TLS Inspection in Microsoft Entra Internet Access Deep Dive

Key Concepts

TLS inspection, Entra Internet Access, Global Secure Access (GSA) client, certificate authority (CA), public key infrastructure (PKI), certificate signing request (CSR), web content filtering, conditional access policy, certificate pinning, data loss prevention (DLP), threat protection, fully qualified domain name (FQDN), destination URL.

TLS Inspection with Entra Internet Access: A Deep Dive

The Challenge of Encrypted Traffic

The video begins by highlighting the importance of inspecting internet traffic for security purposes, such as protecting users from malicious websites and preventing unwanted behavior on the network. However, the widespread use of TLS encryption poses a significant challenge.

• TLS Encryption: Most web traffic is encrypted using TLS (HTTPS), which secures communication between the client and the destination website.
• Limited Visibility: Without TLS inspection, network monitoring tools can only see the fully qualified domain name (FQDN) of the website (e.g., www.msn.com), but not the specific path or content being accessed. This limits the granularity of traffic filtering and prevents the implementation of advanced security measures like DLP and threat protection.
• Example: While you can see a user is visiting www.msn.com, you can't determine if they are accessing the "news," "gaming," or "social" sections, hindering precise policy enforcement.

TLS Inspection Explained

TLS inspection involves placing a component (in this case, Entra Internet Access) between the client and the destination to decrypt, inspect, and re-encrypt the traffic.

• Entra as an Intermediary: The Global Secure Access (GSA) client on the user's device is configured to send internet traffic to the Entra edge for inspection.
• Certificate Generation: Entra generates a certificate for the destination website (e.g., msn.com) using an intermediary CA certificate that is trusted by the organization's clients.
• Decryption and Inspection: Entra uses the generated certificate to decrypt the traffic, inspect the content, and apply security policies.
• Re-encryption: After inspection, Entra re-encrypts the traffic using the destination website's actual certificate before forwarding it.
• Exclusions: Traffic to specific categories like health, medicine, finance, government, and education is not decrypted for privacy reasons.

Setting Up TLS Inspection: A Step-by-Step Guide

The video provides a detailed walkthrough of the TLS inspection setup process:

1. Generating the Certificate Signing Request (CSR):
   • In Entra Internet Access, navigate to GSA secure TLS inspection policies and TLS inspection settings.
   • Create a new certificate, providing a certificate name (<= 12 characters) and your organization's name.
   • Entra generates a CSR file containing the public key. The corresponding private key is securely stored in a key vault.
2. Signing the CSR with Your Organization's CA:
   • Use your organization's internal certificate authority (e.g., Active Directory Certificate Services) to sign the CSR.
   • Submit an advanced certificate request, pasting the content of the CSR file (excluding "BEGIN" and "END" lines).
   • Set the certificate template to "Subordinate Certification Authority."
   • Download the signed certificate in Base64 format and rename it to .pem.
   • Download the CA certificate chain in Base64 format and rename it to .pem.
3. Uploading the Signed Certificate to Entra:
   • In Entra Internet Access, upload the two .pem files (signed certificate and CA certificate chain).
   • Entra verifies the certificate chain, ensuring it's signed by a trusted root CA.
4. Creating a TLS Inspection Policy:
   • Create a new TLS inspection policy in Entra Internet Access.
   • Define the action: "Inspect" (currently, all traffic is inspected, but future updates will allow for more granular control based on categories and FQDNs).
5. Handling Certificate Pinning:
   • Certificate pinning, where applications hardcode expected certificates, can cause issues.
   • Entra automatically excludes well-known pinning sites (e.g., Intune).
   • For other sites using certificate pinning, manually exclude the traffic using internet access profiles and policies.
6. Configuring Web Content Filtering:
   • Create web content filtering policies based on FQDNs and categories (now enhanced with full path URL support).
   • Example: A policy to block gaming websites.
7. Creating a Security Profile:
   • Create a security profile that links the TLS inspection policy and web content filtering policies.
8. Applying the Security Profile with Conditional Access:
   • Use a conditional access policy to apply the security profile to specific users or groups accessing internet resources via Global Secure Access.
   • Example: A conditional access policy that applies the security profile to the user "John" for all internet resources.

Demonstration and Verification

The video demonstrates the setup by:

• Accessing msn.com and verifying that the certificate is issued by "Microsoft GSA Intermediate CA2," confirming that Entra is intercepting and re-issuing certificates.
• Attempting to access a gaming website, which is blocked by the web content filtering policy.
• Examining traffic logs in Entra Internet Access to see the full destination URL, TLS policy names, status, and actions taken (intercepted or allowed).

Visibility and Reporting

• Traffic Logs: Entra provides detailed traffic logs, including the destination URL, TLS policy names, status, and actions taken.
• Full URL Visibility: The ability to see the full URL allows for more granular traffic analysis and policy enforcement.

The Importance of TLS Inspection

• Closing the Visibility Gap: TLS inspection addresses the challenge of encrypted traffic, enabling organizations to inspect the content of HTTPS connections.
• Enabling Advanced Security Features: It unlocks the potential for advanced security features like DLP and threat protection.
• Third-Party Integration: TLS inspection allows for integration with third-party security solutions from the marketplace, such as DLP and advanced threat protection tools.

Notable Quotes

• "The whole point of TLS is even if you send me the traffic, I have no way of cracking that open. That's fundamental to the point of TLS."
• "This ability to see the full URL and then inspect the actual payload of the traffic opens up a massive number of opportunities."

Technical Terms Explained

• TLS Inspection: The process of decrypting, inspecting, and re-encrypting TLS-encrypted traffic.
• Entra Internet Access: A Microsoft service that provides secure internet access with features like TLS inspection and web content filtering.
• Global Secure Access (GSA) Client: A client application installed on user devices that routes internet traffic to Entra Internet Access.
• Certificate Authority (CA): An entity that issues digital certificates.
• Public Key Infrastructure (PKI): A system for managing digital certificates and public keys.
• Certificate Signing Request (CSR): A request to a certificate authority to sign a digital certificate.
• Web Content Filtering: The process of blocking or allowing access to websites based on their content or category.
• Conditional Access Policy: A policy that controls access to resources based on certain conditions.
• Certificate Pinning: A security mechanism where an application hardcodes the expected certificate for a specific website.
• Data Loss Prevention (DLP): A set of technologies and processes used to prevent sensitive data from leaving an organization.
• Threat Protection: Security measures designed to protect against malware, phishing, and other online threats.
• Fully Qualified Domain Name (FQDN): The complete domain name for a specific host or resource on the internet (e.g., www.example.com).
• Destination URL: The full web address, including the path and any query parameters (e.g., www.example.com/path?query=value).

Logical Connections

The video logically connects the problem of encrypted traffic with the solution of TLS inspection. It then provides a step-by-step guide on how to set up TLS inspection using Entra Internet Access, demonstrating the process and highlighting the benefits. The video also explains how TLS inspection integrates with other security features like web content filtering and conditional access.

Synthesis/Conclusion

TLS inspection with Entra Internet Access is a crucial capability for organizations seeking to secure their networks and protect their users in an increasingly encrypted world. By acting as a trusted intermediary, Entra can decrypt, inspect, and re-encrypt traffic, enabling granular policy enforcement, advanced threat protection, and integration with third-party security solutions. The detailed setup process and demonstration provided in the video offer valuable insights for IT professionals looking to implement this essential security measure.