Announcement: Unified suffix domain for proxy

%3CLINGO-SUB%20id%3D%22lingo-sub-1410635%22%20slang%3D%22en-US%22%3EAnnouncement%3A%20Unified%20suffix%20domain%20for%20proxy%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1410635%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20folks%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20wanted%20to%20share%20an%20important%20and%20exciting%20new%20feature%20that%20we%20are%20rolling%20out%20for%20Session%20Controls%20in%20Microsoft%20Cloud%20App%20Security%2C%20with%20%3CSTRONG%3Eimpact%20to%20current%20users%20of%20Session%20Controls.%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20are%20making%20big%20improvements%20to%20our%20architecture%20for%20our%20proxy-based%20session%20controls%2C%20to%20leverage%20one%20unified%20suffix%2C%20without%20a%20named%20region%20(i.e.%2C%20for%20commercial%20customers%2C%20%E2%80%9C*.%5Bregion%5D.cas.ms%E2%80%9D%20will%20become%20%E2%80%9C*.mcas.ms%E2%80%9D).%20This%20change%20will%20start%20to%20hit%20customer%20tenants%20as%20early%20as%20June%207%3CSUP%3Eth%3C%2FSUP%3E%2C%20but%20will%20continue%20to%20roll%20out%20gradually.%20This%20is%20important%20for%20several%20reasons%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3ECustomers%20who%20blacklist%20domains%20by%20default%20in%20their%20network%20appliance%20or%20gateway%20will%20need%20to%20ensure%20they%20whitelist%20all%20the%20domains%20listed%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fdocs.microsoft.com%252Fen-us%252Fcloud-app-security%252Fnetwork-requirements%2523access-and-session-controls%26amp%3Bdata%3D02%257C01%257CAlex.Esibov%2540microsoft.com%257Ce8bde6704ea94964bc5b08d7fdd32ff9%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637256955955371191%26amp%3Bsdata%3DgmaH9FjrazjvU1p4JHuq4CGXsWzzSWA83shXmRy3tpU%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Fnetwork-requirements%23access-and-session-controls%3C%2FA%3E%3C%2FLI%3E%0A%3CUL%3E%0A%3CLI%3ENote%201%3A%20during%20initial%20deployment%20and%20roll-out%20of%20this%20feature%2C%20customers%20may%20transition%20from%20the%20previous%2C%20geo-specific%20domains%20to%20the%20unified%20suffix%20domains.%20Therefore%2C%20it%E2%80%99s%20important%20to%20whitelist%20all%20domains%20listed%20on%20this%20page.%3C%2FLI%3E%0A%3CLI%3ENote%202%3A%20If%20a%20customer%20is%20whitelisting%20specific%20IPs%2C%20they%20must%20whitelist%20all%20IPs%20currently%20listed%20in%20the%20network%20requirements%20across%20all%20listed%20Data%20centers.%3C%2FLI%3E%0A%3CLI%3ENote%203%3A%20Customers%20should%20continue%20to%20check%20this%20page%20for%20the%20latest%20information%20on%20new%20IP%20addresses%2C%20as%20we%20are%20constantly%20increasing%20our%20region%20sizes%20to%20scale%20with%20demand.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CLI%3EOur%20architecture%20becomes%20more%20scalable%20%E2%80%93%20one%20region%20will%20serve%20any%20DC%2C%20meaning%20when%20we%20deploy%20a%20new%20region%2C%20it%E2%80%99s%20automatically%20available%20to%20any%20customer%20in%20MCAS%3C%2FLI%3E%0A%3CLI%3EUsers%20will%20see%20a%20new%20suffix%20URL%20when%20Session%20Controls%20are%20applied%2C%20and%20should%20be%20aware%20of%20these%20changes%2C%20if%20the%20IT%2FIS%20admins%20in%20the%20org%20choose%20to%20do%20so.%3C%2FLI%3E%0A%3CLI%3EUsers%20will%20no%20longer%20see%20DC%20name%20in%20the%20URL%2C%20which%20has%20often%20been%20confused%20with%20the%20location%20of%20the%20proxy%20node%20(which%20it%E2%80%99s%20not)%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EHere%20is%20a%20GIF%20showing%20the%20new%20domain%20for%20Commercial%20customers%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22unified_suffix_2.gif%22%20style%3D%22width%3A%20840px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F193793iCE601EDF0FEC251F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22unified_suffix_2.gif%22%20alt%3D%22unified_suffix_2.gif%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%3ELet%20me%20know%20if%20you%20have%20any%20questions.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%2C%3C%2FP%3E%0A%3CP%3EAlex%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1410635%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECloud%20App%20Security%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EData%20Protection%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EThreat%20Protection%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Highlighted
Microsoft

Hi folks,

 

I wanted to share an important and exciting new feature that we are rolling out for Session Controls in Microsoft Cloud App Security, with impact to current users of Session Controls.

 

We are making big improvements to our architecture for our proxy-based session controls, to leverage one unified suffix, without a named region (i.e., for commercial customers, “*.[region].cas.ms” will become “*.mcas.ms”). This change will start to hit customer tenants as early as June 7th, but will continue to roll out gradually. This is important for several reasons:

  • Customers who blacklist domains by default in their network appliance or gateway will need to ensure they whitelist all the domains listed here: https://docs.microsoft.com/en-us/cloud-app-security/network-requirements#access-and-session-controls
    • Note 1: during initial deployment and roll-out of this feature, customers may transition from the previous, geo-specific domains to the unified suffix domains. Therefore, it’s important to whitelist all domains listed on this page.
    • Note 2: If a customer is whitelisting specific IPs, they must whitelist all IPs currently listed in the network requirements across all listed Data centers.
    • Note 3: Customers should continue to check this page for the latest information on new IP addresses, as we are constantly increasing our region sizes to scale with demand.
  • Our architecture becomes more scalable – one region will serve any DC, meaning when we deploy a new region, it’s automatically available to any customer in MCAS
  • Users will see a new suffix URL when Session Controls are applied, and should be aware of these changes, if the IT/IS admins in the org choose to do so.
  • Users will no longer see DC name in the URL, which has often been confused with the location of the proxy node (which it’s not)

Here is a GIF showing the new domain for Commercial customers:

unified_suffix_2.gif

Let me know if you have any questions.

 

Thanks,

Alex

0 Replies