Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 00:57 UTC Customize Public modeDiscuss ChangeIntel on Discord

GSA client EDR and antivirus coexistence

This page's changes and edits · All guidance changes

Microsoft's edit ·

TOC updates required by AI merger bot

Microsoft's commit message in MicrosoftDocs/entra-docs · commit c906258 · +36 −0 lines · also on GitHub

The file is new at this commit, or was moved here from another path: every line shows as added.

1 +---
2 +title: EDR and antivirus coexistence with Global Secure Access client
3 +description: Learn about endpoint detection and response and antivirus solution coexistence with Global Secure Access client.
4 +author: jricketts
5 +ms.author: jricketts
6 +ms.topic: concept-article
7 +ms.date: 03/28/2025
8 +
9 +#CustomerIntent: As an administrator, I want to configure endpoint detection and response and antivirus solution coexistence with Global Secure Access client so that I can improve system performance.
10 +---
11 +# Configure endpoint detection and response and antivirus solution coexistence with Global Secure Access client
12 +
13 +Running antivirus solutions such as Microsoft Defender for Endpoint side by side with the Global Secure Access client can affect system performance. If your system experiences [high CPU usage or performance issues](/defender-endpoint/troubleshoot-performance-issues), exclude Global Secure Access client processes from your antivirus solution.
14 +
15 +## Configuration overview
16 +
17 +In your antivirus solution, configure exclusions and bypasses for all Global Secure Access client processes:
18 +
19 +- `C:\Program Files\Global Secure Access Client\GlobalSecureAccessClientManagerService.exe`
20 +- `C:\Program Files\Global Secure Access Client\GlobalSecureAccessEngineService.exe`
21 +- `C:\Program Files\Global Secure Access Client\GlobalSecureAccessETLController.exe`
22 +- `C:\Program Files\Global Secure Access Client\GlobalSecureAccessTunnelingService.exe`
23 +- `C:\Program Files\Global Secure Access Client\TrayApp\GlobalSecureAccessClient.exe`
24 +- `C:\Program Files\Global Secure Access Client\PolicyService\GlobalSecureAccessPolicyRetrieverService.exe`
25 +- `C:\Program Files\Global Secure Access Client\LogsCollector\LogsCollector.exe`
26 +- `C:\Program Files\Global Secure Access Client\AuthenticationRunner\GlobalSecureAccessAuthenticationRunner.exe`
27 +- `C:\Program Files\Global Secure Access Client\AdvancedDiagnostics\GlobalSecureAccessClientAdvancedDiagnostics.exe`
28 +
29 +To exclude these processes from Microsoft Defender for Endpoint, see [Configure custom exclusions for Microsoft Defender Antivirus](/defender-endpoint/configure-exclusions-microsoft-defender-antivirus).
30 +
31 +## Next steps
32 +
33 +- Install the Windows client: [The Global Secure Access Client for Windows - Global Secure Access \| Microsoft Learn](how-to-install-windows-client.md)
34 +- Install the macOS client: [The Global Secure Access Client for macOS - Global Secure Access \| Microsoft Learn](how-to-install-macos-client.md)
35 +- Install the Android client: [The Global Secure Access Client for Android - Global Secure Access \| Microsoft Learn](how-to-install-android-client.md)
36 +- Install the iOS client: [The Global Secure Access Client for iOS (Preview) - Global Secure Access \| Microsoft Learn](how-to-install-ios-client.md)

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 17:01 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 21 Oct 00:57 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current