跳到主要内容

Enable and Configure Explicit Forward Proxy

Implementation Effort: Medium

User Impact: Medium

Overview​

In a Zero Trust model, all internet traffic should be authenticated, authorized, and inspected regardless of the device or platform it originates from—but installing an endpoint client isn't always possible. Explicit Forward Proxy is a traffic acquisition mechanism for Global Secure Access that protects browser-based internet traffic in scenarios where the Global Secure Access client is difficult or impossible to deploy, such as multi-session virtual desktop infrastructure (VDI), kiosks, browsers on Linux desktops, lightly managed devices, and bring-your-own devices using Microsoft Edge with Intune app policies.

Explicit Forward Proxy uses proxy automatic configuration (PAC) files to point browsers at Microsoft Entra Internet Access, and the HTTP CONNECT protocol to broker the connection. It leverages Microsoft Entra ID and Conditional Access to authenticate and authorize each user before applying Microsoft Entra Internet Access security policies to the request. All processed traffic is TLS terminated so it can be inspected, extending consistent Zero Trust enforcement to clientless and unmanaged endpoints.

Enabling and configuring Explicit Forward Proxy follows these key steps. See the linked documentation for detailed implementation instructions.

  1. Enable Explicit Forward Proxy — Turn on Explicit Forward Proxy in the Microsoft Entra admin center. Smart session management is enabled by default and relies on Explicit Forward Proxy PAC file hosting to assign each user a unique proxy address so user-specific security profiles can be applied.
  2. Configure PAC file hosting — Configure browsers to retrieve the proxy configuration at startup, using either Microsoft-hosted tenant-specific PAC file URLs (required for smart session management features) or self-hosted PAC files when you need to customize contents or exclude destinations from TLS termination.
  3. Configure session management — Rely on smart session management and, optionally, header-based session affinity (sending the user's private IP in an HTTP header) to maintain user-specific enforcement. If neither is available, Explicit Forward Proxy falls back to source IP affinity and applies only the baseline profile.
  4. Configure Conditional Access — Because session affinity anchors on IP address, create a Conditional Access policy that restricts Explicit Forward Proxy use to trusted company networks and enforces access through Explicit Forward Proxy as the network channel.

Reference​