The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled
MT.1187MediumEntra IDGlobal Secure AccessRuns with -IncludePreview
Part of Maester · Entra ID · Global Secure Access · All checks
Invoke-Maester -TestId MT.1187 -IncludePreviewOverview
Section titled “Overview”The Microsoft 365 traffic forwarding profile routes Microsoft 365 traffic (Exchange Online, SharePoint Online, Teams) through Global Secure Access. Enabling it is the lowest-risk entry point to Global Secure Access and is included with Microsoft Entra ID P1.
Enabling the Microsoft 365 profile unlocks:
- Source IP restoration for Microsoft 365 sign-in logs and Microsoft Entra ID Protection detections
- The Compliant Network signal in Conditional Access (token replay protection)
- Universal Tenant Restrictions to help prevent data exfiltration to other tenants
- Network access traffic logs (
NetworkAccessTraffic) for security operations
Remediation action:
Section titled “Remediation action:”- Sign in to the Microsoft Entra admin center as at least a Global Secure Access Administrator.
- Browse to Global Secure Access > Connect > Traffic forwarding.
- Enable the Microsoft 365 traffic forwarding profile.
- Review and assign the profile to the users and groups that should be protected.
Related links
Section titled “Related links”- Entra admin center - Global Secure Access | Traffic forwarding
- Global Secure Access traffic forwarding profiles
- Learn about the Microsoft 365 traffic forwarding profile
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | MT.1187 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Global Secure Access |
| Area | Access control |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtGsaM365ProfileEnabled |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
| Lifecycle | Preview |