GSA Windows client prerequisites and installation
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 61ed183 · +22 −9 lines · also on GitHub
⋯ 2 unchanged lines
33
description: The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the Windows client.
44
ms.service: global-secure-access
55
ms.topic: how-to
6
−ms.date: 01/20/2026
6
+ms.date: 01/27/2026
77
ms.author: jayrusso
88
author: HULKsmashGithub
99
manager: dougeby
⋯ 14 unchanged lines
2424
## Prerequisites
2525
2626
- A Microsoft Entra tenant onboarded to Global Secure Access.
27
−- A device joined to or registered (preview) in the onboarded tenant:
28
− - Registered device support is available with minimum client version `2_26.103`.
29
− - The device must be Microsoft Entra joined, Microsoft Entra hybrid joined, or Microsoft Entra registered. To learn more, see [Global Secure Access client overview](concept-clients.md).
30
− - If the device isn't joined or registered, the Global Secure Access client registers it to the tenant when the user signs in.
31
− - If the device isn't joined and has multiple registrations, sign-in with the Microsoft Entra user of the tenant that Global Secure Access should connect to.
32
− - On Microsoft Entra registered devices, only Private Access traffic is supported.
27
+- A managed device joined to the onboarded tenant. The device must be either Microsoft Entra joined or Microsoft Entra hybrid joined.
28
+ - Microsoft Entra registered devices aren't supported.
3329
- The Global Secure Access client requires a 64-bit version of Windows 10 (LTSC 2021 or newer), Windows 11, or an Arm64 version of Windows 11.
3430
- Azure Virtual Desktop single-session is supported.
3531
- Azure Virtual Desktop multi-session isn't supported.
⋯ 265 unchanged lines
301297
#### Detection script
302298
303299
```powershell
304
−# Check GSA registry keys
300
+# Check Global Secure Access registry keys
305301
306302
$gsaPath = "HKLM:\SOFTWARE\Microsoft\Global Secure Access Client"
307303
⋯ 51 unchanged lines
359355
#### Remediation script
360356
361357
```powershell
362
−# Ensure GSA registry keys are present
358
+# Ensure Global Secure Access registry keys are present
363359
364360
$gsaPath = "HKLM:\SOFTWARE\Microsoft\Global Secure Access Client"
365361
⋯ 285 unchanged lines
651647
For more information on troubleshooting the Global Secure Access client, see the following articles:
652648
- [Troubleshoot the Global Secure Access client: advanced diagnostics](troubleshoot-global-secure-access-client-advanced-diagnostics.md)
653649
- [Troubleshoot the Global Secure Access client: Health check tab](troubleshoot-global-secure-access-client-diagnostics-health-check.md)
650
+
651
+## Security recommendations
652
+To enhance the security of the Global Secure Access client, use the following configurations:
653
+
654
+### Upgrade to the latest client version of the Global Secure Access client
655
+Regularly test and deploy the latest Global Secure Access client release to take advantage of new features, performance improvements, and security fixes. Download the latest version of the [Global Secure Access client](#download-the-client) from the Microsoft Entra admin center.
656
+
657
+### Restrict nonprivileged users from disabling the client
658
+Administrators can prevent nonprivileged users on Windows devices from disabling or enabling the Global Secure Access client. This restriction ensures that the client stays on and that Global Secure Access continues to authenticate and secure network traffic. Enabling this restriction requires elevated privileges to disable the client.
659
+
660
+Before enforcing this restriction, let users work with the Global Secure Access client in a non‑restricted mode. Verify that the client is configured appropriately for your organization and that users don't need to disable it in specific scenarios (for example, to access specific websites or to use a third‑party VPN in parallel).
661
+
662
+To stop the Global Secure Access client on a device where you restricted nonprivileged users, make sure that there's a process in place to use a local administrator if necessary. For more information regarding restricting nonprivileged users, see [Restrict nonprivileged users](#restrict-nonprivileged-users).
663
+
664
+### Hide the Disable button
665
+In addition to restricting nonprivileged users from disabling the client, administrators can hide the **Disable** button in the client system tray icon menu. Removing the **Disable** button from view further reduces the likelihood of accidental or unauthorized disabling of the client.
666
+For more information regarding hiding client menu buttons, see [Hide or unhide system tray menu buttons](#hide-or-unhide-system-tray-menu-buttons).
654667
655668
## Client registry keys
656669
The Global Secure Access client uses specific registry keys to enable or disable different functionalities. Administrators can use a Mobile Device Management (MDM) solution, such as Microsoft Intune or Group Policy to control the registry values.
⋯ 51 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:31 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.