GSA Android client deployment
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit f89d3de · +43 −75 lines · also on GitHub
⋯ 2 unchanged lines
33
description: The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the Android client app.
44
ms.service: global-secure-access
55
ms.topic: how-to
6
−ms.date: 02/25/2025
6
+ms.date: 08/08/2025
77
ms.author: jayrusso
88
author: HULKsmashGithub
99
manager: dougeby
10
−ms.reviewer: dhruvinrshah
10
+ms.reviewer: cagautham
1111
ms.custom: sfi-image-nochange
1212
# Customer intent: As an administrator, I want to set up and deploy the Global Secure Access mobile client for Android devices.
1313
---
⋯ 32 unchanged lines
4646
4747
## Deploy Microsoft Defender for Endpoint Android
4848
49
−There are several combinations of deployment modes and scenarios for using the Global Secure Access client for Android.
50
−
51
−Once you enable a traffic forwarding profile and configure your network, the Global Secure Access Android client appears in the Defender app automatically; however, the Global Secure Access client is disabled by default. Users can enable the client from the Defender app. The steps to enable the client are provided in the [Confirm Global Secure Access appears in Defender app](#confirm-global-secure-access-appears-in-defender-app) section.
52
−
53
−### [Device Administrator](#tab/device-administrator)
54
−
55
−This legacy enrollment mode allows you to deploy Defender for Endpoint on Android with Microsoft Intune Company Portal - Device Administrator enrolled devices.
56
−
57
−The high level process is as follows:
58
−
59
−1. Deploy Defender to Intune enrolled Android devices.
60
−
61
−1. [Enable at least one traffic forwarding profile](concept-traffic-forwarding.md) if Defender is already deployed.
62
−
63
−1. [Confirm Global Secure Access appears in the Defender app](#confirm-global-secure-access-appears-in-defender-app).
64
−
65
−The detailed process for deploying Defender is as follows:
66
−
67
−1. Sign in to the [Microsoft Intune admin center](https://intune.microsoft.com/) as an [Intune Administrator](../identity/role-based-access-control/permissions-reference.md#intune-administrator).
68
−1. Browse to **Apps** > **Android** > **Add** > **Android store app** > **Select**.
69
−
70
− 
71
−
72
−1. Provide a **Name**, **Description**, and **Publisher**.
73
−1. Enter the URL in the **Appstore URL** field.
74
− - `https://play.google.com/store/apps/details?id=com.microsoft.scmx`
75
−1. Leave all other fields as their default values and select **Next**.
76
−
77
− 
78
−
79
−1. In the **Required** section, select **Add group**, then select the groups to assign the app to and select **Next**.
80
− - The selected group should consist of your Intune enrolled users.
81
− - You can edit or add more groups later.
82
−
83
− 
84
−
85
−1. On the **Review + create** tab, confirm the information is correct and select **Create**.
86
−1. On the new app details page, select **Device install status** and confirm the app is installed.
87
−
88
−**Users need to enable the client in the Defender app. It's disabled by default.** Proceed to the next section to confirm the app is installed and for how to enable the client.
89
−
90
−### [Android Enterprise](#tab/android-enterprise)
91
−
92
−Follow these steps to add the Microsoft Defender for Endpoint app into your managed Google Play store.
93
−
94
−The high level process is as follows:
95
−
96
−1. Deploy Defender on Android Enterprise enrolled devices.
97
−
98
−1. [Enable at least one traffic forwarding profile](concept-traffic-forwarding.md).
99
−
100
−1. [Confirm Global Secure Access appears in the Microsoft Defender for Endpoint app](#confirm-global-secure-access-appears-in-defender-app).
101
−
102
−The detailed process for deploying to the Google Play store is as follows:
103
−
104
−1. Sign in to the [Microsoft Intune admin center](https://intune.microsoft.com/) as an [Intune Administrator](../identity/role-based-access-control/permissions-reference.md#intune-administrator).
105
−1. Browse to **Apps** > **Android** > **Add** > **Managed Google Play app** > **Select**.
106
−
107
− 
108
−
109
−1. On the managed Google Play page, search for **Microsoft Defender** and select it from the search results.
110
−1. On the details page for Microsoft Defender, select the **Select** button.
111
−1. Select the **Sync** button in the upper-left corner. This step syncs Defender with your apps list.
49
+You can use the Global Secure Access client for Android in different deployment modes and scenarios.
11250
113
− 
51
+After you enable a traffic forwarding profile and configure your network, the Global Secure Access Android client appears in the Defender app automatically. However, the Global Secure Access client is disabled by default. Users can enable the client from the Defender app. To learn how, see [Confirm Global Secure Access appears in Defender app](#confirm-global-secure-access-appears-in-defender-app).
11452
115
−1. Select the **Refresh** button on the Android apps screen so Microsoft Defender for Endpoint appears in the list.
116
−1. Select **Microsoft Defender** from the app list and browse to **Properties** > **Assignments** > **Edit**.
53
+You can enable the client using Android Enterprise enrollment mode. This mode supports corporate-owned, fully managed devices, corporate-owned devices with a work profile, and personal devices with a work profile.
11754
118
− 
55
+### Create an MDM profile and configure Global Secure Access for Microsoft Defender for Endpoint
11956
120
−1. In the **Required** section, select **Add group**, then select the groups to assign the app to and select **Next**.
121
−1. Select **Review + save** and once the details are confirmed, select **Save**.
57
+1. In the [Microsoft Intune admin center](https://intune.microsoft.com/#home), go to **Apps** > **Android** > **Manage Apps** > **Configuration**.
58
+1. Select the **+ Create** and then select **Managed devices**. The **Create app configuration policy** form opens.
59
+1. On the **Basics** tab:
60
+ 1. Enter a **Name**.
61
+ 1. Set the **Platform** to **Android Enterprise**.
62
+ 1. Set the **Profile type** to **Fully Managed, Dedicated, and Corporate-Owned Work Profile Only**.
63
+ 1. Set the **Targeted app** to **Microsoft Defender**.
64
+1. Select **Next**.
65
+1. On the **Settings** tab:
66
+ 1. Set **Configuration settings format** to **Use configuration designer**.
67
+ 1. Use the JSON editor to configure the disabled configuration keys. Select the **+Add** button.
68
+ 1. In the search field, type `global` and select these configuration keys:
69
+ - **Global Secure Access** (this key is required to enable Global Secure Access).
70
+ - **GlobalSecureAccessPrivateChannel** (this optional key enables Global Secure Access Private channel).
71
+ 1. Set the appropriate values for each configuration key according to the following table:
72
+
73
+| Configuration key | Value | Details |
74
+|----------------------------------|----------|-----------|
75
+| Global Secure Access | No value | Global Secure Access isn't enabled and the tile isn't visible. |
76
+| | 0 | Global Secure Access isn't enabled and the tile isn't visible. |
77
+| | 1 | The tile is visible and defaults to false (disabled state). The user can enable or disable Global Secure Access using the toggle in the app. |
78
+| | 2 | The tile is visible and defaults to true (enabled state). The user can override Global Secure Access. The user can enable or disable Global Secure Access using the toggle in the app. |
79
+| | 3 | The tile is visible and defaults to true (enabled state). The user **can't** disable Global Secure Access. |
80
+| GlobalSecureAccessPrivateChannel | No value | Global Secure Access defaults to value 2 behavior. |
81
+| | 0 | Private Access isn't enabled and the toggle option isn't visible to the user. |
82
+| | 1 | The Private Access toggle is visible and defaults to the disabled state. The user can enable or disable Private Access. |
83
+| | 2 | The Private Access toggle is visible and defaults to the disabled state. The user can enable or disable Private Access. |
84
+| | 3 | The Private Access toggle is visible but grayed out, and defaults to the enabled state. The user **can't** disable Private Access. |
12285
123
− 
86
+> [!NOTE]
87
+> The **GlobalSecureAccessPA** configuration key is deprecated.
12488
125
−After you assign a group, the app is automatically installed in the *work profile* during the next sync of the device via the Company Portal app.
89
+6. Select **Next**.
90
+1. On the **Scope tags** tab, configure scope tags as needed and select **Next**.
91
+1. On the **Assignments** tab, select **+ Add groups** to assign the configuration policy and enable Global Secure Access.
12692
127
−**Users need to enable the client in the Defender app. It's disabled by default.** Proceed to the next section to confirm the app is installed and for how to enable the client.
93
+> [!TIP]
94
+> To enable the policy for all but a few specific users, select **Add all devices** in the **Included groups** section, and then add the users or groups to exclude in the **Excluded groups** section.
12895
129
−---
96
+9. Select **Next**.
97
+1. Review the configuration summary and select **Create**.
13098
13199
## Confirm Global Secure Access appears in Defender app
132100
⋯ 29 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 17:01 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.