GSA known limitations
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 6738339 · +4 −5 lines · also on GitHub
⋯ 4 unchanged lines
55
author: HULKsmashGithub
66
ms.topic: reference
77
ms.author: jayrusso
8
−ms.date: 11/07/2025
8
+ms.date: 02/24/2026
99
ms.custom: agent-id-ignite
1010
1111
⋯ 140 unchanged lines
152152
return "PROXY 10.1.0.10:8080"; // forward the connection to the proxy
153153
}
154154
```
155
−If a direct internet connection isn't possible, configure the client to connect to the Global Secure Access service through a proxy. For example, set the `grpc_proxy` system variable to match the value of the proxy, such as `http://proxy:8080`.
156
−
157
−To apply the configuration changes, restart the Global Secure Access client Windows services.
155
+> [!IMPORTANT]
156
+> If the Global Secure Access client is behind an outbound proxy, configure the PAC file exclusions as described previously to bypass the proxy for Global Secure Access traffic.
158157
159158
#### Packet injection
160159
The client only tunnels traffic sent using sockets. It doesn't tunnel traffic injected to the network stack using a driver (for example, some of the traffic generated by Network Mapper (Nmap)). Injected packets go directly to the network.
⋯ 60 unchanged lines
221220
Known limitations for remote networks include:
222221
- The maximum number of remote networks per tenant is 200, and the maximum number of device links per remote network is 25. To increase these limits further for your tenant, contact Microsoft Support.
223222
- Universal Conditional Access lets you apply identity controls like requiring multifactor authentication, requiring a compliant device, or defining an acceptable sign-in risk to network traffic—not just cloud apps. These identity controls apply to devices with the Global Secure Access client installed. Remote network connectivity is a clientless approach where customers create an IPsec tunnel from their on-premises equipment to the Global Secure Access edge service. Network traffic from all devices at that remote network (or branch office) is sent to Global Secure Access through the IPsec tunnel. In other words, Conditional Access policies for Microsoft or Internet traffic are only enforced when a user has the Global Secure Access client.
224
−- Use the Global Secure Access client for Microsoft Entra Private Access. Remote network connectivity supports only Microsoft Entra Internet Access.
223
+- Use the Global Secure Access client for Microsoft Entra Private Access. Remote network connectivity supports the Microsoft traffic and Internet Access traffic forwarding profiles.
225224
- Internet over remote network connectivity is supported only in the specific regions listed in the **Region** drop-down when you create a remote network.
226225
- The [Custom Bypass](how-to-manage-internet-access-profile.md#internet-access-traffic-forwarding-profile-policies) feature in the Internet traffic forwarding profile doesn't work with remote network connectivity. You must manually bypass specific URLs from your Customer Premises Equipment (CPE).
227226
⋯ 52 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:20 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.