GSA Windows client prerequisites and installation

This page's changes and edits · All guidance changes

Microsoft's edit · 28 Jan 01:15 UTC

Update security recommendations and clarify admin instructions

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 899c239 · +6 −5 lines · also on GitHub

⋯ 277 unchanged lines

278278

279279 ### Configure Global Secure Access client settings with Intune

280280

281 −Admins can use [remediation scripts](/intune/intune-service/fundamentals/remediations) in Intune to enforce client-side controls, such as preventing non-admin users from disabling the client or hiding specific buttons.

281 +Administrators can use [remediation scripts](/intune/intune-service/fundamentals/remediations) in Intune to enforce client-side controls, such as preventing general users from disabling the client or hiding specific buttons.

282282

283283 > [!IMPORTANT]

284284 > Set the `$gsaSettings` to the values your organization requires in both the detection and remediation scripts.

⋯ 366 unchanged lines

651651 ## Security recommendations

652652 To enhance the security of the Global Secure Access client, use the following configurations:

653653

654 −### Upgrade to the latest client version of the Global Secure Access client

654 +### Upgrade to the latest client version

655655 Regularly test and deploy the latest Global Secure Access client release to take advantage of new features, performance improvements, and security fixes. Download the latest version of the [Global Secure Access client](#download-the-client) from the Microsoft Entra admin center.

656656

657657 ### Restrict nonprivileged users from disabling the client

658658 Administrators can prevent nonprivileged users on Windows devices from disabling or enabling the Global Secure Access client. This restriction ensures that the client stays on and that Global Secure Access continues to authenticate and secure network traffic. Enabling this restriction requires elevated privileges to disable the client.

659659

660 −Before enforcing this restriction, let users work with the Global Secure Access client in a non‑restricted mode. Verify that the client is configured appropriately for your organization and that users don't need to disable it in specific scenarios (for example, to access specific websites or to use a third‑party VPN in parallel).

660 +Before enforcing this restriction, let users work with the Global Secure Access client in a nonrestricted mode. Configure the client for your organization to ensure users don't need to disable the client in specific scenarios (for example, to access specific websites or to use a non-Microsoft VPN in parallel).

661661

662 −To stop the Global Secure Access client on a device where you restricted nonprivileged users, make sure that there's a process in place to use a local administrator if necessary. For more information regarding restricting nonprivileged users, see [Restrict nonprivileged users](#restrict-nonprivileged-users).

662 +To stop the Global Secure Access client on a device with restricted, nonprivileged users, make sure that there's a process in place to use a local administrator when necessary. For more information regarding restricting nonprivileged users, see [Restrict nonprivileged users](#restrict-nonprivileged-users).

663663

664664 ### Hide the Disable button

665 −In addition to restricting nonprivileged users from disabling the client, administrators can hide the **Disable** button in the client system tray icon menu. Removing the **Disable** button from view further reduces the likelihood of accidental or unauthorized disabling of the client.

665 +In addition to restricting nonprivileged users from disabling the client, administrators can hide the **Disable** button in the client system tray icon menu. Removing the **Disable** button from view further reduces the likelihood that users disable the client by accident or without authorization.

666 +

666667 For more information regarding hiding client menu buttons, see [Hide or unhide system tray menu buttons](#hide-or-unhide-system-tray-menu-buttons).

667668

668669 ## Client registry keys

⋯ 52 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:31 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.