Question

Contoso is retiring its legacy VPN and adopting Microsoft Entra Global Secure Access. Users must reach an on-premises HR web application at hr.corp.contoso.local over TCP 443, but the application should never be published to the public internet. You have deployed Private Access connectors on-premises. What must you configure so that users' traffic to this specific internal application is tunneled through the Global Secure Access client and reaches the on-premises server?

Accepted Answer

Create a Quick Access or an Enterprise Application (per-app access) in Private Access that defines the FQDN/IP and port 443 as an application segment served by the connector group

Answer

Enable the Internet Access forwarding profile and add hr.corp.contoso.local to the custom bypass list

Answer

Configure a Conditional Access policy with the Global Secure Access signal as the only required grant control

Answer

Publish the application through Microsoft Entra application proxy with pre-authentication set to passthrough