Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 18:51 UTC Customize Public modeDiscuss ChangeIntel on Discord

GSA Android client deployment

This page's changes and edits · All guidance changes

Microsoft's edit ·

Oct 13 added Kerberos feature to mobile client articles

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 9cd76e4 · +7 −4 lines · also on GitHub

11 ---
22 title: The Global Secure Access Client for Android
33 description: The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the Android client app.
4 +#customer intent: As an administrator, I want to set up and deploy the Global Secure Access mobile client for Android devices.
45 ms.service: global-secure-access
56 ms.topic: how-to
6 −ms.date: 10/03/2025
7 +ms.date: 10/13/2025
78 ms.author: jayrusso
89 author: HULKsmashGithub
910 manager: dougeby
1011 ms.reviewer: cagautham
1112 ms.custom: sfi-image-nochange
12 −# Customer intent: As an administrator, I want to set up and deploy the Global Secure Access mobile client for Android devices.
13 +
1314 ---
15 +
1416 # Global Secure Access client for Android
1517
1618 The Global Secure Access client can be deployed to compliant Android devices using Microsoft Intune and Microsoft Defender for Endpoint on Android. The Android client is built into the Defender for Endpoint Android app, which streamlines how end users connect to Global Secure Access. The Global Secure Access Android client makes it easier for your end users to connect to the resources they need without having to manually configure VPN settings on their devices.
1719
18 −This article explains how to deploy the Global Secure Access client to Android devices.
20 +This article describes how to deploy the Global Secure Access client to Android devices.
1921
2022 ## Prerequisites
2123
⋯ 5 unchanged lines
2729 - Devices not managed by your organization need to have the Microsoft Authenticator app installed.
2830 - Devices not managed through Intune need to have the Company Portal app installed.
2931 - Device enrollment is required to enforce Intune device compliance policies.
32 +- To enable a Kerberos single sign-on (SSO) experience, install and configure a third-party SSO client.
3033
3134 ### Known limitations
3235
⋯ 73 unchanged lines
106109
107110 ![Screenshot of the Global Secure Access client in a disabled state.](media/how-to-install-android-client/defender-global-secure-access-disabled.png)
108111
109 −To view client details, tap the tile on the dashboard. When enabled and working properly, the client shows an "Enabled" message. It also shows the date and time when the client connected to Global Secure Access.
112 +To view client details, tap the tile on the dashboard. When enabled and working properly, the client displays an "Enabled" message. It also shows the date and time when the client connected to Global Secure Access.
110113
111114 ![Screenshot of the Global Secure Access client in an enabled state.](media/how-to-install-android-client/defender-global-secure-access-enabled.png)
112115
⋯ 17 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:31 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 18:51 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current