GSA Windows client prerequisites and installation
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 6ef9105 · +9 −24 lines · also on GitHub
⋯ 2 unchanged lines
33
description: The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the Windows client.
44
ms.service: global-secure-access
55
ms.topic: how-to
6
−ms.date: 01/27/2026
6
+ms.date: 01/20/2026
77
ms.author: jayrusso
88
author: HULKsmashGithub
99
manager: dougeby
⋯ 14 unchanged lines
2424
## Prerequisites
2525
2626
- A Microsoft Entra tenant onboarded to Global Secure Access.
27
−- A managed device joined to the onboarded tenant. The device must be either Microsoft Entra joined or Microsoft Entra hybrid joined.
28
− - Microsoft Entra registered devices aren't supported.
27
+- A device joined to or registered (preview) in the onboarded tenant:
28
+ - The device must be Microsoft Entra joined, Microsoft Entra hybrid joined, or Microsoft Entra registered. To learn more, see [Global Secure Access client overview](concept-clients.md).
29
+ - If the device isn't joined or registered, the Global Secure Access client registers it to the tenant when the user signs in.
30
+ - If the device isn't joined and has multiple registrations, sign-in with the Microsoft Entra user of the tenant that Global Secure Access should connect to.
31
+ - On Microsoft Entra registered devices, only Private Access traffic is supported.
2932
- The Global Secure Access client requires a 64-bit version of Windows 10 (LTSC 2021 or newer), Windows 11, or an Arm64 version of Windows 11.
3033
- Azure Virtual Desktop single-session is supported.
3134
- Azure Virtual Desktop multi-session isn't supported.
⋯ 246 unchanged lines
278281
279282
### Configure Global Secure Access client settings with Intune
280283
281
−Administrators can use [remediation scripts](/intune/intune-service/fundamentals/remediations) in Intune to enforce client-side controls, such as preventing general users from disabling the client or hiding specific buttons.
284
+Admins can use [remediation scripts](/intune/intune-service/fundamentals/remediations) in Intune to enforce client-side controls, such as preventing non-admin users from disabling the client or hiding specific buttons.
282285
283286
> [!IMPORTANT]
284287
> Set the `$gsaSettings` to the values your organization requires in both the detection and remediation scripts.
⋯ 12 unchanged lines
297300
#### Detection script
298301
299302
```powershell
300
−# Check Global Secure Access registry keys
303
+# Check GSA registry keys
301304
302305
$gsaPath = "HKLM:\SOFTWARE\Microsoft\Global Secure Access Client"
303306
⋯ 51 unchanged lines
355358
#### Remediation script
356359
357360
```powershell
358
−# Ensure Global Secure Access registry keys are present
361
+# Ensure GSA registry keys are present
359362
360363
$gsaPath = "HKLM:\SOFTWARE\Microsoft\Global Secure Access Client"
361364
⋯ 285 unchanged lines
647650
For more information on troubleshooting the Global Secure Access client, see the following articles:
648651
- [Troubleshoot the Global Secure Access client: advanced diagnostics](troubleshoot-global-secure-access-client-advanced-diagnostics.md)
649652
- [Troubleshoot the Global Secure Access client: Health check tab](troubleshoot-global-secure-access-client-diagnostics-health-check.md)
650
−
651
−## Security recommendations
652
−To enhance the security of the Global Secure Access client, use the following configurations:
653
−
654
−### Upgrade to the latest client version
655
−Regularly test and deploy the latest Global Secure Access client release to take advantage of new features, performance improvements, and security fixes. Download the latest version of the [Global Secure Access client](#download-the-client) from the Microsoft Entra admin center.
656
−
657
−### Restrict nonprivileged users from disabling the client
658
−Administrators can prevent nonprivileged users on Windows devices from disabling or enabling the Global Secure Access client. This restriction ensures that the client stays on and that Global Secure Access continues to authenticate and secure network traffic. Enabling this restriction requires elevated privileges to disable the client.
659
−
660
−Before enforcing this restriction, let users work with the Global Secure Access client in a nonrestricted mode. Configure the client for your organization to ensure users don't need to disable the client in specific scenarios (for example, to access specific websites or to use a non-Microsoft VPN in parallel).
661
−
662
−To stop the Global Secure Access client on a device with restricted, nonprivileged users, make sure that there's a process in place to use a local administrator when necessary. For more information regarding restricting nonprivileged users, see [Restrict nonprivileged users](#restrict-nonprivileged-users).
663
−
664
−### Hide the Disable button
665
−In addition to restricting nonprivileged users from disabling the client, administrators can hide the **Disable** button in the client system tray icon menu. Removing the **Disable** button from view further reduces the likelihood that users disable the client by accident or without authorization.
666
−
667
−For more information regarding hiding client menu buttons, see [Hide or unhide system tray menu buttons](#hide-or-unhide-system-tray-menu-buttons).
668653
669654
## Client registry keys
670655
The Global Secure Access client uses specific registry keys to enable or disable different functionalities. Administrators can use a Mobile Device Management (MDM) solution, such as Microsoft Intune or Group Policy to control the registry values.
⋯ 51 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:31 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.