GSA iOS client deployment

This page's changes and edits · All guidance changes

Microsoft's edit · 14 Oct 2025 00:13 UTC

Oct 13 added Kerberos feature to mobile client articles

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 9cd76e4 · +18 ~~−17~~ lines · also on GitHub

11 ---

22 title: The Global Secure Access Client for iOS (Preview)

33 description: The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the iOS client app.

4 +#customer intent: As an IT admin, I want to set up and deploy the Global Secure Access client for iOS devices so that I can secure network traffic for my organization.

45 ms.service: global-secure-access

56 ms.topic: how-to

6 −ms.date: 09/08/2025

7 +ms.date: 10/13/2025

78 ms.author: jayrusso

89 author: HULKsmashGithub

910 manager: dougeby

1011 ms.reviewer: cagautham

1112 ms.custom: sfi-image-nochange

12 −# Customer intent: As an administrator, I want to set up and deploy the Global Secure Access mobile client for iOS devices.

13 +

1314 ---

15 +

1416 # Global Secure Access client for iOS (Preview)

1517 > [!IMPORTANT]

1618 > The Global Secure Access client for iOS is currently in PREVIEW.

1719 > This information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.

1820

19 −This article explains how to set up and deploy the Global Secure Access client app onto iOS and iPadOS devices. For simplicity, this article refers to both iOS and iPadOS as **iOS**.

21 +This article explains how to set up and deploy the Global Secure Access client app on iOS and iPadOS devices. For simplicity, this article refers to both iOS and iPadOS as **iOS**.

2022

2123 > [!CAUTION]

2224 > Running other third-party endpoint protection products alongside Defender for Endpoint on iOS is likely to cause performance problems and unpredictable system errors.

2325 > [!NOTE]

24 −> - The Global Secure Access client is deployed via Microsoft Defender for Endpoint on iOS.

26 +> - The Global Secure Access client is deployed through Microsoft Defender for Endpoint on iOS.

2527 > - The Global Secure Access client on iOS uses a VPN. This VPN isn't a regular VPN. Instead, it's a local/self-looping VPN.

2628

2729 ## Prerequisites

2830 - To use the Global Secure Access iOS client, configure the iOS endpoint device as a Microsoft Entra registered device.

2931 - To enable Global Secure Access for your tenant, refer to the [Licensing requirements](overview-what-is-global-secure-access.md#licensing-overview). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).

3032 - Onboard the tenant to Global Secure Access and configure one or more traffic forwarding profiles. For more information, see [Access the Global Secure Access area of the Microsoft Entra admin center](quickstart-access-admin-center.md).

33 +- To enable a Kerberos SSO experience, create and deploy a profile for the iOS [Single sign-on app extension](/intune/intune-service/configuration/ios-device-features-settings#single-sign-on-app-extension).

3134

3235 ## Requirements

3336 ### Network requirements

⋯ 4 unchanged lines

3841

3942 ### System requirements

4043 The iOS device (phone or tablet) must meet the following requirements:

41 −- The device has iOS 15.0 or newer installed.

42 −- The device has the Microsoft Authenticator app or the Intune Company Portal app installed.

44 +- The device runs iOS 15.0 or newer.

45 +- The device has the Microsoft Authenticator app or the Intune Company Portal app.

4346 - The device is enrolled to enforce Intune device compliance policies.

4447

4548 ## Supported modes

46 −The Global Secure Access client for iOS supports installation on both modes of enrolled devices: supervised and unsupervised devices.

49 +The Global Secure Access client for iOS supports installation on both modes of enrolled devices: supervised and unsupervised.

4750

4851 ## Known limitations

4952

⋯ 1 unchanged line

5154

5255 ## Installation Steps

5356 ### Deploy on Device Administrator enrolled devices with Microsoft Intune

54 −1. In the [Microsoft Intune admin center](https://intune.microsoft.com/#home), go to **Apps** > **iOS/iPadOS** > **Add** > **iOS store app** and

55 −select **Select**.

57 +1. In the [Microsoft Intune admin center](https://intune.microsoft.com/#home), go to **Apps** > **iOS/iPadOS** > **Add** > **iOS store app** and select **Select**.

5658 :::image type="content" source="media/how-to-install-ios-client/ios-client-add-ios-store-app.png" alt-text="Screenshot of the Microsoft Intune admin center with the steps to add an iOS store app highlighted.":::

5759

5860 1. On the **Add app** page, select **Search the App Store** and type **Microsoft Defender** in the search bar.

5961 1. In the search results, select **Microsoft Defender** and select **Select**.

60 −1. Select **iOS 15.0** as the minimum operating system. Review the rest of information about the app and select **Next**.

62 +1. Select **iOS 15.0** as the minimum operating system. Review the rest of the information about the app, and select **Next**.

6163 1. In the **Assignments** section, go to the **Required** section and select **Add group**.

6264 :::image type="content" source="media/how-to-install-ios-client/ios-client-add-group.png" alt-text="Screenshot of the Add App screen with the Add group option highlighted.":::

6365

64 −1. Choose the user groups that you would like to target with the Defender for Endpoint on iOS app.

66 +1. Choose the user groups to target with the Defender for Endpoint on iOS app.

6567 > [!NOTE]

6668 > The selected user group should consist of Microsoft Intune enrolled users.

6769

6870 7. Select **Select** and then **Next**.

69 −1. In the **Review + Create** section, verify that all the information entered is correct and then

70 −select **Create**. After a few moments, the Defender for Endpoint app is created successfully, and a notification appears at the top-right corner of the page.

71 +1. In the **Review + Create** section, verify that all the information entered is correct and then select **Create**. After a few moments, the Defender for Endpoint app is created successfully, and a notification appears at the top-right corner of the page.

7172 1. On the app information page, in the **Monitor** section, select **Device install status** to verify that the device installation is completed successfully.

7273 :::image type="content" source="media/how-to-install-ios-client/ios-client-device-install-status.png" alt-text="Screenshot of the Device install status screen showing a list of installed devices.":::

7374

⋯ 37 unchanged lines

111112 - Set **I want to do the following** to **Connect VPN**.

112113 - Set **I want to restrict** to **All domains**.

113114 :::image type="content" source="media/how-to-install-ios-client/ios-client-set-up-vpn.png" alt-text="Screenshot of the VPN screen showing example setup parameters.":::

114 −1. To prevent end users from disabling VPN, set **Block users from disabling automatic VPN** to **Yes**. By default, this setting isn't configured and users can disable VPN only in the Settings.

115 +1. To prevent end users from disabling VPN, set **Block users from disabling automatic VPN** to **Yes**. By default, this setting isn't configured, and users can disable VPN only in the settings.

115116 1. Select **Next** and assign the profile to targeted users.

116117 1. In the **Review + Create** section, verify that all the information is correct and then select **Create**.

117118

⋯ 3 unchanged lines

121122 - A provisional notification is sent to the user device.

122123 - Global Secure Access and other Microsoft Defender for Endpoint (MDE)-configured features are activated.

123124

124 −## Confirm Global Secure Access appears in Defender app

125 +## Confirm Global Secure Access appears in the Defender app

125126 Because the Global Secure Access client for iOS is integrated with Microsoft Defender for Endpoint, it's helpful to understand the end user experience. The client appears in the Defender dashboard after onboarding to Global Secure Access.

126127 :::image type="content" source="media/how-to-install-ios-client/ios-defender-dashboard.png" alt-text="Screenshot of the iOS Microsoft Defender dashboard.":::

127128

128 −You can enable or disable the Global Secure Access client for iOS by setting the **EnableGSA** key in the [VPN profile](#create-a-vpn-profile-and-configure-global-secure-access-for-microsoft-defender-for-endpoint). Depending on the configuration settings, end users can enable or disable individual **Services** or the client itself using the appropriate toggles.

129 +You can enable or disable the Global Secure Access client for iOS by setting the **EnableGSA** key in the [VPN profile](#create-a-vpn-profile-and-configure-global-secure-access-for-microsoft-defender-for-endpoint). End users can enable or disable individual **Services** or the client itself based on the configuration settings, using the appropriate toggles.

129130 :::image type="content" source="media/how-to-install-ios-client/ios-client-enabled-disabled.png" alt-text="Screenshot of the Global Secure Access client on iOS showing both the Enabled and Disabled status screens.":::

130131

131132 If the client is unable to connect, a toggle appears to disable the service. Users can come back later to try enabling the client.

132 −:::image type="content" source="media/how-to-install-ios-client/ios-unable-to-connect.png" alt-text="Screenshot of the Global Secure Access client on iOS showing the message, Unable to connect.":::

133 +:::image type="content" source="media/how-to-install-ios-client/ios-unable-to-connect.png" alt-text="Screenshot of the Global Secure Access client on iOS showing the message 'Unable to connect.'":::

133134

134135 ## Troubleshooting

135136 - The Global Secure Access tile doesn't appear in the Defender app after onboarding the tenant:

⋯ 10 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:31 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.