Microsoft Global Secure Access is the umbrella name for Microsoft Entra Internet Access and Microsoft Entra Private Access. For Microsoft 365, the relevant component is the Microsoft traffic profile in Entra Internet Access. An administrator enables that profile, assigns it to users or groups, and deploys the Global Secure Access client or configures a remote-network connection. Supported Microsoft 365 traffic is then classified by Microsoft endpoint rules and either forwarded through Microsoft’s security service edge (SSE) or bypassed to the user’s ordinary network route, depending on each rule’s action.
What Microsoft Global Secure Access includes
Global Secure Access combines identity-aware access controls with network traffic forwarding in the Microsoft Entra administration experience. It is not a single tunnel that automatically captures everything on a device. Its two product areas serve different destinations:
As an Amazon Associate I earn from qualifying purchases.
- Microsoft Entra Internet Access provides controlled access to supported Microsoft services and, with the appropriate entitlement, general public-internet traffic.
- Microsoft Entra Private Access provides access to private corporate applications and networks.
The Microsoft 365 use case belongs to Entra Internet Access’s Microsoft traffic profile. That profile contains Microsoft-maintained destination data and forwarding rules for supported Microsoft 365 and Microsoft Entra ID services. Global Secure Access therefore adds a policy-controlled path for selected Microsoft traffic; it does not guarantee a performance improvement or replace every existing network design.
Free tools Windows power users keep installed
One-click scans. No signup required.
Available controls include universal tenant restrictions, compliant-network checks and source IP restoration. These controls are policy features, not automatic results of turning on the profile. They work only when the administrator deploys the relevant policies and validates their behavior.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
How Microsoft 365 traffic is classified
The Microsoft traffic profile uses Microsoft’s Microsoft 365 IP-address and fully qualified domain-name (FQDN) data as the basis for destination matching. A forwarding rule describes:
- the destination type and destination value;
- the protocol and ports;
- the traffic category or workload; and
- the action, normally Forward or Bypass.
Related endpoints are grouped into workloads so an administrator can manage them as units while still adjusting individual rules.
Exchange Online
Rules in this group match supported Exchange Online endpoints. Enabling the workload group makes its matching traffic eligible for the Microsoft traffic profile; individual rules can still be changed when a particular endpoint needs different treatment.
SharePoint Online and OneDrive
This group covers supported SharePoint Online and OneDrive destinations. Because file collaboration traffic can be substantial, confirm that the endpoints and action match the organization’s intended routing and inspection policy.
Microsoft Teams
Teams endpoints are managed as a workload group. Review the protocol and port conditions in the rule list rather than assuming that every Teams-related connection follows one identical path.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Microsoft 365 Common and Office Online
Common Microsoft 365 services and Office Online endpoints are grouped separately. These rules can affect sign-in, shared platform functions and browser-based Office workloads, so test representative user activities during a pilot.
What happens when a rule says Forward
When a matching rule’s action is Forward, the Global Secure Access client on the device—or a configured remote-network connection—acquires the traffic and sends it through Microsoft’s SSE. The Microsoft traffic profile must be enabled and assigned to the relevant users or groups. In a client deployment, the client must also be installed and functioning on the endpoint.
- The application opens a connection to a Microsoft 365 destination.
- The client or remote-network connector compares the destination, protocol, port and workload against the Microsoft traffic profile’s rules.
- If a matching rule is set to Forward, the connection is acquired by Global Secure Access.
- Global Secure Access sends the acquired traffic through Microsoft’s SSE, where the configured identity and network policies can be applied.
- The connection proceeds to the Microsoft service, subject to the service and policy response.
Forward applies only to traffic that matches an enabled, assigned rule. It is not a promise that every Microsoft-owned hostname is captured; coverage depends on Microsoft’s endpoint data, the rule state and the deployment method.
What happens when a rule says Bypass
Bypass has a precise consequence: matching traffic skips Global Secure Access acquisition and leaves through the client’s ordinary network route. It does not fall through to the separate Internet Access profile. This distinction matters when administrators expect a bypassed Microsoft 365 endpoint to be picked up by a general internet-forwarding policy; it will not be.
A bypass can be intentional—for example, when a service must use an existing local egress path—but it should be documented because it changes where inspection, source addressing and troubleshooting occur. Check both the Microsoft traffic rule and the endpoint’s normal routing when a bypassed connection behaves differently from forwarded traffic.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Profile evaluation order
Microsoft’s profile reference describes evaluation in this order:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Microsoft traffic profile — supported Microsoft services, including Microsoft 365.
- Private Access profile — private corporate resources.
- Internet Access profile — general public-internet destinations.
These profiles represent different traffic classes, not three successive fallbacks for the same endpoint. A Microsoft 365 destination that matches a Microsoft traffic rule is handled by that profile. A Microsoft traffic rule set to Bypass uses the ordinary network route; it is not reclassified into Internet Access.
Microsoft Entra authentication traffic is handled by a separate, system-managed profile. When another forwarding profile is active, the authentication profile is automatically active as well. Administrators do not assign it like a regular user traffic profile.
Deployment requirements
Profile assignment
An administrator must enable the Microsoft traffic profile and assign it to the intended users or groups. Assignment scope determines who is eligible for the policy; it does not install the client or configure a remote network by itself.
Endpoint client or remote network
For users working from managed devices, install the Global Secure Access client on each supported endpoint and ensure it can communicate with the service. For branch or datacenter traffic, associate a configured remote-network path instead. Use one approach deliberately for each user population, and avoid assuming that assigning a profile alone captures traffic.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Licensing
Microsoft documents Microsoft Entra ID P1 or P2 as a prerequisite for the Microsoft traffic profile. Broader Internet Access capabilities require an Entra Internet Access or Microsoft Entra Suite entitlement in addition to Entra ID P1 or P2. Licensing and packaging can change, so confirm the tenant’s current entitlements and commercial terms with Microsoft before rollout.
A practical pilot sequence
A controlled pilot limits the chance that a routing or policy error affects the whole organization.
- Define the use case. Decide which Microsoft 365 workloads should be forwarded, which (if any) should bypass, and whether the pilot concerns roaming users, office users, remote networks or all three.
- Create a pilot group. Select representative users and devices, including the applications and network locations that matter to production.
- Enable the Microsoft traffic profile. Turn on the profile in the Microsoft Entra administration experience and review the preconfigured workload groups and individual rules.
- Assign only the pilot group. Keep the initial scope narrow enough to revert quickly.
- Deploy the client or configure the remote-network connection. Verify that the chosen path is active on every pilot endpoint or network segment.
- Review Advanced Diagnostics. Confirm that Microsoft Entra and Microsoft 365 rules are present and that the expected workload groups are available to the client.
- Exercise real workloads. Test Exchange Online, SharePoint or OneDrive, Teams and Office Online activities used by the pilot. Include sign-in, file access, meetings and browser sessions where applicable.
- Check sign-in logs. Verify that connections and policy decisions appear as expected, and investigate failures before expanding the assignment.
- Validate optional controls. If using compliant-network checks, universal tenant restrictions or source IP restoration, test both the allowed and denied paths and confirm that the result matches the policy design.
- Expand in stages. Increase group or network scope only after diagnostics, logs and user tests agree with the intended routing.
Why routing design matters for Microsoft 365
Microsoft’s Microsoft 365 connectivity guidance emphasizes minimizing round-trip time into Microsoft’s network. In most designs, users should reach a nearby Microsoft 365 service entry point rather than send traffic back through a distant central egress. Global Secure Access adds a Microsoft-specific controlled path and policy layer that can be useful when identity and network controls need to travel with the user.
Do not treat the service as a universal performance accelerator. The available documentation does not provide a dated benchmark or independent statistic proving an improvement for every customer. Results depend on the user’s location, the existing route, the selected workload rules, the SSE path and the rest of the tenant’s configuration. Measure the pilot’s actual experience instead of assuming that forwarding is faster than direct connectivity.
Recommended Free Tools
Comparing a Microsoft traffic-profile design with a conventional path
Use the following dimensions when deciding whether to change an existing direct or centrally proxied Microsoft 365 design:
| Decision area | Questions to answer |
|---|---|
| Endpoint and workload coverage | Which Exchange Online, SharePoint/OneDrive, Teams, Common and Office Online endpoints are matched, and which remain outside the profile? |
| Egress and latency | Does the path move users toward a nearby Microsoft service entry point, or does it still hairpin through a distant central location? |
| Identity-aware controls | Are universal tenant restrictions, compliant-network checks or source IP restoration required, and have they been tested? |
| Assignment scope | Which users, groups, devices or remote networks receive the profile, and how quickly can the scope be rolled back? |
| Operational visibility | Can administrators confirm rules in Advanced Diagnostics and correlate behavior with sign-in logs? |
| Licensing | Does the tenant have Entra ID P1 or P2 for the Microsoft traffic profile, and are additional Internet Access capabilities licensed? |
This comparison avoids a false either-or choice. Some organizations may retain direct or bypassed routes for selected destinations while forwarding other Microsoft workloads through Global Secure Access.
Common failure modes and fixes
Traffic is not being acquired
- Confirm that the Microsoft traffic profile is enabled and assigned to the affected user or group.
- On client deployments, verify that the Global Secure Access client is installed, running and associated with the expected tenant.
- Use Advanced Diagnostics to check that the relevant Microsoft 365 rules are present.
A bypassed endpoint is not using Internet Access
This is expected behavior. A Bypass action sends the connection over the client’s normal route and does not hand it to the Internet Access profile. Check the local network path, proxy and firewall instead.
Only some Microsoft 365 functions fail
Review workload groups and individual rule conditions, including destination, protocol and port. A service can use multiple endpoints, and one endpoint may be disabled, bypassed or outside the currently maintained Microsoft destination data.
Policy controls produce unexpected results
Check whether the compliant-network check, tenant restriction or source IP restoration policy was actually deployed to the pilot scope. Test an allowed and a denied case, then compare the result with sign-in logs before changing the forwarding rules.
Performance is worse after forwarding
Compare the pilot path with the previous route from the same locations and times. Look for central hairpinning, an unsuitable egress location or a workload that should remain direct or bypassed. The profile itself does not establish a universal latency outcome.
Key points for administrators
- Global Secure Access is Microsoft’s shared name for Entra Internet Access and Entra Private Access.
- The Microsoft 365 routing feature is the Microsoft traffic profile in Entra Internet Access.
- Forward sends matching supported traffic through Microsoft’s SSE; Bypass skips acquisition and uses the ordinary network route.
- Profile assignment plus a functioning client or configured remote-network path is required for deployment.
- Microsoft endpoint IP and FQDN rules are organized by workload and can be enabled, disabled or adjusted.
- Validate diagnostics, sign-in behavior and any optional identity or network controls with a limited pilot.
The Bottom Line
Microsoft Global Secure Access routes Microsoft 365 through policy-defined Microsoft traffic-profile rules. Forwarded matches use the Global Secure Access client or a remote-network connection to reach Microsoft’s SSE; bypassed matches leave through the normal network path and are not redirected to Internet Access. Correct results depend on profile assignment, endpoint deployment, workload rules, licensing and validation in the actual network.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
