Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Microsoft Global Secure Access (GSA) is the shared name for Microsoft Entra Internet Access and Microsoft Entra Private Access. To control Microsoft 365 connections, an administrator uses the Microsoft traffic profile in Entra Internet Access, assigns that profile to users or groups, and deploys the Global Secure Access client or configures a remote-network connection. Matching Microsoft 365 traffic is then acquired and sent to Microsoft’s security service edge (SSE), while rules marked Bypass leave through the device’s ordinary network path.
The important distinction is between the umbrella service and the routing feature: GSA itself does not automatically capture every Microsoft 365 packet. The Microsoft traffic profile, its workload rules, the assignment scope, and the client or remote-network deployment determine what is forwarded, what is bypassed, and which identity-aware controls can be applied.
What Microsoft Global Secure Access includes
Global Secure Access is Microsoft’s umbrella for two Entra networking services:
- Microsoft Entra Internet Access provides controlled access to supported public destinations, including Microsoft services covered by the Microsoft traffic profile.
- Microsoft Entra Private Access provides identity-aware access to private corporate applications and networks.
For a Microsoft 365 routing project, the relevant component is the Microsoft traffic profile within Entra Internet Access. It is a policy-driven forwarding profile, not a generic replacement for every proxy, firewall, VPN, or secure web gateway. The profile uses Microsoft-maintained endpoint data and administrator-selected actions to decide how supported Microsoft traffic is handled.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
GSA combines network forwarding with Microsoft Entra identity controls. Depending on the policies you configure, the design can support universal tenant restrictions, compliant-network checks, and source IP restoration. Those capabilities are available functions, not automatic results of turning on the service; each requires an appropriate policy, assignment, and validation.
How the Microsoft traffic profile classifies Microsoft 365 traffic
The profile starts with Microsoft’s Microsoft 365 IP-address and fully qualified domain name (FQDN) data. Forwarding rules describe a destination type and destination, protocol and ports, traffic category, and an action. Microsoft groups related destinations into workload collections so an administrator can manage them by service:
| Workload group | Typical services covered | Administrative control |
|---|---|---|
| Exchange Online | Exchange Online mail and related endpoints | Enable or disable the workload group and adjust individual rules |
| SharePoint Online and OneDrive | SharePoint Online sites and OneDrive storage | Enable or disable the workload group and adjust individual rules |
| Teams | Microsoft Teams service endpoints | Enable or disable the workload group and adjust individual rules |
| Microsoft 365 Common and Office Online | Shared Microsoft 365 services and Office web applications | Enable or disable the workload group and adjust individual rules |
Because the endpoint inventory is maintained as Microsoft 365 IP and FQDN data, administrators do not have to build an endpoint list from scratch. They still need to review the resulting rules, because enabling a workload group affects every matching destination in the group and a rule can be changed from forwarding to bypass.
Recommended Free Tools
What happens when a rule is set to Forward
With Forward, the Global Secure Access client on the device, or an associated remote-network connection, acquires traffic that matches the Microsoft traffic profile. The acquired connection is sent through Microsoft’s SSE, where the configured identity and network policies can be evaluated before the traffic reaches the Microsoft service.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Forwarding only occurs when all deployment conditions are met:
- The Microsoft traffic profile is enabled.
- The profile is assigned to the user or group whose traffic is being tested.
- For endpoint-based deployment, the Global Secure Access client is installed and operating on the device.
- For a remote-network design, the network connection is configured and associated with the profile.
- The destination, protocol, port, and category match an enabled forwarding rule.
The profile handles supported Microsoft service traffic directly. That traffic is not first acquired by the general Internet Access profile. This separation matters when troubleshooting: a Microsoft 365 connection that does not match an enabled Microsoft traffic rule will not automatically be rescued by a broader Internet Access rule.
What happens when a rule is set to Bypass
Bypass means the matching traffic skips Global Secure Access acquisition and exits over the client’s normal network route. It may use the local network, an existing proxy, a security appliance, or another ordinary egress path, depending on the device and network configuration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Bypassed Microsoft traffic does not fall through to the Internet Access profile. This is a common design surprise: changing a Microsoft workload rule to Bypass does not hand that workload to the general Internet Access policy. It removes the workload from GSA acquisition altogether. Document the intended egress and security inspection path before using Bypass, especially for remote users and unmanaged networks.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
How profile evaluation is ordered
Microsoft documents profile evaluation in this order:
- Microsoft traffic profile: supported Microsoft services, including Microsoft 365 and applicable Microsoft Entra ID traffic.
- Private Access profile: private corporate applications and resources.
- Internet Access profile: general public internet destinations.
These profiles represent different traffic classes rather than three competing versions of the same route. A Microsoft 365 endpoint that matches the Microsoft traffic profile is evaluated there first. A private application is handled by Private Access, and a general public website is considered by Internet Access.
Microsoft Entra authentication traffic is a separate, system-managed profile. It becomes active automatically with another forwarding profile and is not assigned like a normal administrator-created traffic profile. Do not treat it as an additional workload group to configure.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Deployment: a practical pilot sequence
A controlled pilot reduces the risk of changing traffic for an entire workforce at once. Use a small group that represents the device types, locations, and sign-in patterns you expect in production.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
- Define the use case and pilot boundary. Decide which Microsoft 365 workloads should be forwarded, which should remain on the ordinary route, and whether the pilot uses endpoint clients, a remote network, or both. Record the pilot users or group and the expected egress behavior.
- Confirm licensing and tenant readiness. Microsoft documents Microsoft Entra ID P1 or P2 as a prerequisite for the Microsoft traffic profile. Broader Internet Access capabilities require Microsoft Entra Internet Access or Microsoft Entra Suite in addition to Entra ID P1 or P2. Licensing packages can change, so verify the current entitlement and commercial terms in your tenant before deployment.
- Enable the Microsoft traffic profile. Turn on the profile in the Microsoft Entra administration experience, then review the available workload groups and forwarding rules before assigning users.
- Set workload actions. Keep a workload or individual rule on Forward when it should traverse Microsoft’s SSE. Set Bypass only when the organization deliberately wants the device’s ordinary network route. Capture the rationale for exceptions so later administrators know why a rule differs from the default.
- Assign the profile to pilot users or groups. Assignment controls who receives the policy. A correctly configured rule has no effect on a user outside its assignment scope.
- Deploy the Global Secure Access client where required. Install and start the client on pilot devices for endpoint-based acquisition. If the design uses a remote network, configure and associate that connection instead of relying on a client that is not present.
- Test each workload from representative locations. Sign in to Exchange Online, SharePoint or OneDrive, Teams, and Office Online as applicable. Test both a forwarded destination and an intentional bypass so the observed route matches the policy design.
- Inspect diagnostics and sign-in records. Use Advanced Diagnostics to confirm that Microsoft Entra and Microsoft 365 rules are present on the device. Review sign-in logs to verify that the expected connections and users are being recorded.
- Expand gradually. Correct rule, assignment, or client issues in the pilot before adding more users, locations, or workload groups.
Identity-aware controls you can layer onto routing
Universal tenant restrictions
Tenant restrictions can limit which Microsoft Entra tenants users reach from the environment. This is useful when an organization wants to reduce access to unsanctioned tenants, but it must be designed around legitimate guest, partner, and multi-tenant workflows. Forwarding traffic through GSA does not by itself impose tenant restrictions; the relevant policy must be configured and tested.
Compliant-network checks
A compliant-network check can make access conditional on traffic arriving through an approved network path. Use it only when the intended user, device, and network assignments are clear. Test failure behavior as well as success behavior so users receive the expected access result when they are off the approved path.
Source IP restoration
Source IP restoration can preserve the originating client address for supported policy and auditing scenarios after traffic passes through the SSE. Confirm which services and controls in your design depend on the restored address; do not assume every downstream system will see or honor it without validation.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minutePerformance and egress design
Microsoft’s Microsoft 365 connectivity guidance emphasizes minimizing round-trip time into Microsoft’s network. In most environments, users should reach a nearby Microsoft 365 service entry point rather than hairpinning through a distant central egress. A GSA design adds a Microsoft-specific controlled path and policy layer, which can simplify governance when the SSE is well positioned relative to users and Microsoft services.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
There is no universal performance guarantee. The reviewed Microsoft material does not provide a dated benchmark or independent statistic showing that GSA improves speed for every customer. Results depend on the user’s location, local access network, existing proxy or firewall path, SSE entry point, workload, and rule configuration. Measure latency and user experience in your own pilot rather than assuming that forwarding is faster than direct connectivity.
Comparing routing approaches
| Decision axis | Microsoft traffic profile with GSA | Direct Microsoft 365 egress | Central proxy or backhaul |
|---|---|---|---|
| Endpoint and workload coverage | Microsoft-maintained IP/FQDN rules grouped by Microsoft workload; administrators choose Forward or Bypass | Device uses its normal route without GSA acquisition | Coverage depends on proxy policies and endpoint lists maintained by the organization |
| Egress location | Traffic is acquired by the client or remote network and sent through Microsoft’s SSE when forwarded | Usually exits locally or through the device’s configured network path | Often exits through a central gateway, which may create a longer path |
| Identity-aware controls | Can support tenant restrictions, compliant-network checks, and source IP restoration when separately configured | Depends on other identity and network controls | Depends on proxy, firewall, and identity integrations |
| Assignment scope | User and group assignment, plus client or remote-network deployment | Network and device configuration | Usually network segment, device, or proxy policy scope |
| Operational validation | Advanced Diagnostics and Entra sign-in logs provide checks for rules and connections | Uses existing network and service monitoring | Uses proxy and network monitoring systems |
| Licensing | Microsoft Entra ID P1 or P2 for the Microsoft traffic profile; broader Internet Access packaging adds a separate entitlement | No GSA licensing requirement | Cost and licensing depend on the proxy and security platform |
The right comparison is therefore architectural, not just a question of whether traffic is “secure.” Evaluate workload coverage, local versus central egress, identity controls, assignment boundaries, diagnostics, and licensing together.
Troubleshooting common routing surprises
A user’s Microsoft 365 traffic is not forwarded
- Check that the Microsoft traffic profile is enabled and assigned to the user or group.
- Confirm the Global Secure Access client is installed, running, and enrolled on the device, or verify the remote-network association.
- Use Advanced Diagnostics to see whether the expected Microsoft 365 rules are present.
- Check the destination, protocol, port, and workload rule; an endpoint outside the supported Microsoft data or a disabled workload group will not match.
Traffic takes the ordinary route unexpectedly
Inspect the matching action. A Bypass rule intentionally skips acquisition and does not continue to Internet Access. Also check whether a more specific rule or an assignment boundary excludes the user.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchSign-ins or policy results differ between users
Compare group membership, client installation state, device posture, and network location. Conditional Access, compliant-network checks, or tenant restrictions can produce different outcomes even when two users reach the same Microsoft 365 workload.
Performance is worse after forwarding
Compare the pilot path with the previous route from the same location and device. Check round-trip time to Microsoft’s network, local congestion, proxy chaining, and the selected egress path. If the controlled path is not appropriate for a particular workload or location, a narrowly scoped Bypass rule may be considered and then validated, rather than disabling the entire profile.
Quick Recap
What to document before production rollout
- The Microsoft 365 workload groups and individual exceptions that are forwarded or bypassed.
- Which users, groups, devices, and remote networks receive the profile.
- Where the Global Secure Access client is installed and how its health is monitored.
- Expected egress behavior for each user location, including remote and branch users.
- Whether tenant restrictions, compliant-network checks, or source IP restoration are enabled, and the policy that justifies each one.
- The diagnostic and sign-in-log checks used to approve expansion beyond the pilot.
- The tenant licenses and commercial terms that support the deployed features, reviewed against Microsoft’s current offerings.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
