GSA Android client deployment
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 3ff1e1a · +21 −23 lines · also on GitHub
⋯ 2 unchanged lines
33
description: The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the Android client app.
44
ms.service: global-secure-access
55
ms.topic: how-to
6
−ms.date: 08/13/2025
6
+ms.date: 08/27/2025
77
ms.author: jayrusso
88
author: HULKsmashGithub
99
manager: dougeby
⋯ 9 unchanged lines
1919
2020
## Prerequisites
2121
22
−- The product requires licensing. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
23
−- You must enable at least one Global Secure Access [traffic forwarding profile](concept-traffic-forwarding.md).
22
+- The product requires licensing. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
23
+- Enable at least one Global Secure Access [traffic forwarding profile](concept-traffic-forwarding.md).
2424
- You need device installation permissions to install the client.
2525
- Android devices need to run Android 10.0 or later.
2626
- Android devices need to be Microsoft Entra registered devices.
2727
- Devices not managed by your organization need to have the Microsoft Authenticator app installed.
2828
- Devices not managed through Intune need to have the Company Portal app installed.
29
− - Device enrollment is required for Intune device compliance policies to be enforced.
29
+ - Device enrollment is required to enforce Intune device compliance policies.
3030
3131
### Known limitations
3232
⋯ 1 unchanged line
3434
3535
## Supported scenarios
3636
37
−The Global Secure Access client for Android supports deployment for the following Android Enterprise scenarios:
37
+The Global Secure Access client for Android supports deployment in these Android Enterprise scenarios:
3838
39
−- Corporate-owned, fully managed user devices.
40
−- Corporate-owned devices with a work profile.
41
−- Personal devices with a work profile.
39
+- Corporate-owned, fully managed user devices
40
+- Corporate-owned devices with a work profile
41
+- Personal devices with a work profile
4242
4343
### Non-Microsoft mobile device management
4444
45
−The Global Secure Access client also supports non-Microsoft mobile device management (MDM) scenarios. In these scenarios, known as *Global Secure Access only mode*, you only need to enable a traffic forwarding profile and configure the app according to the vendor documentation.
46
−
47
−## Deploy Microsoft Defender for Endpoint Android
45
+The Global Secure Access client also supports non-Microsoft mobile device management (MDM) scenarios. These scenarios, known as *Global Secure Access only mode*, require enabling a traffic forwarding profile and configuring the app based on the vendor documentation.
4846
49
−You can use the Global Secure Access client for Android in different deployment modes and scenarios.
47
+## Deploy Microsoft Defender for Endpoint on Android
5048
51
−### Create an MDM profile and configure Global Secure Access for Microsoft Defender for Endpoint
49
+To deploy Microsoft Defender for Endpoint on Android, create an MDM profile and configure Global Secure Access.
5250
5351
1. In the [Microsoft Intune admin center](https://intune.microsoft.com/#home), go to **Apps** > **Android** > **Manage Apps** > **Configuration**.
54
−1. Select the **+ Create** and then select **Managed devices**. The **Create app configuration policy** form opens.
52
+1. Select **+ Create**, and then select **Managed devices**. The **Create app configuration policy** form opens.
5553
1. On the **Basics** tab:
5654
1. Enter a **Name**.
5755
1. Set the **Platform** to **Android Enterprise**.
58
− 1. Set the **Profile type** to **Fully Managed, Dedicated, and Corporate-Owned Work Profile Only**.
56
+1. Set the **Profile type** to **Fully Managed, Dedicated, and Corporate-Owned Work Profile Only**.
5957
1. Set the **Targeted app** to **Microsoft Defender**.
6058
1. Select **Next**.
6159
:::image type="content" source="media/how-to-install-android-client/create-policy-basics.png" alt-text="Screenshot of the Create app configuration policy on the Basics tab.":::
6260
6361
1. On the **Settings** tab:
6462
1. Set **Configuration settings format** to **Use configuration designer**.
65
− 1. Use the JSON editor to configure the disabled configuration keys. Select the **+Add** button.
63
+1. Use the JSON editor to configure the disabled configuration keys, and then select the **+ Add** button.
6664
1. In the search field, type `global` and select these configuration keys:
6765
- **Global Secure Access** (this key is required to enable Global Secure Access).
6866
- **GlobalSecureAccessPrivateChannel** (this optional key enables Global Secure Access Private channel).
⋯ 13 unchanged lines
8280
| | 3 | The Private Access toggle is visible but grayed out, and defaults to the enabled state. The user **can't** disable Private Access. |
8381
8482
> [!NOTE]
85
−> The **GlobalSecureAccessPA** configuration key is deprecated.
83
+> The **GlobalSecureAccessPA** configuration key is no longer supported.
8684
8785
6. Select **Next**.
8886
:::image type="content" source="media/how-to-install-android-client/create-policy-settings.png" alt-text="Screenshot of the Create app configuration policy on the Settings tab.":::
⋯ 3 unchanged lines
9290
:::image type="content" source="media/how-to-install-android-client/create-policy-assignments.png" alt-text="Screenshot of the Create app configuration policy on the Assignments tab.":::
9391
9492
> [!TIP]
95
−> To enable the policy for all but a few specific users, select **Add all devices** in the **Included groups** section, and then add the users or groups to exclude in the **Excluded groups** section.
93
+> To enable the policy for all but a few specific users, select **Add all devices** in the **Included groups** section. Then, add the users or groups to exclude in the **Excluded groups** section.
9694
9795
9. Select **Next**.
9896
1. Review the configuration summary and select **Create**.
9997
100
−## Confirm Global Secure Access appears in Defender app
98
+## Confirm Global Secure Access appears in the Defender app
10199
102100
Because the Android client is integrated with Defender for Endpoint, it's helpful to understand the end user experience. The client appears in the Defender dashboard after onboarding to Global Secure Access. Onboarding happens by enabling a traffic forwarding profile.
103101
⋯ 3 unchanged lines
107105
108106
109107
110
−To view the details of the client, tap on the tile on the dashboard. When enabled and working properly, the client displays an "Enabled" message. The date and time for when the client connected to Global Secure Access also appears.
108
+To view client details, tap the tile on the dashboard. When enabled and working properly, the client shows an "Enabled" message. It also shows the date and time when the client connected to Global Secure Access.
111109
112110
113111
114
−If the client is unable to connect, a toggle appears to disable the service. Users can come back later to try enabling the client.
112
+If the client can't connect, a toggle appears to disable the service. Users can return later to enable the client.
115113
116114
117115
118116
## Troubleshooting
119117
120
−If the Global Secure Access tile doesn't appear after onboarding the tenant to the service, try restarting the Defender app.
118
+If the Global Secure Access tile doesn't appear after onboarding the tenant to the service, restart the Defender app.
121119
122
−When attempting to access a Private Access application, the connection might time out after a successful interactive sign-in. Try reloading the application by refreshing the web browser.
120
+When you try to access a Private Access application, the connection might time out after a successful interactive sign-in. Reload the application by refreshing the web browser.
123121
124122
## Related content
125123
- [About Microsoft Defender for Endpoint on Android](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-android)
⋯ 5 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:31 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.