MT.1187 - The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled
Overview
The Microsoft 365 traffic forwarding profile routes Microsoft 365 traffic (Exchange Online, SharePoint Online, Teams) through Global Secure Access. Enabling it is the lowest-risk entry point to Global Secure Access and is included with Microsoft Entra ID P1.
Enabling the Microsoft 365 profile unlocks:
- Source IP restoration for Microsoft 365 sign-in logs and Identity Protection detections
- The Compliant Network signal in Conditional Access (token replay protection)
- Universal Tenant Restrictions to help prevent data exfiltration to other tenants
- Network access traffic logs (
NetworkAccessTraffic) for security operations
Remediation action:
- Sign in to the Microsoft Entra admin center as at least a Global Secure Access Administrator.
- Browse to Global Secure Access > Connect > Traffic forwarding.
- Enable the Microsoft 365 traffic forwarding profile.
- Review and assign the profile to the users and groups that should be protected.
Related links
- Entra admin center - Global Secure Access | Traffic forwarding
- Global Secure Access traffic forwarding profiles
- Learn about the Microsoft 365 traffic forwarding profile
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1187 |
| Severity | Unknown |
| Suite | Maester |
| Category | Entra |
| PowerShell test | Test-MtGsaM365ProfileEnabled |
| Tags | Entra, Maester, MT.1187, Preview |
Source
- Pester test:
tests/Maester/GlobalSecureAccess/Test-MtGsaM365ProfileEnabled.Tests.ps1 - PowerShell source:
powershell/public/maester/globalsecureaccess/Test-MtGsaM365ProfileEnabled.ps1