GSA known limitations

This page's changes and edits · All guidance changes

Microsoft's edit · 6 Nov 18:34 UTC

Use Custom Acquire and cloud firewall instead of disabling browser QUIC (#14776)

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 866f302 · +6 −5 lines · also on GitHub

Inline diff Before After

⋯ 2 unchanged lines

33 ms.reviewer: teresayao

44 description: Discover the known limitations of Global Secure Access, including platform-specific issues and mitigations, to ensure seamless deployment and management.

55 ms.topic: reference

6 −ms.date: 09/29/2026

6 +ms.date: 11/03/2026

77 ms.custom: agent-id-ignite, msecd-doc-authoring-1026

88 ai-usage: ai-assisted

⋯ 151 unchanged lines

161161 The Global Secure Access client doesn't support concurrent sessions on the same machine. This limitation applies to Remote Desktop Protocol (RDP) servers and Virtual Desktop Infrastructure (VDI) solutions like Azure Virtual Desktop (AVD) that are configured for multi-session.

162162

163163 #### QUIC not supported for Internet Access

164 −Since QUIC isn't yet supported for Internet Access, traffic to ports 80 UDP and 443 UDP can't be tunneled.

164 +End-to-end QUIC forwarding isn't supported in Internet Access. Cloud firewall for clients supports QUIC acquisition and blocking in preview.

165165 > [!TIP]

166166 > QUIC is currently supported in Private Access and Microsoft 365 workloads.

167167

168 −Administrators can disable QUIC protocol triggering clients to fall back to HTTPS over TCP, which is fully supported in Internet Access. For more information, see [QUIC not supported for Internet Access](troubleshoot-global-secure-access-client-diagnostics-health-check.md#quic-not-supported-for-internet-access).

168 +Keep QUIC enabled in browsers. Use **Custom Acquire** to acquire UDP traffic on destination port `443` for the intended destinations, and use cloud firewall to block that traffic. Apply the firewall policy through the security profile for the intended users. Applications that support fallback can then use HTTPS over TCP. **Default Acquire** on TCP port `443` doesn't acquire UDP port `443`, and an **Allow** rule doesn't enable supported end-to-end QUIC forwarding. For configuration and verification steps, see [Control QUIC traffic on UDP port 443](how-to-configure-cloud-firewall-clients.md#control-quic-traffic-on-udp-port-443).

169169

170170 #### WSL 2 connectivity

171171 When the Global Secure Access client for Windows is enabled on the host machine, outgoing connections from the Windows Subsystem for Linux (WSL) 2 environment might be blocked. To fix this issue, create a `.wslconfig` file that sets dnsTunneling to **false**. This way, all traffic from the WSL bypasses Global Secure Access and goes directly to the network. For more information, see [Advanced settings configuration in WSL](/windows/wsl/wsl-config#wslconfig).

⋯ 20 unchanged lines

192192 - If the network is in **shared** mode, you can install the Global Secure Access client on a virtual machine running macOS, as long as the client isn't also installed on the host machine.

193193

194194 #### QUIC not supported for Internet Access

195 −Since QUIC isn't yet supported for Internet Access, traffic to ports 80 UDP and 443 UDP can't be tunneled.

195 +End-to-end QUIC forwarding isn't supported in Internet Access. Cloud firewall for clients supports QUIC acquisition and blocking in preview.

196196 > [!TIP]

197197 > QUIC is currently supported in Private Access and Microsoft 365 workloads.

198 −Administrators can disable QUIC protocol on browsers, triggering clients to fall back to HTTPS over TCP, which is fully supported in Internet Access. For more information, see [QUIC not supported for Internet Access](troubleshoot-global-secure-access-client-diagnostics-health-check.md#quic-not-supported-for-internet-access).

198 +

199 +Keep QUIC enabled in browsers. Use **Custom Acquire** to acquire UDP traffic on destination port `443` for the intended destinations, and use cloud firewall to block that traffic. Apply the firewall policy through the security profile for the intended users. Applications that support fallback can then use HTTPS over TCP. **Default Acquire** on TCP port `443` doesn't acquire UDP port `443`, and an **Allow** rule doesn't enable supported end-to-end QUIC forwarding. For configuration and verification steps, see [Control QUIC traffic on UDP port 443](how-to-configure-cloud-firewall-clients.md#control-quic-traffic-on-udp-port-443).

199200

200201 ### [Android client](#tab/android-client)

201202 Known limitations for the Global Secure Access client for Android include:

⋯ 85 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 7 Nov 06:39 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.