GSA Windows client health check
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit ef08b29 · +9 −1 lines · also on GitHub
⋯ 1 unchanged line
22
title: "Troubleshoot the Windows Global Secure Access client: Health check"
33
description: Troubleshoot the Global Secure Access client using the Health check tab in the Advanced diagnostics utility.
44
ms.topic: troubleshooting
5
−ms.date: 01/16/2026
5
+ms.date: 02/21/2026
66
ms.author: jayrusso
77
author: HULKsmashGithub
88
ms.reviewer: lirazbarak
⋯ 34 unchanged lines
4343
The Windows client authenticates the user and the device to Global Secure Access services. The device authentication, based on a device token, requires that the device is either Microsoft Entra joined or Microsoft Entra hybrid joined. Microsoft Entra registered devices aren't currently supported.
4444
To check the status of your device, enter the following command in the Command Prompt: `dsregcmd.exe /status`.
4545
:::image type="content" source="media/troubleshoot-global-secure-access-client-diagnostics-health-check/troubleshoot-health-entra-joined.png" alt-text="Screenshot of the Command Prompt with the Device State, AzureAdJoined : Yes, highlighted.":::
46
+
47
+### Entra user signed in to Windows
48
+This check verifies that the user currently signed in to Windows is a Microsoft Entra user. The Global Secure Access client requires the Windows sign-in user to be a Microsoft Entra user, not a local-only account.
49
+
50
+If this test fails:
51
+1. Verify the user signed in to the device with a Microsoft Entra account or a Microsoft Entra hybrid identity.
52
+1. Check that the Windows sign-in session uses Microsoft Entra credentials (not a local account).
53
+1. Run `dsregcmd.exe /status` and verify the **SSO State** section shows `AzureAdPrt : YES`.
4654
4755
### Can connect to the internet
4856
This check indicates whether the device is connected to the internet. The Global Secure Access client requires an internet connection. This test is based on the [Network Connectivity Status Indicator (NCSI)](/windows-server/networking/ncsi/ncsi-overview) feature.
⋯ 304 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:31 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.