ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 257/260 feeds/APIs · 416/439 docs · checked 21:54 UTC Customize Public modeDiscuss ChangeIntel on Discord

GSA Windows client health check

This page's changes and edits · All guidance changes

Microsoft's edit ·

Nov 17 removed extra images, completed macOS draft, revised Windows article, and updated TOC

Microsoft's commit message in MicrosoftDocs/entra-docs · commit b798de4 · +40 −39 lines · also on GitHub

11 ---
2 −title: "Troubleshoot the Global Secure Access client: Health check"
2 +title: "Troubleshoot the Windows Global Secure Access client: Health check"
33 description: Troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.
44 ms.service: global-secure-access
55 ms.topic: troubleshooting
6 −ms.date: 02/25/2025
6 +ms.date: 11/17/2025
77 ms.author: jayrusso
88 author: HULKsmashGithub
99 manager: dougeby
⋯ 1 unchanged line
1111 ms.custom: sfi-image-nochange
1212 # Customer intent: I want to troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.
1313 ---
14 −# Troubleshoot the Global Secure Access client: Health check tab
15 −This document provides troubleshooting guidance for the Global Secure Access client using the **Health check** tab in the Advanced diagnostics utility.
14 +# Troubleshoot the Global Secure Access client for Windows: Health check tab
15 +This article provides troubleshooting guidance for the Global Secure Access Windows client using the **Health check** tab in the Advanced diagnostics utility.
1616
1717 ## Introduction
18 −The Advanced diagnostics Health check runs tests to verify that the Global Secure Access client is working correctly and that its components are running.
18 +The Advanced diagnostics Health check runs tests to verify that the Global Secure Access client works correctly and that its components are running.
1919
2020 ## Run the health check
2121 To run a health check for the Global Secure Access client:
⋯ 20 unchanged lines
4242 The following checks verify the health of the Global Secure Access client.
4343
4444 ### Device is Microsoft Entra joined
45 −The Windows client authenticates the user and the device to Global Secure Access services. The device authentication, based on a device token, requires that the device is either Microsoft Entra joined or Microsoft Entra hybrid joined. Microsoft Entra registered devices are currently not supported.
45 +The Windows client authenticates the user and the device to Global Secure Access services. The device authentication, based on a device token, requires that the device is either Microsoft Entra joined or Microsoft Entra hybrid joined. Microsoft Entra registered devices aren't currently supported.
4646 To check the status of your device, enter the following command in the Command Prompt: `dsregcmd.exe /status`.
4747 :::image type="content" source="media/troubleshoot-global-secure-access-client-diagnostics-health-check/troubleshoot-health-entra-joined.png" alt-text="Screenshot of the Command Prompt with the Device State, AzureAdJoined : Yes, highlighted.":::
4848
4949 ### Can connect to the internet
50 −This check indicates whether or not the device is connected to the internet. The Global Secure Access client requires an internet connection. This test is based on the [Network Connectivity Status Indicator (NCSI)](/windows-server/networking/ncsi/ncsi-overview) feature.
50 +This check indicates whether the device is connected to the internet. The Global Secure Access client requires an internet connection. This test is based on the [Network Connectivity Status Indicator (NCSI)](/windows-server/networking/ncsi/ncsi-overview) feature.
5151
5252 ### Tunneling service running
53 −Global Secure Access Tunneling service must be running.
54 −1. To verify that this service running, enter the following command in the Command Prompt:
53 +The Global Secure Access Tunneling service must be running.
54 +1. To verify that this service is running, enter the following command in the Command Prompt:
5555 `sc query GlobalSecureAccessTunnelingService`
5656 1. If the Global Secure Access Tunneling service isn't running, start it from the `services.msc`.
5757 1. If the service fails to start, look for errors in the Event Viewer.
⋯ 7 unchanged lines
6565
6666 ### Policy Retriever service running
6767 The Global Secure Access Policy Retriever service must be running.
68 −1. To verify that this service running, enter the following command in the Command Prompt:
68 +1. To verify that this service is running, enter the following command in the Command Prompt:
6969 `sc query GlobalSecureAccessPolicyRetrieverService`
7070 1. If the Global Secure Access Policy Retriever service isn't running, start it from the `services.msc`.
7171 1. If the service fails to start, look for errors in the Event Viewer.
7272
7373 ### Driver running
7474 The Global Secure Access driver must be running.
75 −To verify that this service running, enter the following command in the Command Prompt:
75 +To verify that this service is running, enter the following command in the Command Prompt:
7676 `sc query GlobalSecureAccessDriver`
7777
7878 If the driver isn't running:
⋯ 32 unchanged lines
111111 1. If the problem still exists, contact Microsoft Support.
112112
113113 ### Break-glass mode disabled
114 −Break-glass mode prevents the Global Secure Access client from tunneling network traffic to the Global Secure Access cloud service. In Break-glass mode, all traffic profiles in the Global Secure Access portal are unchecked and the Global Secure Access client isn't expected to tunnel any traffic.
114 +Break-glass mode prevents the Global Secure Access client from tunneling network traffic to the Global Secure Access cloud service. In break-glass mode, all traffic profiles in the Global Secure Access portal are unchecked and the Global Secure Access client isn't expected to tunnel any traffic.
115115
116116 To set the client to acquire traffic and tunnel that traffic to the Global Secure Access service:
117117
⋯ 4 unchanged lines
122122 The Global Secure Access client should receive the updated forwarding profile within one hour after you make changes in the portal.
123123
124124 ### Diagnostic URLs in forwarding profile
125 −For each channel activated in the forwarding profile, this test checks that the configuration contains a URL to probe the service's health.
126 −
127 −To view the health status, double-click the Global Secure Access client system tray icon.
128 −:::image type="content" source="media/troubleshoot-global-secure-access-client-diagnostics-health-check/troubleshoot-health-client-status.png" alt-text="Screenshot of the Global Secure Access client system tray icon along with the current health status of Connected.":::
125 +For each channel activated in the forwarding profile, this test checks that the configuration contains a URL to probe the service's health. To view the health status, select the system tray icon. On the Connections tab, view the **Status**.
129126
130127 If this test fails, it's usually because of an internal problem with Global Secure Access. Contact Microsoft Support.
131128
132129 ### Authentication certificate exists
133130 This test verifies that a certificate exists on the device for the Mutual Transport Layer Security (mTLS) connection to the Global Secure Access cloud service.
134131 > [!TIP]
135 −> This test doesn't appear if mTLS isn't enabled for your tenant yet.
132 +> This test doesn't appear if you don't enable mTLS for your tenant.
136133
137134 If this test fails, enroll in a new certificate by completing the following steps:
138135 1. Launch the Microsoft Management console by entering the following command in the Command Prompt: `certlm.msc`.
⋯ 11 unchanged lines
150147 ### Authentication certificate is valid
151148 This test verifies that the authentication certificate used for the mTLS connection to the Global Secure Access cloud service is valid.
152149 > [!TIP]
153 −> This test doesn't appear if mTLS isn't enabled for your tenant yet.
150 +> This test doesn't appear if you don't enable mTLS for your tenant.
154151
155152 If this test fails, enroll in a new certificate by completing the following steps:
156153 1. Launch the Microsoft Management console by entering the following command in the Command Prompt: `certlm.msc`.
⋯ 9 unchanged lines
166163 1. Run the Health check tests again.
167164
168165 ### DNS over HTTPS not supported
169 −For the Global Secure Access client to acquire network traffic by a fully qualified domain name (FQDN) destination (as opposed to an IP destination), the client needs to read the DNS requests sent by the device to the DNS server. This means that if the forwarding profile contains FQDN rules, you must disable DNS over HTTPS.
166 +For the Global Secure Access client to acquire network traffic by a fully qualified domain name (FQDN) destination (as opposed to an IP destination), the client needs to read the DNS requests sent by the device to the DNS server. This requirement means that if the forwarding profile contains FQDN rules, you must disable DNS over HTTPS.
170167
171168 #### Secure DNS disabled in OS
172 −To disable DNS over HTTPS in Windows, refer to [Secure DNS Client over HTTPS (DoH)](/windows-server/networking/dns/doh-client-support#configure-the-dns-client-to-support-doh.md).
169 +To disable DNS over HTTPS in Windows, see [Secure DNS Client over HTTPS (DoH)](/windows-server/networking/dns/doh-client-support#configure-the-dns-client-to-support-doh.md).
173170 > [!IMPORTANT]
174171 > You must disable DNS over HTTPS to successfully run the Global Secure Access client Health check.
175172
⋯ 23 unchanged lines
199196 1. In the **DNS over HTTPS** section, select **Off**.
200197
201198 ### DNS Responsive
202 −This test checks whether the DNS server configured to Windows returns a DNS response.
199 +This test checks whether the DNS server configured in Windows returns a DNS response.
203200
204201 If this test fails:
205202 1. Pause the Global Secure Access client.
206 −1. Check if the DNS server configured to Windows is reachable. For example, try resolving "microsoft.com" using the `nslookup` tool.
207 −1. Verify that no firewalls are blocking traffic to the DNS server.
203 +1. Check if the DNS server configured in Windows is reachable. For example, try resolving "microsoft.com" by using the `nslookup` tool.
204 +1. Verify that no firewalls block traffic to the DNS server.
208205 1. Configure an alternate DNS server and test again.
209206 1. Resume the Global Secure Access client.
210207
211208 ### Magic IP received
212 −This check verifies that the client is able to acquire traffic from a fully qualified domain name (FQDN).
209 +This check verifies that the client can acquire traffic from a fully qualified domain name (FQDN).
213210
214211 If the test fails:
215212 1. Restart the client and test again.
216213 1. Restart Windows. This step might be necessary in rare cases to delete volatile cache.
217214
218215 ### Cached token
219 −This test verifies that the client successfully authenticated to Microsoft Entra.
216 +This test verifies that the client successfully authenticates to Microsoft Entra.
220217
221218 If the cached token test fails:
222219 1. Verify that the services and the driver are running.
223220 1. Verify that the system tray icon is visible.
224221 1. If the sign-in notification appears, select **Sign in**.
225 −1. If the sign-in notification doesn't appear, check if it is in the Notification Center and select **Sign in**.
222 +1. If the sign-in notification doesn't appear, check if it's in the Notification Center and select **Sign in**.
226223 1. Sign in with a user that is a member of the same Microsoft Entra tenant that the device is joined to.
227224 1. Verify the network connection.
228 −1. Hover over the system tray icon and verify that the client is **not** disabled by your organization.
225 +1. Hover over the system tray icon and verify that the client **isn't** disabled by your organization.
229226 1. Restart the client and wait for a few seconds.
230227 1. Look for errors in the Event Viewer.
231228
232229 ### IPv4 preferred
233 −Global Secure Access doesn't yet support traffic acquisition for destinations with IPv6 addresses. We recommend that you configure the client to prefer IPv4 over IPv6, if:
230 +Global Secure Access doesn't yet support traffic acquisition for destinations with IPv6 addresses. Configure the client to prefer IPv4 over IPv6 if:
234231 1. The forwarding profile is set to acquire traffic by IPv4 (as opposed to by FQDN).
235 −1. The FQDN resolved to this IP is also resolved to an IPv6 address.
232 +1. The FQDN resolved to this IP also resolves to an IPv6 address.
236233
237234 To configure the client to prefer IPv4 over IPv6, set the following registry key:
238235 `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\
⋯ 29 unchanged lines
268265 1. Try the PowerShell command from another device connected to the internet from a public network.
269266
270267 ### Proxy disabled
271 −This test checks whether the proxy is configured on the device. If the end-user device is configured to use a proxy for outgoing traffic to the internet, you must exclude the destination IPs/FQDNs acquired by the client with a Proxy Auto-Configuration (PAC) file or with the Web Proxy Auto-Discovery (WPAD) protocol.
268 +This test checks whether the proxy is configured on the device. If a device uses a proxy for outgoing traffic to the internet, you must exclude the destination IPs and FQDNs that the client acquires with a Proxy Auto-Configuration (PAC) file or with the Web Proxy Auto-Discovery (WPAD) protocol.
272269
273270 #### Change the PAC file
274 −Add the IPs/FQDNs to be tunneled to Global Secure Access edge as exclusions in the PAC file, so that HTTP requests for these destinations won't redirect to the proxy. (These IPs/FQDNs are also set to tunnel to Global Secure Access in the forwarding profile.)
271 +Add the IPs and FQDNs to be tunneled to Global Secure Access edge as exclusions in the PAC file, so that HTTP requests for these destinations don't redirect to the proxy. These IPs and FQDNs are also set to tunnel to Global Secure Access in the forwarding profile.
275272 To show the client's health status properly, add the FQDN used for health probing to the exclusions list: `.edgediagnostic.globalsecureaccess.microsoft.com`.
276273
277274 Example PAC file containing exclusions:
278275
279 −```http
276 +```javascript
280277 function FindProxyForURL(url, host) {  
281278         if (isPlainHostName(host) ||  
282279 dnsDomainIs(host, ".edgediagnostic.globalsecureaccess.microsoft.com") || //tunneled
⋯ 6 unchanged lines
289286 ```
290287
291288 #### Add a system variable
292 −Configuring the Global Secure Access client to route Global Secure Access traffic through a proxy:
289 +Configure the Global Secure Access client to route Global Secure Access traffic through a proxy:
293290 1. Set a system environment variable in Windows named `grpc_proxy` to the value of the proxy address. For example, `http://10.1.0.10:8080`.
294291 1. Restart the Global Secure Access client.
295292
296293 ### No Hyper-V external virtual switch detected
297294 Hyper-V support:
298 −1. External virtual switch: The Global Secure Access Windows client doesn't currently support host machines that have a Hyper-V external virtual switch. However, the client can be installed on the virtual machines to tunnel traffic to Global Secure Access.
299 −1. Internal virtual switch: The Global Secure Access Windows client can be installed on host and guest machines. The client tunnels only the network traffic of the machine it's installed on. In other words, a client installed on a host machine doesn’t tunnel the network traffic of the guest machines.
295 +1. External virtual switch: The Global Secure Access Windows client doesn't currently support host machines that have a Hyper-V external virtual switch. However, you can install the client on the virtual machines to tunnel traffic to Global Secure Access.
296 +1. Internal virtual switch: You can install the Global Secure Access Windows client on host and guest machines. The client tunnels only the network traffic of the machine it's installed on. In other words, a client installed on a host machine doesn't tunnel the network traffic of the guest machines.
300297
301298 The Global Secure Access Windows client supports Azure Virtual Machines.
302299
303300 The Global Secure Access Windows client supports Azure Virtual Desktop (AVD).
304301 > [!NOTE]
305 −> AVD multi-session is not supported.
302 +> AVD multisesion isn't supported.
306303
307304 ### Tunneling succeeded
308305 This test checks each active traffic profile in the forwarding profile (**Microsoft 365**, **Private Access**, and **Internet Access**) to verify that connections to the health service of the corresponding channel are tunneled successfully.
⋯ 24 unchanged lines
333330
334331 Administrators can disable QUIC protocol triggering clients to fall back to HTTPS over TCP, which is fully supported in Internet Access.
335332
336 −### QUIC disabled in Microsoft Edge
333 +### Disable QUIC in Microsoft Edge
337334 To disable QUIC in Microsoft Edge:
338335 1. Open Microsoft Edge.
339336 1. Paste `edge://flags/#enable-quic` in the Address bar.
340337 1. Set the **Experimental QUIC protocol** drop-down to **Disabled**.
341338
342 −### QUIC disabled in Chrome
339 +### Disable QUIC in Chrome
343340 To disable QUIC in Google Chrome:
344341 1. Open Google Chrome.
345342 1. Paste `chrome://flags/#enable-quic` in the Address bar.
346343 1. Set the **Experimental QUIC protocol** drop-down to **Disabled**.
347344
348 −### QUIC disabled in Mozilla Firefox
345 +### Disable QUIC in Mozilla Firefox
349346 To disable QUIC in Mozilla Firefox:
350347 1. Open Firefox.
351348 1. Paste `about:config` in the Address bar.
352349 1. In the **Search preference name field**, paste `network.http.http3.enable`.
353350 1. Toggle the **network.http.http3.enable** option to **false**.
351 +
352 +## Related content
353 +- [Install the Global Secure Access client for Windows](how-to-install-windows-client.md)
354 +- [Troubleshoot the Global Secure Access client for macOS: Health check tab](troubleshoot-global-secure-access-client-macos-health-check.md)

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:31 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 21:54 UTC · 257 of 260 readable · 255 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.