GSA Windows client prerequisites and installation
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 7706047 · +205 −141 lines · also on GitHub
11
---
2
−title: The Global Secure Access Client for Windows
3
−description: The Global Secure Access client secures network traffic at the end-user device. This article describes how to download and install the Windows client.
2
+title: Install the Global Secure Access Client for Windows
3
+description: The Global Secure Access client helps secure network traffic at the user device. This article describes how to download and install the Windows client.
44
ms.topic: how-to
55
ms.date: 02/02/2026
66
ms.author: jayrusso
⋯ 2 unchanged lines
99
ai-usage: ai-assisted
1010
ms.custom: sfi-image-nochange
1111
12
−# Customer intent: Windows users, I want to download and install the Global Secure Access client.
12
+# Customer intent: As a Windows user, I want to download and install the Global Secure Access client so that I can enhance network security.
1313
---
14
−# Install the Global Secure Access client for Microsoft Windows
15
−The Global Secure Access client is an essential part of Global Secure Access. It helps organizations manage and secure network traffic on end-user devices. The client routes traffic that needs to be secured by Global Secure Access to the cloud service. All other traffic goes directly to the network. The [Forwarding Profiles](concept-traffic-forwarding.md) you set up in the portal decide which traffic the Global Secure Access client routes to the cloud service.
14
+# Install the Global Secure Access client for Windows
1615
17
−> [!NOTE]
18
−> The Global Secure Access client is also available for macOS, Android, and iOS. To learn how to install the Global Secure Access client on these platforms, see [Global Secure Access client for macOS](how-to-install-macos-client.md), [Global Secure Access client for Android](how-to-install-android-client.md), and [Global Secure Access client for iOS](how-to-install-ios-client.md).
16
+The Global Secure Access client is an essential part of Global Secure Access. It helps organizations manage and secure network traffic on user devices. The client routes traffic that needs to be secured by Global Secure Access to the cloud service. All other traffic goes directly to the network. The [forwarding profiles](concept-traffic-forwarding.md) that you set up in the portal decide which traffic the Global Secure Access client routes to the cloud service.
1917
20
−This article describes how to download and install the Global Secure Access client for Windows.
18
+This article describes how to download and install the Global Secure Access client for Windows. The Global Secure Access client is also available for [macOS](how-to-install-macos-client.md), [Android](how-to-install-android-client.md), and [iOS](how-to-install-ios-client.md).
2119
2220
## Prerequisites
2321
2422
- A Microsoft Entra tenant onboarded to Global Secure Access.
23
+
2524
- A device joined to or registered (preview) in the onboarded tenant:
26
− - The device must be Microsoft Entra joined, Microsoft Entra hybrid joined, or Microsoft Entra registered. To learn more, see [Global Secure Access client overview](concept-clients.md).
27
− - If the device isn't joined or registered, the Global Secure Access client registers it to the tenant when the user signs in.
28
− - If the device isn't joined and has multiple registrations, sign-in with the Microsoft Entra user of the tenant that Global Secure Access should connect to.
29
− - On Microsoft Entra registered devices, only Private Access traffic is supported.
30
−- The Global Secure Access client requires a 64-bit version of Windows 10 (LTSC 2021 or newer), Windows 11, or an Arm64 version of Windows 11.
31
− - Azure Virtual Desktop single-session is supported.
32
− - Azure Virtual Desktop multi-session isn't supported.
33
− - Windows 365 is supported.
34
− - Windows on Arm devices (such as Surface Pro and Surface Laptop with Snapdragon processors) require a separate client installer, available at **https://aka.ms/GlobalSecureAccess-WindowsOnArm**. Don't use the standard x64 installer on Arm64 devices.
35
−- You need local admin credentials to install or upgrade the Global Secure Access client.
36
−- The Global Secure Access client requires a license. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [buy licenses or get trial licenses](https://aka.ms/azureadlicense).
3725
38
−## Download the client
26
+ - The device must be Microsoft Entra joined, Microsoft Entra hybrid joined, or Microsoft Entra registered. To learn more, see [Global Secure Access client overview](concept-clients.md).
27
+ - If the device isn't joined or registered, the Global Secure Access client registers it to the tenant when the user signs in.
28
+ - If the device isn't joined and has multiple registrations, sign in with the Microsoft Entra user of the tenant that Global Secure Access should connect to.
29
+ - On Microsoft Entra registered devices, only Private Access traffic is supported.
3930
31
+- A 64-bit version of Windows 10 (LTSC 2021 or newer), Windows 11, or an Arm64 version of Windows 11:
32
+
33
+ - Azure Virtual Desktop single-session is supported.
34
+ - Azure Virtual Desktop multi-session isn't supported.
35
+ - Windows 365 is supported.
36
+ - Windows on Arm devices (such as Surface Pro and Surface Laptop with Snapdragon processors) require a [separate client installer](https://aka.ms/GlobalSecureAccess-WindowsOnArm). Don't use the standard x64 installer on Arm64 devices.
37
+
38
+- Local admin credentials to install or upgrade the Global Secure Access client.
39
+
40
+- A license. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If necessary, you can [buy licenses or get trial licenses](https://aka.ms/azureadlicense).
41
+
42
+## Steps for downloading the client
43
+
4044
The most current version of the Global Secure Access client is available to download from the Microsoft Entra admin center.
4145
4246
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Secure Access Administrator](/azure/active-directory/roles/permissions-reference#global-secure-access-administrator).
43
−1. Browse to **Global Secure Access** > **Connect** > **Client download**.
47
+
48
+1. Go to **Global Secure Access** > **Connect** > **Client download**.
49
+
4450
1. Select **Download Client**.
4551
46
− :::image type="content" source="media/how-to-install-windows-client/client-download-screen.png" alt-text="Screenshot of the Client download screen with the Download Client button highlighted.":::
47
−
48
−## Install the Global Secure Access client
52
+ :::image type="content" source="media/how-to-install-windows-client/client-download-screen.png" alt-text="Screenshot of the pane for client download with the Download Client button highlighted.":::
53
+
54
+## Steps for installing the client
55
+
4956
### Automated installation
50
−Organizations can install the Global Secure Access client silently with the `/quiet` switch, or use Mobile Device Management (MDM) solutions, such as [Microsoft Intune](/mem/intune/apps/apps-win32-app-management), to deploy the client to their devices.
5157
58
+Organizations can install the Global Secure Access client silently with the `/quiet` switch. Or they can use solutions for mobile device management, such as [Microsoft Intune](/mem/intune/apps/apps-win32-app-management), to deploy the client to their devices.
59
+
5260
### Use Microsoft Intune to deploy the Global Secure Access client
5361
5462
This section explains how to use Intune to install the Global Secure Access client on a Windows 11 client device.
⋯ 4 unchanged lines
5967
6068
#### Package the client
6169
62
−Package the installation script into a `.intunewin` file.
70
+Package the installation script into a `.intunewin` file:
6371
6472
1. Save the following PowerShell script to your device. Put the PowerShell script and the Global Secure Access `.exe` installer into a folder.
6573
66
− > [!NOTE]
67
− > The name of the `.exe` file must be `GlobalSecureAccessClient.exe` for the PowerShell installation script to work properly. If you modify the name of the `.exe` file to something else, you must also modify the $installerPath in the PowerShell script.
74
+ The PowerShell installation script installs the Global Secure Access client, sets the `IPv4Preferred` registry key to prefer IPv4 over IPv6 traffic, and prompts for a reboot for the registry key change to take effect.
6875
6976
> [!NOTE]
70
− > The PowerShell installation script installs the Global Secure Access client, sets the `IPv4Preferred` registry key to prefer IPv4 over IPv6 traffic, and prompts for a reboot for the registry key change to take effect.
77
+ > The name of the `.exe` file must be `GlobalSecureAccessClient.exe` for the PowerShell installation script to work properly. If you modify the name of the `.exe` file to something else, you must also modify `$installerPath` in the PowerShell script.
7178
7279
```powershell
7380
# Create log directory and log helper
⋯ 89 unchanged lines
163170
}
164171
```
165172
166
−2. Go to the [Microsoft Win32 Content Prep Tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool). Select **IntuneWinAppUtil.exe**.
173
+1. Go to the [Microsoft Win32 Content Prep Tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool). Select `IntuneWinAppUtil.exe`.
167174
168
− :::image type="content" source="media/how-to-install-windows-client/install-content-prep-tool.png" alt-text="Screenshot of prep tool install file selection.":::
175
+ :::image type="content" source="media/how-to-install-windows-client/install-content-prep-tool.png" alt-text="Screenshot of selecting the installaton file in the prep tool.":::
169176
170
−1. In the top right corner, select **More file actions** and then select **Download**.
177
+1. In the upper-right corner, select **More file actions** and then select **Download**.
171178
172
− :::image type="content" source="media/how-to-install-windows-client/raw-file-download.png" alt-text="Screenshot of More file actions menu to select Download.":::
179
+ :::image type="content" source="media/how-to-install-windows-client/raw-file-download.png" alt-text="Screenshot of the Download command on the menu for more file actions.":::
173180
174
−1. Navigate to and run `IntuneWinAppUtil.exe`. A command prompt opens.
181
+1. Go to and run `IntuneWinAppUtil.exe`. A command prompt opens.
182
+
175183
1. Enter the folder path location of the Global Secure Access `.exe` file. Select **Enter**.
184
+
176185
1. Enter the name of the Global Secure Access installation `.ps1` file. Select **Enter**.
186
+
177187
1. Enter the folder path in which to place the `.intunewin` file. Select **Enter**.
188
+
178189
1. Enter **N**. Select **Enter**.
179190
180
− :::image type="content" source="media/how-to-install-windows-client/install-from-command-line.png" alt-text="Screenshot of command line to install client.":::
191
+ :::image type="content" source="media/how-to-install-windows-client/install-from-command-line.png" alt-text="Screenshot of command line to install a client.":::
181192
182
−The `.intunewin` file is ready for you to deploy Microsoft Intune.
193
+The `.intunewin` file is ready for you to deploy Microsoft Intune.
183194
184
−#### Deploy Global Secure Access client with Intune
195
+#### Deploy the client
185196
186
−For detailed guidance, see [Add and assign Win32 apps to Microsoft Intune](/mem/intune/apps/apps-win32-add#add-a-win32-app-to-intune).
197
+For detailed guidance, see [Add a Win32 app to Intune](/mem/intune/apps/apps-win32-add#add-a-win32-app-to-intune).
187198
188
−1. Navigate to [https://intune.microsoft.com](https://intune.microsoft.com/).
199
+1. Go to the [Intune admin center](https://intune.microsoft.com/).
200
+
189201
1. Select **Apps** > **All apps** > **Add**.
202
+
190203
1. On **Select app type**, under **Other** app types, select **Windows app (Win32)**.
204
+
191205
1. Select **Select**. The **Add app** steps appear.
206
+
192207
1. Select **Select app package file**.
193
−1. Select the folder icon. Open the `.intunewin` file you created in the previous section.
194208
195
− :::image type="content" source="media/how-to-install-windows-client/app-package-file.png" alt-text="Screenshot of App package file selection.":::
209
+1. Select the folder icon. Open the `.intunewin` file that you created in the previous section.
196210
211
+ :::image type="content" source="media/how-to-install-windows-client/app-package-file.png" alt-text="Screenshot that shows selection of an app package file.":::
212
+
197213
1. Select **OK**.
214
+
198215
1. On the **App Information** tab, configure these fields:
199216
200217
- **Name**: Enter a name for the client app.
⋯ 5 unchanged lines
206223
207224
:::image type="content" source="media/how-to-install-windows-client/add-app.png" alt-text="Screenshot of Add App to install client." lightbox="media/how-to-install-windows-client/add-app.png":::
208225
209
−10. Select **Next**.
210
−1. On the **Program** tab, configure these fields:
226
+1. Select **Next**.
211227
228
+1. On the **Program** tab, configure these values:
229
+
212230
- **Install command**: Use the original name of the `.ps1` file for `powershell.exe -ExecutionPolicy Bypass -File OriginalNameOfFile.ps1`.
213
− - **Uninstall command**: `"GlobalSecureAccessClient.exe" /uninstall /quiet /norestart`.
231
+ - **Uninstall command**: Enter `"GlobalSecureAccessClient.exe" /uninstall /quiet /norestart`.
214232
- **Allow available uninstall**: Select **No**.
215233
- **Install behavior**: Select **System**.
216
− - **Device restart behavior**: Select **Determine behavior based on return codes**.
234
+ - **Device restart behavior**: Select **Determine behavior based on return codes**. Specify the following return codes.
217235
218
−|Return code|Code type|
219
−|-----------|---------|
220
−|0|Success|
221
−|3010|Soft reboot|
222
−|1618|Retry|
236
+ |Return code|Code type|
237
+ |-----------|---------|
238
+ |0|**Success**|
239
+ |3010|**Soft reboot**|
240
+ |1618|**Retry**|
223241
224
− :::image type="content" source="media/how-to-install-windows-client/program-install-parameters.png" alt-text="Screenshot of Program to configure installation parameters." lightbox="media/how-to-install-windows-client/program-install-parameters.png":::
242
+ :::image type="content" source="media/how-to-install-windows-client/program-install-parameters.png" alt-text="Screenshot of the Program tab for configuring installation parameters." lightbox="media/how-to-install-windows-client/program-install-parameters.png":::
225243
226
−12. Select **Next**.
227
−1. On the **Requirements** tab, configure these fields:
244
+1. Select **Next**.
228245
229
− - **Check operating system architecture**: Select **Yes. Specify the systems the app can be installed on.**.
230
− - Select the **Install on** options according to the system type you're deploying to.
246
+1. On the **Requirements** tab, configure these values:
247
+
248
+ - **Check operating system architecture**: Select **Yes. Specify the systems the app can be installed on.** Then select the **Install on** options according to the system type that you're deploying to.
231249
- **Minimum operating system**: Select your minimum requirements.
232250
233
−1. Leave the remaining fields blank.
251
+1. Leave the remaining boxes blank.
234252
235
− :::image type="content" source="media/how-to-install-windows-client/requirements-install-parameters.png" alt-text="Screenshot of Requirements to configure installation parameters." lightbox="media/how-to-install-windows-client/requirements-install-parameters.png":::
253
+ :::image type="content" source="media/how-to-install-windows-client/requirements-install-parameters.png" alt-text="Screenshot of the Requirements tab for configuring installation parameters." lightbox="media/how-to-install-windows-client/requirements-install-parameters.png":::
236254
237
−> [!NOTE]
238
−> Windows on Arm devices have their own client, which is available at **aka.ms/GlobalSecureAccess-WindowsOnArm**.
255
+ > [!NOTE]
256
+ > Windows on Arm devices have their own client, which is available at **aka.ms/GlobalSecureAccess-WindowsOnArm**.
239257
240
−15. Select **Next**.
258
+1. Select **Next**.
259
+
241260
1. On the **Detection rules** tab, under **Rules format**, select **Manually configure detection rules**.
261
+
242262
1. Select **Add**.
263
+
243264
1. Under **Rule type**, select **File**.
265
+
244266
1. Configure these fields:
245267
246268
- **Path**: Enter `C:\Program Files\Global Secure Access Client\TrayApp`.
⋯ 3 unchanged lines
250272
- **Value**: Enter the client version number.
251273
- **Associated with a 32-bit app on 64-bit client**: Select **No**.
252274
253
− :::image type="content" source="media/how-to-install-windows-client/detection-rule.png" alt-text="Screenshot of Detection rule for client." lightbox="media/how-to-install-windows-client/detection-rule.png":::
275
+ :::image type="content" source="media/how-to-install-windows-client/detection-rule.png" alt-text="Screenshot of the pane for creating a detection rule for the client." lightbox="media/how-to-install-windows-client/detection-rule.png":::
254276
255
−1. Select **OK**. Select **Next**.
277
+1. Select **OK**. Then select **Next**.
278
+
256279
1. Select **Next** twice to go to **Assignments**.
257
−1. Under **Required**, select **+Add group**. Select a group of users or devices. Select **Select**.
280
+
281
+1. Under **Required**, select **+Add group**. Select a group of users or devices. Choose **Select**.
282
+
258283
1. Set the **Restart grace period** to **Enabled** to avoid disrupting users with an abrupt device reboot.
259284
260
− :::image type="content" source="media/how-to-install-windows-client/restart-grace-period.png" alt-text="Screenshot of the Assignments tab showing the required groups and that restart grace period is enabled." lightbox="media/how-to-install-windows-client/restart-grace-period.png":::
285
+ :::image type="content" source="media/how-to-install-windows-client/restart-grace-period.png" alt-text="Screenshot of the Assignments tab that shows the required groups and the restart grace period set to Enabled." lightbox="media/how-to-install-windows-client/restart-grace-period.png":::
261286
262
−1. Select **Next**. Select **Create**.
287
+1. Select **Next**. Then select **Create**.
263288
264289
> [!NOTE]
265
−> Deploying the Global Secure Access client to a virtual machine might suppress the prompt to restart the device. The user won't see the reboot prompt.
290
+> Deploying the Global Secure Access client to a virtual machine might suppress the prompt to restart the device.
266291
267292
#### Update the client to a newer version
268293
⋯ 5 unchanged lines
274299
In a production environment, it's a good practice to deploy new client versions in a phased deployment approach:
275300
276301
1. Leave the existing app in place.
277
−1. Add a new app for the new client version, repeating the previous steps.
278
−1. Assign the new app to a small group of users to pilot the new client version. It's okay to assign these users to the app with the old client version for an in-place upgrade.
302
+
303
+1. Add a new app for the new client version by repeating the previous steps.
304
+
305
+1. Assign the new app to a small group of users to pilot the new client version. It's OK to assign these users to the app with the old client version for an in-place upgrade.
306
+
279307
1. Slowly increase the membership of the pilot group until you deploy the new client to all desired devices.
308
+
280309
1. Delete the app with the old client version.
281310
282311
### Configure Global Secure Access client settings with Intune
283312
284
−Administrators can use [remediation scripts](/intune/intune-service/fundamentals/remediations) in Intune to enforce client-side controls, such as preventing general users from disabling the client or hiding specific buttons.
313
+Administrators can use [remediation scripts](/intune/intune-service/fundamentals/remediations) in Intune to enforce client-side controls, such as preventing general users from disabling the client or hiding specific buttons.
285314
286315
> [!IMPORTANT]
287
−> Set the `$gsaSettings` to the values your organization requires in both the detection and remediation scripts.
288
−
289
−> [!NOTE]
316
+> Set the `$gsaSettings` to the values that your organization requires in both the detection and remediation scripts.
317
+>
290318
> Make sure to configure these scripts to run in 64-bit PowerShell.
291319
292
−:::image type="content" source="media/how-to-install-windows-client/run-script-64-bit.png" alt-text="Screenshot of the Create custom script settings tab with the Run script in 64-bit PowerShell option set to yes.":::
320
+:::image type="content" source="media/how-to-install-windows-client/run-script-64-bit.png" alt-text="Screenshot of the tab for creating custom script settings, with the option for running the script in 64-bit PowerShell set to Yes.":::
293321
294
−> [!TIP]
295
−> Select to expand the PowerShell scripts.
322
+Select the PowerShell scripts to expand them.
296323
297324
<details>
298325
<summary>PowerShell detection script</summary>
299326
300
−#### Detection script
327
+#### Detection script
301328
302329
```powershell
303330
# Check Global Secure Access registry keys
⋯ 90 unchanged lines
394421
395422
</details>
396423
397
−### Configure settings for Microsoft Entra Internet Access with Intune
424
+### Configure settings for Microsoft Entra Internet Access by using Intune
398425
399
−Microsoft Entra Internet Access doesn't yet support DNS over HTTPS or Quick UDP Internet Connections (QUIC) traffic. To mitigate this limitation, disable these protocols in users' browsers. The following instructions provide guidance on how to enforce these controls using Intune.
426
+Microsoft Entra Internet Access doesn't yet support DNS over HTTPS or Quick UDP Internet Connections (QUIC) traffic. To mitigate this limitation, disable these protocols in users' browsers. The following instructions provide guidance on how to enforce these controls by using Intune.
400427
401
−#### Disable QUIC in Microsoft Edge and Chrome with Intune
428
+#### Disable QUIC in Microsoft Edge and Chrome by using Intune
402429
403
−To disable QUIC in Microsoft Edge and Chrome with Intune:
404430
1. In the Microsoft Intune admin center, select **Devices** > **Manage devices** > **Configuration**.
431
+
405432
1. On the **Policies** tab, select **+ Create** > **+ New Policy**.
433
+
406434
1. In the **Create a profile** dialog:
407
− - Set the **Platform** to **Windows 10 and later**.
408
− - Set the **Profile type** to **Settings catalog**.
435
+
436
+ - Set **Platform** to **Windows 10 and later**.
437
+ - Set **Profile type** to **Settings catalog**.
409438
- Select **Create**. The **Create profile** form opens.
439
+
410440
1. On the **Basics** tab, give the profile a name and description.
441
+
411442
1. Select **Next**.
443
+
412444
1. On the **Configuration settings** tab:
445
+
413446
1. Select **+ Add settings**.
414
− 1. In the **Settings picker**, search for "QUIC".
447
+ 1. In the **Settings picker**, search for **QUIC**.
415448
1. From the search results:
416
− 1. Select **Microsoft Edge** and select the **Allow QUIC protocol** setting.
417
− 1. Next, select **Google Google Chrome** and select the **Allow QUIC protocol** setting.
418
− 1. In the **Settings picker**, search for "DNS-over-HTTPS".
449
+ 1. Select **Microsoft Edge**, and then select the **Allow QUIC protocol** setting.
450
+ 1. Select **Google Google Chrome**, and then select the **Allow QUIC protocol** setting.
451
+ 1. In the **Settings picker**, search for **DNS-over-HTTPS**.
419452
1. From the search results:
420
− 1. Select **Microsoft Edge** and select the **Control the mode of DNS-over-HTTPS** setting.
421
− 1. Next, select **Google Google Chrome** and select the **Control the mode of DNS-over-HTTPS** setting.
453
+ 1. Select **Microsoft Edge**, and then select the **Control the mode of DNS-over-HTTPS** setting.
454
+ 1. Select **Google Google Chrome**, and then select the **Control the mode of DNS-over-HTTPS** setting.
422455
1. Close the **Settings picker**.
456
+
423457
1. For **Google Chrome**, set both toggles to **Disabled**.
458
+
424459
1. For **Microsoft Edge**, set both toggles to **Disabled**.
425460
426
− :::image type="content" source="media/how-to-install-windows-client/edge-chrome-profile.png" alt-text="Screenshot of the Configuration settings tab showing the Microsoft Edge and Chrome settings." lightbox="media/how-to-install-windows-client/edge-chrome-profile.png":::
461
+ :::image type="content" source="media/how-to-install-windows-client/edge-chrome-profile.png" alt-text="Screenshot of the tab for configuration settings that shows the Microsoft Edge and Chrome settings." lightbox="media/how-to-install-windows-client/edge-chrome-profile.png":::
427462
428463
1. Select **Next** twice.
464
+
429465
1. On the **Assignments** tab:
466
+
430467
1. Select **Add groups**.
431468
1. Select a group of users or devices to assign the policy.
432469
1. Select **Select**.
470
+
433471
1. Select **Next**.
472
+
434473
1. On the **Review + create** tab, select **Create**.
435474
436475
### Configure Firefox browser settings
⋯ 3 unchanged lines
440479
> [!NOTE]
441480
> Make sure to configure these scripts to run in 64-bit PowerShell.
442481
443
−:::image type="content" source="media/how-to-install-windows-client/run-script-64-bit.png" alt-text="Screenshot of the Create custom script settings tab with the Run script in 64-bit PowerShell option set to yes.":::
444
−
445
−> [!TIP]
446
−> Select to expand the PowerShell scripts.
482
+:::image type="content" source="media/how-to-install-windows-client/run-script-64-bit.png" alt-text="Screenshot of the tab for creating custom script settings, with the option for running the script in 64-bit PowerShell set to Yes.":::
447483
448484
<details>
449485
<summary>PowerShell detection script</summary>
⋯ 60 unchanged lines
510546
if ($compliant) { Write-Output "Compliant" Exit 0 } else { Write-Output "Non-compliant" Exit 1 }
511547
```
512548
513
−</details>
549
+</details>
514550
515551
<details>
516552
<summary>PowerShell remediation script</summary>
⋯ 61 unchanged lines
578614
}
579615
```
580616
581
−</details>
617
+</details>
582618
583
−### Manual installation
584
−To manually install the Global Secure Access client:
585
−1. Run the *GlobalSecureAccessClient.exe* setup file. Accept the software license terms.
619
+### Manually install the Global Secure Access client
620
+
621
+1. Run the `GlobalSecureAccessClient.exe` setup file. Accept the software license terms.
622
+
586623
1. The client installs and silently signs you in with your Microsoft Entra credentials. If the silent sign-in fails, the installer prompts you to sign in manually.
587
−1. Sign in. The connection icon turns green.
588
−1. Hover over the connection icon to open the client status notification, which should show as **Connected**.
589
−:::image type="content" source="media/how-to-install-windows-client/global-secure-access-client-installed-connected.png" alt-text="Screenshot showing the client is connected.":::
590624
625
+1. The connection icon turns green. Hover over it to open the client status notification, which should show as **Connected**.
626
+
627
+:::image type="content" source="media/how-to-install-windows-client/global-secure-access-client-installed-connected.png" alt-text="Screenshot that shows a connected client.":::
628
+
591629
## Client interface
592
−To open the Global Secure Access client interface, select the Global Secure Access icon in the system tray. The client interface provides a view of the current connection status, the channels configured for the client, and access to diagnostics tools.
593630
631
+To open the Global Secure Access client interface, select the Global Secure Access icon in the system tray. The client interface provides a view of the current connection status, the channels configured for the client, and access to diagnostics tools.
632
+
594633
### Connections view
595
−In the **Connections** view, you can see the client **Status** and the **Channels** configured for the client. To disable the client, select the **Disable** button. You can use the information in the **Additional details** section to troubleshoot the client connection. Select **Show more details** to expand the section and view more information.
596
−:::image type="content" source="media/how-to-install-windows-client/client-interface-connections.png" alt-text="Screenshot of the Connections view of the Global Secure Access client interface.":::
597634
635
+In the **Connections** view, you can see the client status and the channels configured for the client.
636
+
637
+To disable the client, select the **Disable** button. You can use the information in the **Additional details** section to troubleshoot the client connection. Select **Show more details** to expand the section and view more information.
638
+
639
+:::image type="content" source="media/how-to-install-windows-client/client-interface-connections.png" alt-text="Screenshot of the Connections view of the Global Secure Access client interface.":::
640
+
598641
### Troubleshooting view
599
−In the **Troubleshooting** view, you can perform various diagnostic tasks. You can export and share logs with your IT admin. You can also access the **Advanced diagnostics** tool, which provides an assortment of troubleshooting tools. Note: You can also launch the **Advanced diagnostics** tool from the client system tray icon menu.
600
−:::image type="content" source="media/how-to-install-windows-client/client-interface-troubleshooting.png" alt-text="Screenshot of the Troubleshooting view of the Global Secure Access client interface.":::
601642
643
+In the **Troubleshooting** view, you can perform various diagnostic tasks. You can export and share logs with your IT admin. You can also access the **Advanced diagnostics** tool, which provides an assortment of troubleshooting tools. (You can also open the **Advanced diagnostics** tool from the menu for the client's system tray icon.
644
+
645
+:::image type="content" source="media/how-to-install-windows-client/client-interface-troubleshooting.png" alt-text="Screenshot of the Troubleshooting view of the Global Secure Access client interface.":::
646
+
602647
### Settings view
603
−Switch to the **Settings** view to check the installed **Version** or access the **Microsoft Privacy Statement**.
604
−:::image type="content" source="media/how-to-install-windows-client/client-interface-settings.png" alt-text="Screenshot of the Settings view of the Global Secure Access client interface.":::
605648
649
+Switch to the **Settings** view to check the installed version or access the Microsoft Privacy Statement.
650
+
651
+:::image type="content" source="media/how-to-install-windows-client/client-interface-settings.png" alt-text="Screenshot of the Settings view of the Global Secure Access client interface.":::
652
+
606653
## Client actions
607
−To view the available client menu actions, select the Global Secure Access system tray icon.
608
−:::image type="content" source="media/how-to-install-windows-client/client-install-all-actions.png" alt-text="Screenshot showing the complete list of Global Secure Access client actions.":::
609654
655
+To view the available actions on the client menu, select the Global Secure Access icon in the system tray.
656
+
657
+:::image type="content" source="media/how-to-install-windows-client/client-install-all-actions.png" alt-text="Screenshot that shows the complete list of Global Secure Access client actions.":::
658
+
610659
> [!TIP]
611
−> The Global Secure Access client menu actions depend on your [Client registry keys](#client-registry-keys) configuration.
660
+> The Global Secure Access actions on the client menu depend on your [client registry keys](#client-registry-keys) configuration.
612661
613662
|Action |Description |
614
−|---------|---------|
615
−|**Sign out** |*Hidden by default*. Use the **Sign out** action when you need to sign in to the Global Secure Access client with a Microsoft Entra user other than the one used to sign in to Windows. To make this action available, update the appropriate [Client registry keys](#client-registry-keys). |
663
+|---------|-------------|
664
+|**Sign out** |*Hidden by default*. Use the **Sign out** action when you need to sign in to the Global Secure Access client with a Microsoft Entra user other than the one that you used to sign in to Windows. To make this action available, update the appropriate [client registry keys](#client-registry-keys). |
616665
|**Disable** |Select the **Disable** action to disable the client. The client remains disabled until you either enable the client or restart the machine. |
617
−|**Enable** |Enables the Global Secure Access client. |
618
−|**Disable Private Access** |*Hidden by default*. Use the **Disable Private Access** action when you want to bypass Global Secure Access whenever you connect your device directly to the corporate network to access private applications directly through the network rather than through Global Secure Access. To make this action available, update the appropriate [Client registry keys](#client-registry-keys). |
619
−|**Collect logs** |Select this action to collect client logs (information about the client machine, the related event logs for the services, and registry values) and archive them in a zip file to share with Microsoft Support for investigation. The default location for the logs is `C:\Program Files\Global Secure Access Client\Logs`. You can also collect client logs on Windows by entering the following command in the Command Prompt: `C:\Program Files\Global Secure Access Client\LogsCollector\LogsCollector.exe" <username> <user>`. |
620
−|**Advanced diagnostics** |Select this action to open the Advanced diagnostics utility and access an assortment of [troubleshooting](#troubleshooting) tools. |
666
+|**Enable** |Select this action to enable the Global Secure Access client. |
667
+|**Disable Private Access** |*Hidden by default*. Use the **Disable Private Access** action when you want to bypass Global Secure Access whenever you connect your device directly to the corporate network to access private applications directly through the network rather than through Global Secure Access. To make this action available, update the appropriate [client registry keys](#client-registry-keys). |
668
+|**Collect logs** |Select this action to collect client logs (information about the client machine, the related event logs for the services, and registry values) and archive them in a .zip file to share with Microsoft Support for investigation. The default location for the logs is `C:\Program Files\Global Secure Access Client\Logs`. You can also collect client logs on Windows by entering the following command in the command prompt: `C:\Program Files\Global Secure Access Client\LogsCollector\LogsCollector.exe" <username> <user>`. |
669
+|**Advanced diagnostics** |Select this action to open the advanced diagnostics and access an assortment of [troubleshooting](#troubleshooting) tools. |
621670
622671
## Client status indicators
672
+
623673
### Status notification
624
−Select the Global Secure Access icon to open the client status notification and view the status of each channel configured for the client.
625
−:::image type="content" source="media/how-to-install-windows-client/install-windows-client-client-status.png" alt-text="Screenshot showing the client status is connected.":::
626674
627
−### Client statuses in system tray icon
675
+Select the Global Secure Access icon to open the client status notification and view the status of each channel that you configured for the client.
628676
677
+:::image type="content" source="media/how-to-install-windows-client/install-windows-client-client-status.png" alt-text="Screenshot that shows a client status of Connected.":::
678
+
679
+### Client statuses in the system tray
680
+
629681
|Icon |Message |Description |
630
−|---------|---------|---------|
631
−|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-initializing.png"::: |Global Secure Access |The client is initializing and checking its connection to Global Secure Access. |
632
−|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-connected.png"::: |Global Secure Access - Connected |The client is connected to Global Secure Access. |
633
−|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-disabled.png"::: |Global Secure Access - Disabled |The client is disabled because services are offline or the user disabled the client. |
634
−|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-disconnected.png"::: |Global Secure Access - Disconnected |The client failed to connect to Global Secure Access. |
635
−|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-warning.png"::: |Global Secure Access - Some channels are unreachable |The client is partially connected to Global Secure Access (that is, the connection to at least one channel failed: Microsoft Entra, Microsoft 365, Private Access, Internet Access). |
636
−|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-warning.png"::: |Global Secure Access - Disabled by your organization |Your organization disabled the client (that is, all traffic forwarding profiles are disabled). |
637
−|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-warning.png"::: |Global Secure Access - Private Access is disabled |The user disabled Private Access on this device. |
638
−|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-warning.png"::: |Global Secure Access - could not connect to the Internet |The client couldn't detect an internet connection. The device is either connected to a network that doesn't have an Internet connection or a network that requires captive portal sign in. |
682
+|--------|-----------|---------------|
683
+|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-initializing.png"::: |Global Secure Access |The client is initializing and checking its connection to Global Secure Access. |
684
+|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-connected.png"::: |Global Secure Access - Connected |The client is connected to Global Secure Access. |
685
+|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-disabled.png"::: |Global Secure Access - Disabled |The client is disabled because services are offline or the user disabled the client. |
686
+|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-disconnected.png"::: |Global Secure Access - Disconnected |The client failed to connect to Global Secure Access. |
687
+|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-warning.png"::: |Global Secure Access - Some channels are unreachable |The client is partially connected to Global Secure Access (that is, the connection to at least one channel failed: Microsoft Entra, Microsoft 365, Private Access, Internet Access). |
688
+|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-warning.png"::: |Global Secure Access - Disabled by your organization |Your organization disabled the client (that is, all traffic forwarding profiles are disabled). |
689
+|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-warning.png"::: |Global Secure Access - Private Access is disabled |The user disabled Private Access on this device. |
690
+|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-warning.png"::: |Global Secure Access - could not connect to the Internet |The client couldn't detect an internet connection. The device is either connected to a network that doesn't have an Internet connection or a network that requires captive portal sign in. |
639691
640692
## Known limitations
641693
642694
[!INCLUDE [known-limitations-include](../includes/known-limitations-include.md)]
643695
644696
## Troubleshooting
697
+
645698
To troubleshoot the Global Secure Access client, select the client icon in the taskbar and select one of the troubleshooting options: **Export logs** or **Advanced diagnostics tool**.
646699
647700
> [!TIP]
648701
> Administrators can modify the Global Secure Access client menu options by revising the [Client registry keys](#client-registry-keys).
649702
650703
For more information on troubleshooting the Global Secure Access client, see the following articles:
704
+
651705
- [Troubleshoot the Global Secure Access client: advanced diagnostics](troubleshoot-global-secure-access-client-advanced-diagnostics.md)
652706
- [Troubleshoot the Global Secure Access client: Health check tab](troubleshoot-global-secure-access-client-diagnostics-health-check.md)
653707
654708
## Security recommendations
709
+
655710
To enhance the security of the Global Secure Access client, use the following configurations:
656711
657712
### Upgrade to the latest client version
713
+
658714
Regularly test and deploy the latest Global Secure Access client release to take advantage of new features, performance improvements, and security fixes. Download the latest version of the [Global Secure Access client](#download-the-client) from the Microsoft Entra admin center.
659715
660716
### Restrict nonprivileged users from disabling the client
717
+
661718
Administrators can prevent nonprivileged users on Windows devices from disabling or enabling the Global Secure Access client. This restriction ensures that the client stays on and that Global Secure Access continues to authenticate and secure network traffic. Enabling this restriction requires elevated privileges to disable the client.
662719
663720
Before enforcing this restriction, let users work with the Global Secure Access client in a nonrestricted mode. Configure the client for your organization to ensure users don't need to disable the client in specific scenarios (for example, to access specific websites or to use a non-Microsoft VPN in parallel).
⋯ 1 unchanged line
665722
To stop the Global Secure Access client on a device with restricted, nonprivileged users, make sure that there's a process in place to use a user with local administrator privileges when necessary. For more information regarding restricting nonprivileged users, see [Restrict nonprivileged users](#restrict-nonprivileged-users).
666723
667724
### Hide the Disable button
725
+
668726
In addition to restricting nonprivileged users from disabling the client, administrators can hide the **Disable** button in the client system tray icon menu. Removing the **Disable** button from view further reduces the likelihood that users disable the client by accident or without authorization.
669727
670728
For more information regarding hiding client menu buttons, see [Hide or unhide system tray menu buttons](#hide-or-unhide-system-tray-menu-buttons).
671729
672730
## Client registry keys
673
−The Global Secure Access client uses specific registry keys to enable or disable different functionalities. Administrators can use a Mobile Device Management (MDM) solution, such as Microsoft Intune or Group Policy to control the registry values.
674
−> [!CAUTION]
731
+
732
+The Global Secure Access client uses specific registry keys to enable or disable different functionalities. Administrators can use a solution for mobile device management, such as Microsoft Intune or Group Policy, to control the registry values.
733
+
734
+> [!CAUTION]
675735
> Don't change other registry values unless instructed by Microsoft Support.
676736
677737
### Restrict nonprivileged users
678
−Administrators can prevent nonprivileged users on the Windows device from disabling or enabling the client by setting the following registry key:
679
−`Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\Global Secure Access Client`
680738
739
+Administrators can prevent nonprivileged users on the Windows device from disabling or enabling the client by setting the following registry key:
740
+`Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\Global Secure Access Client`.
741
+
681742
|Value |Type |Data |Description |
682
−|---------|---------|---------|---------|
743
+|-------|------|------|-------------|
683744
|RestrictNonPrivilegedUsers |REG_DWORD |0x0 |Nonprivileged users on the Windows device can disable and enable the client. |
684745
|RestrictNonPrivilegedUsers |REG_DWORD |0x1 |Nonprivileged users on the Windows device are restricted from disabling and enabling the client. A UAC prompt requires local administrator credentials for disable and enable options. The administrator can also hide the disable button (see [Hide or unhide system tray menu buttons](#hide-or-unhide-system-tray-menu-buttons)). |
685746
686747
### Disable or enable Private Access on the client
748
+
687749
This registry value controls whether Private Access is enabled or disabled for the client. If a user is connected to the corporate network, they can choose to bypass Global Secure Access and directly access private applications.
688750
689751
Users can disable or enable Private Access through the system tray menu.
⋯ 1 unchanged line
691753
> [!TIP]
692754
> This option is available on the menu only if it isn't hidden (see [Hide or unhide system tray menu buttons](#hide-or-unhide-system-tray-menu-buttons)) and Private Access is enabled for this tenant.
693755
694
−Administrators can disable or enable Private Access for the user by setting the registry key:
695
−`Computer\HKEY_CURRENT_USER\Software\Microsoft\Global Secure Access Client`
756
+Administrators can disable or enable Private Access for the user by setting the registry key:
757
+`Computer\HKEY_CURRENT_USER\Software\Microsoft\Global Secure Access Client`.
696758
697759
|Value |Type |Data |Description |
698
−|---------|---------|---------|---------|
760
+|-------|------|------|-------------|
699761
|IsPrivateAccessDisabledByUser |REG_DWORD |0x0 |Private Access is enabled on this device. Network traffic to private applications goes through Global Secure Access. |
700762
|IsPrivateAccessDisabledByUser |REG_DWORD |0x1 |Private Access is disabled on this device. Network traffic to private applications goes directly to the network. |
701763
702764
:::image type="content" source="media/how-to-install-windows-client/global-secure-access-registry-key-private-access-enabled.png" alt-text="Screenshot of the Registry Editor with the IsPrivateAccessDisabledByUser registry key highlighted.":::
703
−
765
+␣␣
704766
If the registry value doesn't exist, the default value is 0x0, Private Access is enabled.
705767
706768
### Hide or unhide system tray menu buttons
707
−Administrators can show or hide specific buttons in the client system tray icon menu. Create the values under the following registry key:
708
−`Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Global Secure Access Client`
709769
770
+Administrators can show or hide specific buttons in the client system tray icon menu. Create the values under the following registry key:
771
+`Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Global Secure Access Client`.
772
+
710773
|Value |Type |Data |Default behavior |Description |
711774
|---------|---------|---------|---------|---------|
712775
|HideSignOutButton |REG_DWORD |0x0 - shown 0x1 - hidden |hidden |Configure this setting to show or hide the **Sign out** action. This option is for specific scenarios when a user needs to sign in to the client with a different Microsoft Entra user than the one used to sign in to Windows. Note: You must sign in to the client with a user in the same Microsoft Entra tenant to which the device is joined. You can also use the **Sign out** action to reauthenticate the existing user. |
713
−|HideDisablePrivateAccessButton |REG_DWORD |0x0 - shown 0x1 - hidden |hidden |Configure this setting to show or hide the **Disable Private Access** action. This option is for a scenario when the device is directly connected to the corporate network and the user prefers accessing private applications directly through the network instead of through the Global Secure Access. |
776
+|HideDisablePrivateAccessButton |REG_DWORD |0x0 - shown 0x1 - hidden |hidden |Configure this setting to show or hide the **Disable Private Access** action. This option is for a scenario when the device is directly connected to the corporate network and the user prefers accessing private applications directly through the network instead of through the Global Secure Access. |
714777
|HideDisableButton |REG_DWORD |0x0 - shown 0x1 - hidden |shown |Configure this setting to show or hide the **Disable** action. When visible, the user can disable the Global Secure Access client. The client remains disabled until the user enables it again. If the **Disable** action is hidden, a nonprivileged user can't disable the client. |
715778
716779
:::image type="content" source="media/how-to-install-windows-client/global-secure-access-registry-key-private-hide-signout.png" alt-text="Screenshot of the Registry Editor with the HideSignOutButton and HideDisablePrivateAccessButton registry keys highlighted.":::
⋯ 1 unchanged line
718781
For more information, see [Guidance for configuring IPv6 in Windows for advanced users](/troubleshoot/windows-server/networking/configure-ipv6-in-windows).
719782
720783
## Related content
784
+
721785
- [Global Secure Access client for macOS](how-to-install-macos-client.md)
722786
- [Global Secure Access client for Android](how-to-install-android-client.md)
723787
- [Global Secure Access client for iOS](how-to-install-ios-client.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:31 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.