Click here for the Japanese version of this article.

Introduction

To use the Internet Access feature of Microsoft Entra Global Secure Access (GSA), all required prerequisites must be configured.

This article covers a subset of the prerequisites explained in the following article:

[GSA: Internet] How to Meet All Prerequisites for Internet Access
https://qiita.com/carol0226/items/29197f33c6537cd2b0e5

Scope of This Article

Among the prerequisites listed below, this article focuses specifically on the items highlighted in red, which require disabling DoH (DNS over HTTPS).

Public documentation: Prerequisites
https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-web-content-filtering?wt.mc_id=MVP_407731#prerequisites

(Excerpt from the documentation)

Configure the DNS Client to Disable DoH

To tunnel Internet network traffic via GSA, Secure DNS (DNS over HTTPS) must be disabled.
Traffic Forwarding Profiles rely on FQDN‑based rules, which require traditional DNS lookups rather than encrypted DNS.

Public documentation: DNS over HTTPS is not supported
https://learn.microsoft.com/en-us/entra/global-secure-access/troubleshoot-global-secure-access-client-diagnostics-health-check?wt.mc_id=MVP_407731#dns-over-https-not-supported

(Excerpt)

This article explains three different ways to disable DoH:

• 1. Disable DoH directly on client PCs
• 2. Disable DoH via Group Policy (GPO)
• 3. Disable DoH via Intune

1. Disable DoH on Client PCs

Both command-line and GUI methods are shown below.

Disable DoH via Command Line

• Check current configuration:
  netsh dnsclient show global
• Disable DoH:
  netsh dnsclient set global doh=no dot=no

Public documentation: netsh dnsclient
https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netsh-dnsclient?wt.mc_id=MVP_407731

Disable DoH via GUI

On my PC (Windows 11 24H2), the UI differed from the documentation—but simply switching the toggle Off disables DNS encryption.
However, note that GUI settings cannot be configured when DHCP is used.
Using the command line is therefore more reliable.

UI shown in the public documentation
If you see the UI below, choose Unencrypted only:

Public documentation: Configure DNS clients to support DoH
https://learn.microsoft.com/en-us/windows-server/networking/dns/doh-client-support?wt.mc_id=MVP_407731#configure-the-dns-client-to-support-doh

Reference
After applying the settings, it is correct if “(Unencrypted)” is displayed to the right of the DNS server address in the screen below.

2. Disable DoH via Group Policy (GPO)

This section tends to be challenging due to version‑specific differences in ADMX templates.
The public documentation refers to the following settings:

Public documentation: Configure DoH using Group Policy
https://learn.microsoft.com/en-us/windows-server/networking/dns/doh-client-support?wt.mc_id=MVP_407731#configuring-doh-through-group-policy

Naming differences by Windows version

The names shown in the documentation—

• English: Configure DNS over HTTPS (DoH) name resolution
• Japanese: HTTPS (DoH) の名前解決ポリシー経由の DNS の構成

—did not appear on Windows Server 2022 21H2 or Windows Server 2025 24H2.

This indicates that the public documentation may not reflect the latest Windows builds.

Based on investigation:

Download and Deploy ADMX Templates

To configure DoH settings, download the Windows 11 23H2 Administrative Templates and place them in the PolicyDefinitions folder on your domain controller.

Public documentation: Create and manage a Central Store for ADMX templates
https://learn.microsoft.com/en-us/troubleshoot/windows-client/group-policy/create-and-manage-central-store?wt.mc_id=MVP_407731

Configuration Steps

After importing the correct ADMX templates, you will see the expected policy settings:

Extract from the Help text:

Specifies whether the DNS client performs name resolution using DNS over HTTPS (DoH).

Default: classic DNS (UDP or TCP).

Options:

• Prohibit DoH – DoH name resolution is not performed.
• Allow DoH – Use DoH when supported by the configured DNS server.
• Require DoH – Only DoH is permitted; classic DNS fails if DoH is unavailable.

Verification

Before applying GPO: DoH/DoT = enabled
After applying GPO: DoH/DoT = disabled

Note for 24H2 Templates
Applying 23H2 template settings and later switching to 24H2 templates shows the following configuration:

3. Disable DoH via Intune

I tested many methods in Intune, and the most reliable approach is using a Detection Script + Remediation Script (formerly called Proactive Remediations).

Disable DoH Using Detection & Remediation Scripts

We will use Intune’s Remediations feature:

Public documentation: Use Remediations
https://learn.microsoft.com/en-us/intune/intune-service/fundamentals/remediations?wt.mc_id=MVP_407731

Step 1: Create Two Script Files

1) Detection Script — Detect-DoH.ps1

# Detect-DoH.ps1

# Get current DoH configuration

$doh = (netsh dnsclient show global | Select-String "DoH").ToString()

# Evaluate DoH status
if ($doh -match "disabled") {
    exit 0   # No remediation needed
} else {
    exit 1   # Remediation required
}

Save with UTF‑8 encoding.

2) Remediation Script — Remediate-DoH.ps1

# Remediate-DoH.ps1

# Disable DoH and DoT
netsh dnsclient set global doh=no dot=no

Start-Sleep -Seconds 1

exit 0

Save with UTF‑8 encoding.

Step 2: Create a Remediation in Intune

Navigate to
Devices → Device Management → Scripts and Remediations → + Create.

Enter any name.

Upload detection/remediation scripts.

Skip scope tags.

Assign to a device group and configure schedule
—for example: Frequency: Hourly / Interval: 1.

Review and create the remediation.

The remediation now appears in the list.

Verification

A device with DoH enabled transitions from Issue detected → Issue resolved after remediation runs:

Reference 1

Thanks to Kunii-san’s article for guiding detection/remediation approach:

Always on the clock: Troubleshooting Intune Scripts & Remediations
https://azuread.net/archives/15219

Reference 2

(Details of unsuccessful ADMX-upload attempts for archival purposes)