Unable to add users to traffic forwarding profiles in GSA in MS Entra

Hello New Var,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well. 

I got that you're asking why the "User and group assignments" option in Microsoft Entra Global Secure Access (GSA) traffic forwarding profiles is showing as "temporarily unavailable", even though you have the Entra Suite license.
We will recommend you to clarify few points as: Do you have the required administrative roles?(please confirm your account has both the Global Secure Access Administrator role and the Application Administrator role assigned in Microsoft Entra ID)

Is the Global Secure Access service activated? (Have you completed the initial onboarding/activation step under Global Secure Access > Overview (or Get started) to enable all core security settings in the tenant?)

What is the status of the profiles? (Are all three profiles (Microsoft 365, Private Access, Internet Access) currently enabled/set to On in the Traffic Forwarding settings?)

we will recommend you to try below solutions:

So, the "temporarily unavailable" message is most often caused by the administrator missing a required role, or the core GSA service not being fully activated in the tenant.

Verify Administrative Roles

• The account performing the assignment must hold both the Global Secure Access Administrator and the Application Administrator roles. Many users only have the GSA role, but the Application Administrator role is often required for the underlying service principal setup.
• Go to Microsoft Entra admin center > Identity > Roles & admins > Roles, and verify your account has both roles. more at: https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-manage-users-groups-assignment https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

Ensure GSA Service is Fully Activated:

• Even if you have the license, the entire GSA service often requires a one-time activation/onboarding step to fully initialize the required backend service principals.
• Navigate to Global Secure Access > Overview (or Get started). Ensure all necessary setup steps have been acknowledged or completed to fully activate the security service edge (SSE) features.
• also Ensure the GSA client version is 1.7.376.0 or higher. Older versions won’t support user assignment. more at: https://learn.microsoft.com/en-us/entra/global-secure-access/troubleshoot-global-secure-access-client-disabled

Enable the Traffic Profiles and Re-check:

• Once the roles are confirmed and the service is activated, you must explicitly enable the profiles. If a profile is disabled, it will prevent user assignment.
• Go to Global Secure Access > Connect > Traffic forwarding, for all three profiles (Microsoft 365, Internet Access, Private Access), ensure the switch is set to On.
• After confirming roles and profile enablement, try to assign users again: Click View under "User and group assignments" on the desired profile -> Select Add user/group for better understanding and steps: https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-manage-users-groups-assignment

Enable the Traffic Profile First

• If the profile is disabled, the assignment UI will show “temporarily unavailable.” You must enable the profile before assigning users. more at: https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-manage-microsoft-profile

Kindly let us know if the above helps or you need further assistance on this issue. 

Please "Accept the answer" if the information helped you and 'upvote' for it. This will help us and others in the community as well. 

Regards,

Monalisha

HI Monalisha,

Thank you for such a detailed reply, however all these prerequisites are already met.

1. I have Global admin, Application admin, Global Secure Admin role on my account.
2. All 3 profiles are enabled. Please see Temp unavailable.png
3. GSA activation was done few months ago from Dashboard page and I was then able to use M365 forwarding profile as well ( I didnt have Entra suite license at that time).Dashboard.png
4. Conditional access policy is turned off.
5. I installed latest GSA client but it was showing error, that is when I found that users are not assigned in profile and showed temporary unavailable, hence I could not assign any user.

Hi,

Did you find a solution? if so, which one? I encounter the exact same situation and even queried MS Graph to check if my tenant was provisionned, which it is. But I cannot assign the policies to users as..I cannot select users.

I tried to open a ticket with MS, but the react front is crashing, preventing a ticket opening.

Any feedback is welcome.

@sivarshney was there ever a solution for this?