managed certificate or an administrator-provided certificate before configuring TLS inspection policies.
1 September 2026
The documentation now provides separate links for configuring TLS inspection with a Microsoft-managed certificate and with your own certificate.
1 September 2026
Configure Custom Headers
Doc updateConsistent spacing was added to domain lists for Claude, GitHub, Slack, Dropbox, and YouTube entries. Header names and descriptions are unchanged.
1 September 2026
Troubleshoot Transport Layer Security
Doc updateThe troubleshooting page now links to separate guides for Microsoft-managed certificates and customer-provided certificates, and its publication date was updated.
1 September 2026