GSA Android client deployment
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 98d4fc7 · +10 −10 lines · also on GitHub
⋯ 2 unchanged lines
33
description: The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the Android client app.
44
ms.service: global-secure-access
55
ms.topic: how-to
6
−ms.date: 09/02/2025
6
+ms.date: 10/03/2025
77
ms.author: jayrusso
88
author: HULKsmashGithub
99
manager: dougeby
⋯ 3 unchanged lines
1313
---
1414
# Global Secure Access client for Android
1515
16
−The Global Secure Access client can be deployed to compliant Android devices using Microsoft Intune and Microsoft Defender for Endpoint on Android. The Android client is built into the Defender for Endpoint Android app, which streamlines how your end users connect to Global Secure Access. The Global Secure Access Android client makes it easier for your end users to connect to the resources they need without having to manually configure VPN settings on their devices.
16
+The Global Secure Access client can be deployed to compliant Android devices using Microsoft Intune and Microsoft Defender for Endpoint on Android. The Android client is built into the Defender for Endpoint Android app, which streamlines how end users connect to Global Secure Access. The Global Secure Access Android client makes it easier for your end users to connect to the resources they need without having to manually configure VPN settings on their devices.
1717
18
−This article explains how to deploy the Global Secure Access client onto Android devices.
18
+This article explains how to deploy the Global Secure Access client to Android devices.
1919
2020
## Prerequisites
2121
⋯ 14 unchanged lines
3636
3737
The Global Secure Access client for Android supports deployment in these Android Enterprise scenarios:
3838
39
−- Corporate-owned, fully managed user devices
40
−- Corporate-owned devices with a work profile
41
−- Personal devices with a work profile
39
+- Corporate-owned, fully managed user devices.
40
+- Corporate-owned devices with a work profile.
41
+- Personal devices with a work profile.
4242
4343
### Non-Microsoft mobile device management
4444
⋯ 32 unchanged lines
7777
| GlobalSecureAccessPrivateChannel | No value | Global Secure Access defaults to value 2 behavior. |
7878
| | 0 | Private Access isn't enabled and the toggle option isn't visible to the user. |
7979
| | 1 | The Private Access toggle is visible and defaults to the disabled state. The user can enable or disable Private Access. |
80
− | | 2 | The Private Access toggle is visible and defaults to the disabled state. The user can enable or disable Private Access. |
80
+ | | 2 | The Private Access toggle is visible and defaults to the enabled state. The user can enable or disable Private Access. |
8181
| | 3 | The Private Access toggle is visible but grayed out, and defaults to the enabled state. The user **can't** disable Private Access. |
8282
8383
> [!NOTE]
⋯ 16 unchanged lines
100100
101101
Because the Android client is integrated with Defender for Endpoint, it's helpful to understand the end user experience. The client appears in the Defender dashboard after onboarding to Global Secure Access. Onboarding happens by enabling a traffic forwarding profile.
102102
103
−
103
+
104104
105105
**The client is disabled by default when it's deployed to user devices.** Users need to enable the client from the Defender app. To enable the client, tap the toggle.
106106
107
−
107
+
108108
109109
To view client details, tap the tile on the dashboard. When enabled and working properly, the client shows an "Enabled" message. It also shows the date and time when the client connected to Global Secure Access.
110110
111
−
111
+
112112
113113
If the client can't connect, a toggle appears to disable the service. Users can return later to enable the client.
114114
⋯ 15 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:31 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.