MT.1187: The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled.
| ID | MT.1187 |
| Severity | Medium |
| Suite | Mito |
| Product | Entra ID |
| Feature | Global Secure Access |
| Security area | Access control |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Reads from | Microsoft Graph |
| Licence needed | AAD_PREMIUM |
| Lifecycle | Preview |
What this checks and how to fix it
Section titled “What this checks and how to fix it”The Microsoft 365 traffic forwarding profile routes Microsoft 365 traffic (Exchange Online, SharePoint Online, Teams) through Global Secure Access. Enabling it is the lowest-risk entry point to Global Secure Access and is included with Microsoft Entra ID P1.
Enabling the Microsoft 365 profile unlocks:
- Source IP restoration for Microsoft 365 sign-in logs and Microsoft Entra ID Protection detections
- The Compliant Network signal in Conditional Access (token replay protection)
- Universal Tenant Restrictions to help prevent data exfiltration to other tenants
- Network access traffic logs (
NetworkAccessTraffic) for security operations
Remediation action:
Section titled “Remediation action:”- Sign in to the Microsoft Entra admin center as at least a Global Secure Access Administrator.
- Browse to Global Secure Access > Connect > Traffic forwarding.
- Enable the Microsoft 365 traffic forwarding profile.
- Review and assign the profile to the users and groups that should be protected.
Related links
Section titled “Related links”- Entra admin center - Global Secure Access | Traffic forwarding
- Global Secure Access traffic forwarding profiles
- Learn about the Microsoft 365 traffic forwarding profile
Mito check. Author: crmhh. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.