GSA Android client deployment
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 363c793 · +67 −56 lines · also on GitHub
⋯ 12 unchanged lines
1313
1414
# Install the Global Secure Access client for Android
1515
16
−The Global Secure Access client can be deployed to compliant Android devices using Microsoft Intune and Microsoft Defender for Endpoint on Android. The Android client is built into the Defender for Endpoint Android app, which streamlines how end users connect to Global Secure Access. The Global Secure Access Android client makes it easier for your end users to connect to the resources they need without having to manually configure VPN settings on their devices.
17
−
18
−This article describes how to deploy the Global Secure Access client to Android devices.
16
+This article describes how to deploy the Global Secure Access client to compliant Android devices by using Microsoft Intune and Microsoft Defender for Endpoint on Android. The Android client is built into the Defender for Endpoint Android app, which streamlines how users connect to Global Secure Access. The Global Secure Access Android client makes it easier for your users to connect to the resources that they need without having to manually configure VPN settings on their devices.
1917
2018
## Prerequisites
2119
22
−- The product requires licensing. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
20
+- The product requires licensing. For details, see the licensing section of [What is Global Secure Access?](overview-what-is-global-secure-access.md). If necessary, [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
21
+
2322
- Enable at least one Global Secure Access [traffic forwarding profile](concept-traffic-forwarding.md).
23
+
2424
- You need device installation permissions to install the client.
25
+
2526
- Android devices need to run Android 10.0 or later.
26
−- Android devices need to be Microsoft Entra registered devices.
27
− - Devices not managed by your organization need to have the Microsoft Authenticator app installed.
27
+
28
+- Android devices need to be Microsoft Entra registered devices:
29
+ - Devices that your organization doesn't manage need to have the Microsoft Authenticator app installed.
2830
- Devices not managed through Intune need to have the Company Portal app installed.
2931
- Device enrollment is required to enforce Intune device compliance policies.
30
−- To enable a Kerberos single sign-on (SSO) experience, install and configure a third-party SSO client.
3132
33
+- To enable a Kerberos single sign-on (SSO) experience, install and configure a non-Microsoft SSO client.
34
+
3235
### Known limitations
3336
3437
[!INCLUDE [known-limitations-include](../includes/known-limitations-include.md)]
⋯ 2 unchanged lines
3740
3841
The Global Secure Access client for Android supports deployment in these Android Enterprise scenarios:
3942
40
−- Corporate-owned, fully managed user devices.
41
−- Corporate-owned devices with a work profile.
42
−- Personal devices with a work profile.
43
+- Corporate-owned, fully managed user devices
44
+- Corporate-owned devices with a work profile
45
+- Personal devices with a work profile
4346
4447
### Non-Microsoft mobile device management
4548
4649
The Global Secure Access client also supports non-Microsoft mobile device management (MDM) scenarios. These scenarios, known as *Global Secure Access only mode*, require enabling a traffic forwarding profile and configuring the app based on the vendor documentation.
4750
48
−When configuring through a non-Microsoft MDM, use the following key-value pairs in the managed app configuration:
51
+When you're configuring through a non-Microsoft MDM, use the following key/value pairs in the managed app configuration:
4952
5053
| Configuration key | Value | Details |
5154
|----------------------------------|-------|---------|
52
−| Global Secure Access | 1–3 | Required. Controls whether Global Secure Access is enabled in the Defender app. See the table in [Deploy Microsoft Defender for Endpoint on Android](#deploy-microsoft-defender-for-endpoint-on-android) for detailed value descriptions. |
53
−| GlobalSecureAccessPrivateChannel | 0–3 | Optional. Controls the Private Access channel. See the table in [Deploy Microsoft Defender for Endpoint on Android](#deploy-microsoft-defender-for-endpoint-on-android) for detailed value descriptions. |
55
+| `Global Secure Access` | `1`–`3` | Required. Controls whether Global Secure Access is enabled in the Defender app. For detailed value descriptions, see the table [later in this article](#deploy-microsoft-defender-for-endpoint-on-android). |
56
+| `GlobalSecureAccessPrivateChannel` | `0`–`3` | Optional. Controls the Private Access channel. For detailed value descriptions, see the table [later in this article](#deploy-microsoft-defender-for-endpoint-on-android). |
5457
5558
## Deploy Microsoft Defender for Endpoint on Android
5659
57
−To deploy Microsoft Defender for Endpoint on Android, create an MDM profile and configure Global Secure Access.
60
+To deploy Microsoft Defender for Endpoint on Android, create an MDM profile and configure Global Secure Access:
5861
59
−1. In the [Microsoft Intune admin center](https://intune.microsoft.com/#home), go to **Apps** > **Android** > **Manage Apps** > **Configuration**.
62
+1. In the [Microsoft Intune admin center](https://intune.microsoft.com/#home), go to **Apps** > **Android** > **Manage Apps** > **Configuration**.
63
+
6064
1. Select **+ Create**, and then select **Managed devices**. The **Create app configuration policy** form opens.
65
+
6166
1. On the **Basics** tab:
62
− 1. Enter a **Name**.
63
− 1. Set the **Platform** to **Android Enterprise**.
64
− 1. Set the **Profile type** to **Fully Managed, Dedicated, and Corporate-Owned Work Profile Only**.
65
− 1. Set the **Targeted app** to **Microsoft Defender**.
67
+
68
+ 1. Enter a **Name** value.
69
+ 1. Set **Platform** to **Android Enterprise**.
70
+ 1. Set **Profile type** to **Fully Managed, Dedicated, and Corporate-Owned Work Profile Only**.
71
+ 1. Set **Targeted app** to **Microsoft Defender**.
72
+
73
+ :::image type="content" source="media/how-to-install-android-client/create-policy-basics.png" alt-text="Screenshot of the Basics tab in the pane for creating an app configuration policy." lightbox="media/how-to-install-android-client/create-policy-basics-expanded.png":::
74
+
6675
1. Select **Next**.
67
−:::image type="content" source="media/how-to-install-android-client/create-policy-basics.png" alt-text="Screenshot of the Create app configuration policy on the Basics tab." lightbox="media/how-to-install-android-client/create-policy-basics-expanded.png":::
6876
6977
1. On the **Settings** tab:
78
+
7079
1. Set **Configuration settings format** to **Use configuration designer**.
7180
1. Add the Global Secure Access configuration keys:
7281
1. Select the **+ Add** button.
73
− 1. In the search field, type `global` and select the configuration keys listed in the following table:
74
− - **Global Secure Access** (this key is required to enable Global Secure Access).
75
− - **GlobalSecureAccessPrivateChannel** (this optional key enables Global Secure Access Private channel).
76
− 1. Set the appropriate values for each configuration key according to the following table:
82
+ 1. In the search field, type **global** and select the configuration keys listed in the following table.
83
+ 1. Set the appropriate values for each configuration key according to the following table.
7784
7885
> [!NOTE]
7986
> The Android configuration keys differ from the iOS client keys. On Android, use `Global Secure Access` and `GlobalSecureAccessPrivateChannel` as shown here. Don't use the iOS key names (`EnableGSA`, `EnableGSAPrivateChannel`).
80
−
87
+ >
88
+ > The `GlobalSecureAccessPA` configuration key is no longer supported.
89
+
8190
| Configuration key | Value | Details |
8291
|----------------------------------|----------|-----------|
83
− | Global Secure Access | No value | Global Secure Access isn't enabled and the tile isn't visible. |
84
− | | 0 | Global Secure Access isn't enabled and the tile isn't visible. |
85
− | | 1 | The tile is visible and defaults to false (disabled state). The user can enable or disable Global Secure Access using the toggle in the app. |
86
− | | 2 | The tile is visible and defaults to true (enabled state). The user can override Global Secure Access. The user can enable or disable Global Secure Access using the toggle in the app. |
87
− | | 3 | The tile is visible and defaults to true (enabled state). The user **can't** disable Global Secure Access. |
88
− | GlobalSecureAccessPrivateChannel | No value | Global Secure Access defaults to value 2 behavior. |
89
− | | 0 | Private Access isn't enabled and the toggle option isn't visible to the user. |
90
− | | 1 | The Private Access toggle is visible and defaults to the disabled state. The user can enable or disable Private Access. |
91
− | | 2 | The Private Access toggle is visible and defaults to the enabled state. The user can enable or disable Private Access. |
92
− | | 3 | The Private Access toggle is visible but grayed out, and defaults to the enabled state. The user **can't** disable Private Access. |
92
+ | `Global Secure Access` | No value | Global Secure Access isn't enabled and the tile isn't visible. |
93
+ | | `0` | Global Secure Access isn't enabled and the tile isn't visible. |
94
+ | | `1` | The tile is visible and defaults to `false` (disabled state). The user can enable or disable Global Secure Access by using the toggle in the app. |
95
+ | | `2` | The tile is visible and defaults to `true` (enabled state). The user can override Global Secure Access. The user can enable or disable Global Secure Access by using the toggle in the app. |
96
+ | | `3` | The tile is visible and defaults to `true` (enabled state). The user *can't* disable Global Secure Access. |
97
+ | `GlobalSecureAccessPrivateChannel` | No value | Global Secure Access defaults to value 2 behavior. |
98
+ | | `0` | Private Access isn't enabled and the toggle option isn't visible to the user. |
99
+ | | `1` | The Private Access toggle is visible and defaults to the disabled state. The user can enable or disable Private Access. |
100
+ | | `2` | The Private Access toggle is visible and defaults to the enabled state. The user can enable or disable Private Access. |
101
+ | | `3` | The Private Access toggle is visible but unavailable, and defaults to the enabled state. The user *can't* disable Private Access. |
93102
94
− > [!NOTE]
95
− > The **GlobalSecureAccessPA** configuration key is no longer supported.
103
+ :::image type="content" source="media/how-to-install-android-client/create-policy-settings.png" alt-text="Screenshot of the Settings tab in the pane for creating an app configuration policy." lightbox="media/how-to-install-android-client/create-policy-settings-expanded.png":::
96104
97
−6. Select **Next**.
98
−:::image type="content" source="media/how-to-install-android-client/create-policy-settings.png" alt-text="Screenshot of the Create app configuration policy on the Settings tab." lightbox="media/how-to-install-android-client/create-policy-settings-expanded.png":::
105
+1. Select **Next**.
99106
100
−1. On the **Scope tags** tab, configure scope tags as needed and select **Next**.
107
+1. On the **Scope tags** tab, configure scope tags as needed and then select **Next**.
108
+
101109
1. On the **Assignments** tab, select **+ Add groups** to assign the configuration policy and enable Global Secure Access.
102
−:::image type="content" source="media/how-to-install-android-client/create-policy-assignments.png" alt-text="Screenshot of the Create app configuration policy on the Assignments tab." lightbox="media/how-to-install-android-client/create-policy-assignments-expanded.png":::
103110
104
−> [!TIP]
105
−> To enable the policy for all but a few specific users, select **Add all devices** in the **Included groups** section. Then, add the users or groups to exclude in the **Excluded groups** section.
111
+ :::image type="content" source="media/how-to-install-android-client/create-policy-assignments.png" alt-text="Screenshot of the Assignments tab in the pane for creating an app configuration policy." lightbox="media/how-to-install-android-client/create-policy-assignments-expanded.png":::
106112
107
−9. Select **Next**.
108
−1. Review the configuration summary and select **Create**.
113
+ > [!TIP]
114
+ > To enable the policy for all but a few specific users, select **Add all devices** in the **Included groups** section. Then, add the users or groups to exclude in the **Excluded groups** section.
109115
116
+1. Select **Next**.
117
+
118
+1. Review the configuration summary, and then select **Create**.
119
+
110120
## Confirm Global Secure Access appears in the Defender app
111121
112
−Because the Android client is integrated with Defender for Endpoint, it's helpful to understand the end user experience. The client appears in the Defender dashboard after onboarding to Global Secure Access. Onboarding happens by enabling a traffic forwarding profile.
122
+Because the Android client is integrated with Defender for Endpoint, it's helpful to understand the user experience. The client appears in the Defender dashboard after onboarding to Global Secure Access. Onboarding happens by enabling a traffic forwarding profile.
113123
114
−
124
+
115125
116
−**The client is disabled by default when it's deployed to user devices.** Users need to enable the client from the Defender app. To enable the client, tap the toggle.
126
+*The client is disabled by default when it's deployed to user devices.* Users need to enable the client from the Defender app. To enable the client, tap the toggle.
117127
118128
119129
120
−To view client details, tap the tile on the dashboard. When enabled and working properly, the client displays an "Enabled" message. It also shows the date and time when the client connected to Global Secure Access.
130
+To view client details, tap the tile on the dashboard. When the client is enabled and working properly, the dashboard displays an "Enabled" message. It also shows the date and time when the client connected to Global Secure Access.
121131
122132
123133
124134
If the client can't connect, a toggle appears to disable the service. Users can return later to enable the client.
125135
126
−
136
+
127137
128138
## Troubleshooting
129139
130
−If the Global Secure Access tile doesn't appear after onboarding the tenant to the service, restart the Defender app.
140
+If the Global Secure Access tile doesn't appear after you onboard the tenant to the service, restart the Defender app.
131141
132142
When you try to access a Private Access application, the connection might time out after a successful interactive sign-in. Reload the application by refreshing the web browser.
133143
134144
## Related content
135
−- [About Microsoft Defender for Endpoint on Android](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-android)
145
+
146
+- [Microsoft Defender for Endpoint on Android](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-android)
136147
- [Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune](/microsoft-365/security/defender-endpoint/android-intune)
137
−- [Learn about managed Google Play apps and Android Enterprise devices with Intune](/mem/intune/apps/apps-add-android-for-work)
138
−- [Global Secure Access client for Microsoft Windows](how-to-install-windows-client.md)
139
−- [Global Secure Access client for macOS](how-to-install-macos-client.md)
140
−- [Global Secure Access client for iOS](how-to-install-ios-client.md)
148
+- [Add managed Google Play apps to Android Enterprise devices with Intune](/mem/intune/apps/apps-add-android-for-work)
149
+- [Install the Global Secure Access client for Windows](how-to-install-windows-client.md)
150
+- [Install the Global Secure Access client for macOS](how-to-install-macos-client.md)
151
+- [Install the Global Secure Access client for iOS](how-to-install-ios-client.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:16 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.