Question

Your organization has deployed Global Secure Access and enrolled all corporate Windows devices with the Global Secure Access client configured to route Microsoft 365 traffic. The security team wants to ensure that users can only access Exchange Online and SharePoint Online when their traffic is verifiably passing through the Global Secure Access service, without depending on IP address ranges that change frequently or can be spoofed by VPNs. What should you configure to enforce this requirement?

Accepted Answer

Enable the Compliant Network check in the Global Secure Access session management settings and require a compliant network in a Conditional Access policy

Answer

Create a trusted named location containing the Global Secure Access egress IP ranges and require it in a Conditional Access policy

Answer

Configure a device compliance grant control in Conditional Access and mark all enrolled devices as compliant

Answer

Create an authentication context and bind it to the Microsoft 365 traffic forwarding profile