Skip to main content
Version: 2.1.1-preview

MT.1187 - The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled

Overview

The Microsoft 365 traffic forwarding profile routes Microsoft 365 traffic (Exchange Online, SharePoint Online, Teams) through Global Secure Access. Enabling it is the lowest-risk entry point to Global Secure Access and is included with Microsoft Entra ID P1.

Enabling the Microsoft 365 profile unlocks:

  • Source IP restoration for Microsoft 365 sign-in logs and Identity Protection detections
  • The Compliant Network signal in Conditional Access (token replay protection)
  • Universal Tenant Restrictions to help prevent data exfiltration to other tenants
  • Network access traffic logs (NetworkAccessTraffic) for security operations

Remediation action:

  1. Sign in to the Microsoft Entra admin center as at least a Global Secure Access Administrator.
  2. Browse to Global Secure Access > Connect > Traffic forwarding.
  3. Enable the Microsoft 365 traffic forwarding profile.
  4. Review and assign the profile to the users and groups that should be protected.

Test Metadata

FieldValue
Test IDMT.1187
SeverityUnknown
SuiteMaester
CategoryEntra
PowerShell testTest-MtGsaM365ProfileEnabled
TagsEntra, Maester, MT.1187, Preview

Source

  • Pester test: tests/Maester/GlobalSecureAccess/Test-MtGsaM365ProfileEnabled.Tests.ps1
  • PowerShell source: powershell/public/maester/globalsecureaccess/Test-MtGsaM365ProfileEnabled.ps1