GSA known limitations

This page's changes and edits · All guidance changes

Microsoft's edit · 30 Sep 04:19 UTC

Update macOS Secure DNS limitation

Microsoft's commit message in MicrosoftDocs/entra-docs · commit cb5ca1c · +11 −5 lines · also on GitHub

⋯ 2 unchanged lines

33 ms.reviewer: teresayao

44 description: Discover the known limitations of Global Secure Access, including platform-specific issues and mitigations, to ensure seamless deployment and management.

55 ms.topic: reference

6 −ms.date: 05/29/2026

7 −ms.custom: agent-id-ignite

6 +ms.date: 09/29/2026

7 +ms.custom: agent-id-ignite, msecd-doc-authoring-1026

8 +ai-usage: ai-assisted

910

10 −# Customer intent: As an administrator, I want to access the known limitations for Global Secure Access in one place. This article gathers all known issues and limitations into a single reference point. Global Secure Access articles with a "known limitations" section point to this article.

11 +#customer intent: As an administrator, I want to review Global Secure Access limitations so that I can plan deployments and mitigate known issues.

1112 ---

1213

1314 # Known limitations for Global Secure Access

⋯ 159 unchanged lines

173174 Known limitations for the Global Secure Access client for macOS include:

174175

175176 #### Secure Domain Name System (DNS)

176 −If Secure DNS is enabled on the browser or in macOS and the DNS server supports Secure DNS, then the client doesn't tunnel traffic set to be acquired by FQDN. (Network traffic that's acquired by IP isn't affected and is tunneled according to the forwarding profile.) To mitigate the Secure DNS issue, disable Secure DNS, set a DNS server that doesn't support Secure DNS, or create rules based on IP.

177 +The Global Secure Access client doesn't currently support secure DNS in its different versions, such as DNS over HTTPS (DoH), DNS over TLS (DoT), or DNS Security Extensions (DNSSEC). The client for macOS bypasses Secure DNS to enforce fully qualified domain name (FQDN)-based tunneling through the traffic forwarding policy. You don't need to disable Secure DNS in the browser or macOS.

177178

178179 #### Connection fallback

179180 If there's a connection error to the cloud service, the client falls back to either direct Internet connection or blocking the connection, based on the ***hardening*** value of the matching rule in the forwarding profile.

⋯ 91 unchanged lines

271272 - The Global Secure Access client doesn't support multi-session Azure Virtual Desktop.

272273

273274 ## Global Secure Access In Government Cloud limitations

274 −Global Secure Access is available in the US Government Community Cloud (GCC), but isn't yet supported in the US Government Community Cloud High (GCC-H), Department of Defense cloud, or other government or sovereign cloud environments.

275 +Global Secure Access is not available in the US Government community cloud High (GCC-H), Department of Defense cloud and other Govt/Sovereign cloud environments.

276 +

277 +For usage in US Government community (GCC) cloud, known limitations/disclaimers include:

278 +

279 +- Non Federal Information Processing Standard (FIPS) 140-2 certified: Note that while the GSA service is FedRAMP High accredited, it is not yet FIPS 140-2 certified. Microsoft is actively working toward achieving FIPS accreditation/certification, and this process is currently underway. Customers should consider this status when evaluating compliance requirements. FIPS 140-2 is a US government standard that defines FedRAMP minimum security requirements for cryptographic modules in products and systems. For more information, see [Federal Information Processing Standard (FIPS) 140](/azure/compliance/offerings/offering-fips-140-2).

280 +- Data Residency Requirements: Customers should carefully consider data residency requirements when evaluating the GSA solution for their needs. When using GSA, there is a possibility that your data (up to and including customer content) may be Transport Layer Security (TLS) terminated and processed outside the United States esp. in cases where the users access GSA while traveling outside of the USA and its territories. Additionally, data may also be TLS terminated and processed outside of the USA when GSA routes traffic through the nearest available edge location, which may be outside USA borders depending on several factors. Factors for TLS termination and processing outside the US may include but not limited to: user’s physical location, proximity to edge locations, network latency, service availability, performance considerations, customer configurations and so on. As an example, a user near a USA border with a non-USA region may connect to a non-USA edge, where data inspection and policy enforcement take place.

275281

276282 ## Explicit Forward Proxy (preview) limitations

277283 Known limitations for Explicit Forward Proxy (preview) include:

⋯ 8 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:20 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.