GSA Android client deployment
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit e60bc2a · +66 −76 lines · also on GitHub
11
---
2
−title: Install the Global Secure Access Client for Android
3
−description: The Global Secure Access client helps secure network traffic at the user device. This article describes how to download and install the Android client.
2
+title: The Global Secure Access Client for Android
3
+description: The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the Android client app.
44
#customer intent: As an administrator, I want to set up and deploy the Global Secure Access mobile client for Android devices.
55
ms.topic: how-to
66
ms.date: 02/21/2026
⋯ 4 unchanged lines
1111
1212
---
1313
14
−# Install the Global Secure Access client for Android
14
+# Global Secure Access client for Android
1515
16
−This article describes how to deploy the Global Secure Access client to compliant Android devices by using Microsoft Intune and Microsoft Defender for Endpoint on Android. The Android client is built into the Defender for Endpoint Android app, which streamlines how users connect to Global Secure Access. The Global Secure Access Android client makes it easier for your users to connect to the resources that they need without having to manually configure VPN settings on their devices.
16
+The Global Secure Access client can be deployed to compliant Android devices using Microsoft Intune and Microsoft Defender for Endpoint on Android. The Android client is built into the Defender for Endpoint Android app, which streamlines how end users connect to Global Secure Access. The Global Secure Access Android client makes it easier for your end users to connect to the resources they need without having to manually configure VPN settings on their devices.
1717
18
−## Prerequisites
18
+This article describes how to deploy the Global Secure Access client to Android devices.
1919
20
−- The product requires licensing. For details, see the licensing section of [What is Global Secure Access?](overview-what-is-global-secure-access.md). If necessary, [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
20
+## Prerequisites
2121
22
+- The product requires licensing. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
2223
- Enable at least one Global Secure Access [traffic forwarding profile](concept-traffic-forwarding.md).
23
−
2424
- You need device installation permissions to install the client.
25
−
26
−- Android devices need to run Android 10.0 or later.
27
−
28
−- Android devices need to be Microsoft Entra registered devices:
29
− - Devices that your organization doesn't manage need to have the Microsoft Authenticator app installed.
25
+- Android devices need to run Android 11.0 or later.
26
+- Android devices need to be Microsoft Entra registered devices.
27
+ - Devices not managed by your organization need to have the Microsoft Authenticator app installed.
3028
- Devices not managed through Intune need to have the Company Portal app installed.
3129
- Device enrollment is required to enforce Intune device compliance policies.
32
−
33
−- To enable a Kerberos single sign-on (SSO) experience, install and configure a non-Microsoft SSO client.
30
+- To enable a Kerberos single sign-on (SSO) experience, install and configure a third-party SSO client.
3431
3532
### Known limitations
3633
⋯ 3 unchanged lines
4037
4138
The Global Secure Access client for Android supports deployment in these Android Enterprise scenarios:
4239
43
−- Corporate-owned, fully managed user devices
44
−- Corporate-owned devices with a work profile
45
−- Personal devices with a work profile
40
+- Corporate-owned, fully managed user devices.
41
+- Corporate-owned devices with a work profile.
42
+- Personal devices with a work profile.
4643
4744
### Non-Microsoft mobile device management
4845
4946
The Global Secure Access client also supports non-Microsoft mobile device management (MDM) scenarios. These scenarios, known as *Global Secure Access only mode*, require enabling a traffic forwarding profile and configuring the app based on the vendor documentation.
5047
51
−When you're configuring through a non-Microsoft MDM solution, use the following key/value pairs in the managed app configuration:
48
+When configuring through a non-Microsoft MDM, use the following key-value pairs in the managed app configuration:
5249
5350
| Configuration key | Value | Details |
5451
|----------------------------------|-------|---------|
55
−| `Global Secure Access` | `1`–`3` | Required. Controls whether Global Secure Access is enabled in the Defender app. For detailed value descriptions, see the table [later in this article](#deploy-microsoft-defender-for-endpoint-on-android). |
56
−| `GlobalSecureAccessPrivateChannel` | `0`–`3` | Optional. Controls the Private Access channel. For detailed value descriptions, see the table [later in this article](#deploy-microsoft-defender-for-endpoint-on-android). |
52
+| Global Secure Access | 1–3 | Required. Controls whether Global Secure Access is enabled in the Defender app. See the table in [Deploy Microsoft Defender for Endpoint on Android](#deploy-microsoft-defender-for-endpoint-on-android) for detailed value descriptions. |
53
+| GlobalSecureAccessPrivateChannel | 0–3 | Optional. Controls the Private Access channel. See the table in [Deploy Microsoft Defender for Endpoint on Android](#deploy-microsoft-defender-for-endpoint-on-android) for detailed value descriptions. |
5754
5855
## Deploy Microsoft Defender for Endpoint on Android
5956
60
−To deploy Microsoft Defender for Endpoint on Android, create an MDM profile and configure Global Secure Access:
61
−
62
−1. In the [Microsoft Intune admin center](https://intune.microsoft.com/#home), go to **Apps** > **Android** > **Manage Apps** > **Configuration**.
57
+To deploy Microsoft Defender for Endpoint on Android, create an MDM profile and configure Global Secure Access.
6358
59
+1. In the [Microsoft Intune admin center](https://intune.microsoft.com/#home), go to **Apps** > **Android** > **Manage Apps** > **Configuration**.
6460
1. Select **+ Create**, and then select **Managed devices**. The **Create app configuration policy** form opens.
65
−
6661
1. On the **Basics** tab:
67
−
68
− 1. Enter a **Name** value.
69
− 1. Set **Platform** to **Android Enterprise**.
70
− 1. Set **Profile Type** to **Fully Managed, Dedicated, and Corporate-Owned Work Profile Only**.
71
− 1. Set **Targeted app** to **Microsoft Defender**.
72
−
73
− :::image type="content" source="media/how-to-install-android-client/create-policy-basics.png" alt-text="Screenshot of the Basics tab in the pane for creating an app configuration policy." lightbox="media/how-to-install-android-client/create-policy-basics-expanded.png":::
74
−
62
+ 1. Enter a **Name**.
63
+ 1. Set the **Platform** to **Android Enterprise**.
64
+ 1. Set the **Profile type** to **Fully Managed, Dedicated, and Corporate-Owned Work Profile Only**.
65
+ 1. Set the **Targeted app** to **Microsoft Defender**.
7566
1. Select **Next**.
67
+:::image type="content" source="media/how-to-install-android-client/create-policy-basics.png" alt-text="Screenshot of the Create app configuration policy on the Basics tab." lightbox="media/how-to-install-android-client/create-policy-basics-expanded.png":::
7668
7769
1. On the **Settings** tab:
78
−
7970
1. Set **Configuration settings format** to **Use configuration designer**.
80
− 1. Select the **+ Add** button.
81
− 1. In the search box, type **global** and select the Global Secure Access configuration keys listed in the following table.
82
− 1. Set the appropriate values for each configuration key according to the following table.
83
−
84
− > [!NOTE]
85
− > The Android configuration keys differ from the iOS client keys. On Android, use `Global Secure Access` and `GlobalSecureAccessPrivateChannel` as shown here. Don't use the iOS key names (`EnableGSA`, `EnableGSAPrivateChannel`).
86
− >
87
− > The `GlobalSecureAccessPA` configuration key is no longer supported.
88
−
89
− | Configuration key | Value | Details |
90
− |----------------------------------|----------|-----------|
91
− | `Global Secure Access` | No value | Global Secure Access isn't enabled and the tile isn't visible. |
92
− | | `0` | Global Secure Access isn't enabled and the tile isn't visible. |
93
− | | `1` | The tile is visible and defaults to `false` (disabled state). The user can enable or disable Global Secure Access by using the toggle in the app. |
94
− | | `2` | The tile is visible and defaults to `true` (enabled state). The user can override Global Secure Access. The user can enable or disable Global Secure Access by using the toggle in the app. |
95
− | | `3` | The tile is visible and defaults to `true` (enabled state). The user *can't* disable Global Secure Access. |
96
− | `GlobalSecureAccessPrivateChannel` | No value | Global Secure Access defaults to value `2` behavior. |
97
− | | `0` | Private Access isn't enabled and the toggle option isn't visible to the user. |
98
− | | `1` | The Private Access toggle is visible and defaults to the disabled state. The user can enable or disable Private Access. |
99
− | | `2` | The Private Access toggle is visible and defaults to the enabled state. The user can enable or disable Private Access. |
100
− | | `3` | The Private Access toggle is visible but unavailable, and it defaults to the enabled state. The user *can't* disable Private Access. |
71
+ 1. Add the Global Secure Access configuration keys:
72
+ 1. Select the **+ Add** button.
73
+ 1. In the search field, type `global` and select the configuration keys listed in the following table:
74
+ - **Global Secure Access** (this key is required to enable Global Secure Access).
75
+ - **GlobalSecureAccessPrivateChannel** (this optional key enables Global Secure Access Private channel).
76
+ 1. Set the appropriate values for each configuration key according to the following table:
10177
102
− :::image type="content" source="media/how-to-install-android-client/create-policy-settings.png" alt-text="Screenshot of the Settings tab in the pane for creating an app configuration policy." lightbox="media/how-to-install-android-client/create-policy-settings-expanded.png":::
78
+ > [!NOTE]
79
+ > The Android configuration keys differ from the iOS client keys. On Android, use `Global Secure Access` and `GlobalSecureAccessPrivateChannel` as shown here. Don't use the iOS key names (`EnableGSA`, `EnableGSAPrivateChannel`).
80
+
81
+ | Configuration key | Value | Details |
82
+ |----------------------------------|----------|-----------|
83
+ | Global Secure Access | No value | Global Secure Access isn't enabled and the tile isn't visible. |
84
+ | | 0 | Global Secure Access isn't enabled and the tile isn't visible. |
85
+ | | 1 | The tile is visible and defaults to false (disabled state). The user can enable or disable Global Secure Access using the toggle in the app. |
86
+ | | 2 | The tile is visible and defaults to true (enabled state). The user can override Global Secure Access. The user can enable or disable Global Secure Access using the toggle in the app. |
87
+ | | 3 | The tile is visible and defaults to true (enabled state). The user **can't** disable Global Secure Access. |
88
+ | GlobalSecureAccessPrivateChannel | No value | Global Secure Access defaults to value 2 behavior. |
89
+ | | 0 | Private Access isn't enabled and the toggle option isn't visible to the user. |
90
+ | | 1 | The Private Access toggle is visible and defaults to the disabled state. The user can enable or disable Private Access. |
91
+ | | 2 | The Private Access toggle is visible and defaults to the enabled state. The user can enable or disable Private Access. |
92
+ | | 3 | The Private Access toggle is visible but grayed out, and defaults to the enabled state. The user **can't** disable Private Access. |
10393
104
−1. Select **Next**.
94
+ > [!NOTE]
95
+ > The **GlobalSecureAccessPA** configuration key is no longer supported.
10596
106
−1. On the **Scope tags** tab, configure scope tags as needed and then select **Next**.
97
+6. Select **Next**.
98
+:::image type="content" source="media/how-to-install-android-client/create-policy-settings.png" alt-text="Screenshot of the Create app configuration policy on the Settings tab." lightbox="media/how-to-install-android-client/create-policy-settings-expanded.png":::
10799
100
+1. On the **Scope tags** tab, configure scope tags as needed and select **Next**.
108101
1. On the **Assignments** tab, select **+ Add groups** to assign the configuration policy and enable Global Secure Access.
109
−
110
− :::image type="content" source="media/how-to-install-android-client/create-policy-assignments.png" alt-text="Screenshot of the Assignments tab in the pane for creating an app configuration policy." lightbox="media/how-to-install-android-client/create-policy-assignments-expanded.png":::
111
−
112
− > [!TIP]
113
− > To enable the policy for all but a few specific users, select **Add all devices** in the **Included groups** section. Then, add the users or groups to exclude in the **Excluded groups** section.
102
+:::image type="content" source="media/how-to-install-android-client/create-policy-assignments.png" alt-text="Screenshot of the Create app configuration policy on the Assignments tab." lightbox="media/how-to-install-android-client/create-policy-assignments-expanded.png":::
114103
115
−1. Select **Next**.
104
+> [!TIP]
105
+> To enable the policy for all but a few specific users, select **Add all devices** in the **Included groups** section. Then, add the users or groups to exclude in the **Excluded groups** section.
116106
117
−1. Review the configuration summary, and then select **Create**.
107
+9. Select **Next**.
108
+1. Review the configuration summary and select **Create**.
118109
119110
## Confirm Global Secure Access appears in the Defender app
120111
121
−Because the Android client is integrated with Defender for Endpoint, it's helpful to understand the user experience. The client appears in the Defender dashboard after you onboard to Global Secure Access. Onboarding happens by enabling a traffic forwarding profile.
112
+Because the Android client is integrated with Defender for Endpoint, it's helpful to understand the end user experience. The client appears in the Defender dashboard after onboarding to Global Secure Access. Onboarding happens by enabling a traffic forwarding profile.
122113
123
−
114
+
124115
125
−*The client is disabled by default when it's deployed to user devices.* Users need to enable the client from the Defender app. To enable the client, tap the toggle.
116
+**The client is disabled by default when it's deployed to user devices.** Users need to enable the client from the Defender app. To enable the client, tap the toggle.
126117
127118
128119
129
−To view client details, tap the tile on the dashboard. When the client is enabled and working properly, the dashboard displays an "Enabled" message. It also shows the date and time when the client connected to Global Secure Access.
120
+To view client details, tap the tile on the dashboard. When enabled and working properly, the client displays an "Enabled" message. It also shows the date and time when the client connected to Global Secure Access.
130121
131122
132123
133124
If the client can't connect, a toggle appears to disable the service. Users can return later to enable the client.
134125
135
−
126
+
136127
137128
## Troubleshooting
138129
139
−If the Global Secure Access tile doesn't appear after you onboard the tenant to the service, restart the Defender app.
130
+If the Global Secure Access tile doesn't appear after onboarding the tenant to the service, restart the Defender app.
140131
141132
When you try to access a Private Access application, the connection might time out after a successful interactive sign-in. Reload the application by refreshing the web browser.
142133
143134
## Related content
144
−
145
−- [Microsoft Defender for Endpoint on Android](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-android)
135
+- [About Microsoft Defender for Endpoint on Android](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-android)
146136
- [Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune](/microsoft-365/security/defender-endpoint/android-intune)
147
−- [Add managed Google Play apps to Android Enterprise devices with Intune](/mem/intune/apps/apps-add-android-for-work)
148
−- [Install the Global Secure Access client for Windows](how-to-install-windows-client.md)
149
−- [Install the Global Secure Access client for macOS](how-to-install-macos-client.md)
150
−- [Install the Global Secure Access client for iOS](how-to-install-ios-client.md)
137
+- [Learn about managed Google Play apps and Android Enterprise devices with Intune](/mem/intune/apps/apps-add-android-for-work)
138
+- [Global Secure Access client for Microsoft Windows](how-to-install-windows-client.md)
139
+- [Global Secure Access client for macOS](how-to-install-macos-client.md)
140
+- [Global Secure Access client for iOS](how-to-install-ios-client.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:16 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.