Microsoft Entra Internet Access: Web Filtering Without a Proxy Appliance, Licensing, and Setup

Microsoft's Global Secure Access overview (15 April 2026) states that Entra Internet Access is included in the Microsoft Entra Suite and sold standalone, that the Microsoft traffic profile is included in Entra ID P1 and P2, and that users need an Entra ID P1 or P2 license to use Internet Access or Private Access.

All prices are Microsoft list price, October 2026 price list, US commercial. The Microsoft traffic profile, which carries Microsoft 365 traffic and enables the compliant network check, costs nothing beyond the P1 that Business Premium, E3 and E5 include.

Web filtering is the core feature. Microsoft's concept page describes filtering on web categories, URLs and FQDNs, enforced at Microsoft's edge; for HTTP it reads the URL, and for HTTPS it reads the server name in the TLS handshake unless TLS inspection is on. The categories are grouped as liability, high bandwidth, business use, productivity loss and general surfing, about 80 in all.

• A web filtering policy holds rules. In the V2 model Microsoft documents as of 17 September 2026, each rule carries a destination (category or URL) and an action, allow or block, and the policy has a default action for unmatched traffic. Rules can be scoped to user or AI-agent traffic, and to HTTP methods when TLS inspection is on.
• A security profile groups policies: the web filtering policy, and optionally threat intelligence, TLS inspection and file-content policies.
• Conditional Access delivers the profile. You link it to a Conditional Access policy that targets users or groups, so finance and the warehouse get different rules from the engine that already guards Exchange Online.
• The baseline profile applies to everyone. Microsoft states it runs at the lowest priority on all Internet Access traffic without any Conditional Access policy, so it is where the threat intelligence block and the liability categories go.

Microsoft notes that the URL filtering preview supports up to 1,000 URLs per tenant and that *.contoso.com matches subdomains but not the root domain.

Universal Conditional Access puts a policy on the Internet Access and Microsoft traffic tunnels themselves: require a compliant device, require MFA, or block at high sign-in risk before any web traffic flows. Microsoft's caution: if a policy blocks the Internet Access tunnel on non-compliant devices, the device cannot reach Intune to become compliant again, so the Intune endpoints go on the custom bypass list of the Internet Access profile.

The compliant network check works the other way round. Once the client is on every managed device and the Microsoft traffic profile is enabled, a named location called All Compliant Network locations appears in Conditional Access, and a policy can block Microsoft 365 from every location except it. Microsoft's page (3 April 2026) explains why: a session token stolen from a device and replayed from a machine outside your tenant's compliant network is denied at sign-in, and applications that support continuous access evaluation reject the replay in near real time. Without that control a stolen access token stays valid for its lifetime, 60 to 90 minutes by default. The sign-in log patterns that reveal such replays are in stolen refresh tokens in Microsoft 365, and the policy set to build around is in Conditional Access policies every business should have.

Microsoft's concept page notes that similar category filtering exists in Defender for Endpoint and Azure Firewall, and positions Internet Access on identity-aware policy, cloud-edge enforcement and TLS inspection. On Business Premium, Defender for Business already blocks categories by device group. Buy Internet Access when you need rules per user or group, conditions on device state and risk, TLS inspection, threat intelligence filtering, or the compliant network check extended to every SaaS application; a DNS filter remains a reasonable control for guest Wi-Fi and printers that run no client.

Microsoft's install guides set the floor:

• Windows: a 64-bit build of Windows 10 (LTSC 2021 or later) or Windows 11, with a separate Arm64 installer; the device must be Entra joined, hybrid joined or Entra registered, and a registered device supports only Private Access traffic, so Internet Access needs a joined device. Windows 365 and single-session Azure Virtual Desktop are supported; multi-session is not. The client deploys through Intune as a Win32 app.
• macOS 14 or later on Intel or Apple silicon, registered through the Company Portal app.
• iOS 16 and Android 11 or later, where the client ships inside the Microsoft Defender for Endpoint app; device compliance on phones requires Intune enrollment.
• No Linux client, and no Windows Server as a client.

Microsoft's web filtering prerequisites are the ones that cause tickets: secure DNS off, the built-in DNS clients in Edge and Chrome disabled, IPv4 preferred because IPv6 is not acquired, and QUIC blocked with a Windows Firewall rule on outbound UDP 443 so browsers fall back to TCP. Each is an Intune setting; ship them with the client. The Private Access side, with its connectors and app segments, is covered in Entra Private Access vs a VPN.

1. Week 1: confirm Entra ID P1 on every user (P1 versus P2 explains what each carries) and exclude the break-glass accounts from every policy that follows.
2. Week 1: deploy the client through Intune to a ten-device pilot with the DNS, IPv6 and QUIC settings, with the Microsoft traffic profile only.
3. Week 2: turn on Conditional Access signaling, create the compliant network policy for Microsoft 365 in report-only mode, and read the sign-in log for a week.
4. Week 3: license the pilot group for Internet Access, enable the Internet Access profile, and add the custom bypasses: Intune endpoints, any remaining VPN concentrator, vendor sites that pin certificates.
5. Week 3: build the baseline profile: a threat intelligence policy blocking high-severity threats and a web filtering policy blocking the liability categories, default action allow.
6. Week 4: add one group profile, for example finance, linked to a Conditional Access policy that also requires a compliant device, and test allowed and blocked destinations.
7. Week 5: extend the client to all 100 devices in two waves, move the compliant network policy to on, and read the traffic logs weekly.
8. Week 6 and later: TLS inspection last, with the intermediate certificate deployed by Intune before the policy is linked. Add a remote network for the office only if the tenant holds at least 50 combined P1 and Internet Access licenses and the printers need the same egress.

The design rules for the policies themselves, named locations and exclusions are in Conditional Access design patterns.

A 100-user firm on Business Premium wants web filtering per group, the compliant network check and, later, a VPN replacement.

• Compliant network check and the Microsoft traffic profile: no additional license; the P1 inside Business Premium covers it.
• Entra Internet Access standalone: 100 × $60.00 = $6,000 per year.
• Entra Private Access standalone, added later for the VPN replacement: 100 × $60.00 = $6,000 per year, $12,000 for both.
• Microsoft Entra Suite instead: 100 × $144.00 = $14,400 per year, which adds Entra ID Governance, ID Protection risk policies and Verified ID with Face Check for $2,400 more than the two standalone licenses.

The decision rule: two standalone products is $12,000; the Suite is $14,400. If any third Suite component will be used, the Suite is the cheaper way to buy the set; the 2026 packaging changes explain why P1 is the floor under it. A firm on Microsoft 365 E5 takes the Suite add-on for P2 holders at $9.00 instead, $10,800 per year for 100 users.

On the services side, the Conditional Access review with break-glass validation is $2,450 for a tenant that already has policies, and Entra Private Access VPN Replacement is $3,950 when the second product arrives; both are quoted in writing before work begins.

What is the Entra Suite license?

Microsoft Entra Suite is a $12.00 per user per month bundle (Microsoft list price, October 2026 price list) of Entra Internet Access, Entra Private Access, Entra ID Governance, Entra ID Protection and Entra Verified ID with Face Check. It requires Entra ID P1 or a plan that includes it, and Entra ID P2 holders can buy it as a $9.00 add-on.

Is Entra Internet Access included in Microsoft 365 E5?

No. E5 includes Entra ID P2, which carries the Microsoft traffic profile and the compliant network check, but Internet Access itself is a standalone license or part of the Entra Suite. Microsoft 365 E7 includes the Entra Suite.

Does Entra Internet Access require Entra ID P1?

Yes. Microsoft's overview states that users need an Entra ID P1 or P2 license to use Entra Internet Access or Entra Private Access. Business Premium, E3 and E5 include it.

Does Entra Internet Access work without the client?

For an office, yes, through a remote network: an IPsec tunnel from the firewall to Microsoft's edge carrying the Microsoft 365 and Internet Access profiles. Microsoft requires at least 50 combined Entra ID P1 and Internet Access licenses, and allocates bandwidth by license count: 500 Mbps for 50 to 99 licenses, 1,000 Mbps for 100 to 499.

Can Entra Internet Access replace Defender for Endpoint web content filtering?

It can; Microsoft's concept page names Defender for Endpoint as having similar category filtering. Internet Access applies rules per user through Conditional Access and adds TLS inspection and threat intelligence; Defender's filtering is per device group and comes with Defender for Business and Plan 1 at no extra cost.

• Microsoft Learn source files on GitHub, checked 2026-10-11: What is Global Secure Access? (ms.date 04/15/2026); Learn about Microsoft Entra Internet Access (03/12/2026); Web filtering in Global Secure Access (V2) (09/17/2026); How to configure web content filtering (09/16/2026); Universal Conditional Access (03/12/2026); Enable compliant network check (04/03/2026); Install the Windows client (02/02/2026) and the macOS, iOS and Android guides; Understand remote network connectivity (04/15/2026); Tutorial: Enable TLS inspection (03/07/2026); Known limitations (09/29/2026)
• Microsoft Entra plans and pricing — Microsoft, checked 2026-10-11 (Suite contents and P1 requirement)
• Microsoft list price, October 2026 price list, US commercial, for every price quoted above