# The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled

The Microsoft 365 traffic forwarding profile routes Microsoft 365 traffic (Exchange Online, SharePoint Online, Teams) through Global Secure Access.

Source: https://maester.dev/docs/tests/MT.1187

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/crmhh" title="Christopher Brumm · Original author"><img src="https://github.com/crmhh.png" alt="Christopher Brumm" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/crmhh">Christopher Brumm</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Global Secure Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1187 -IncludePreview
```

## Overview

The Microsoft 365 traffic forwarding profile routes Microsoft 365 traffic (Exchange Online, SharePoint Online, Teams) through Global Secure Access. Enabling it is the lowest-risk entry point to Global Secure Access and is included with Microsoft Entra ID P1.

Enabling the Microsoft 365 profile unlocks:

* **Source IP restoration** for Microsoft 365 sign-in logs and Microsoft Entra ID Protection detections
* The **Compliant Network** signal in Conditional Access (token replay protection)
* **Universal Tenant Restrictions** to help prevent data exfiltration to other tenants
* **Network access traffic logs** (`NetworkAccessTraffic`) for security operations

#### Remediation action:

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a **Global Secure Access Administrator**.
2. Browse to **Global Secure Access** > **Connect** > **[Traffic forwarding](https://entra.microsoft.com/#view/Microsoft_Azure_Network_Access/TrafficForwarding.ReactView)**.
3. Enable the **Microsoft 365 traffic forwarding profile**.
4. Review and assign the profile to the users and groups that should be protected.

#### Related links

* [Entra admin center - Global Secure Access | Traffic forwarding](https://entra.microsoft.com/#view/Microsoft_Azure_Network_Access/TrafficForwarding.ReactView)
* [Global Secure Access traffic forwarding profiles](https://learn.microsoft.com/entra/global-secure-access/concept-traffic-forwarding)
* [Learn about the Microsoft 365 traffic forwarding profile](https://learn.microsoft.com/entra/global-secure-access/how-to-manage-microsoft-365-profile)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1187 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Global Secure Access |
| Area | Access control |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtGsaM365ProfileEnabled](https://github.com/maester365/maester/blob/main/tests/maester/global-secure-access/Test.MT.1187.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
| Lifecycle | Preview |

</details>

## Source

- Test: [`tests/maester/global-secure-access/Test.MT.1187.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/global-secure-access/Test.MT.1187.ps1)
- Documentation: [`tests/maester/global-secure-access/Test.MT.1187.md`](https://github.com/maester365/maester/blob/main/tests/maester/global-secure-access/Test.MT.1187.md)