Using Global Secure access and preventing ipv6 traffic

Question

Using Global Secure access and preventing ipv6 traffic

Phil Littlewood 0

We are using Global Secure Access and it's not playing well with IPv6. We have followed the steps apply the registry keys to always prefer ipv4 over ipv6 but some connections are still going over ipv6, which prevents us from using location based conditional access to block non-trusted locations.

All our users work remotely, so we cannot add every home ipv6 address to trusted locations. We need to route traffic through GSA so we can just tag GSA traffic as trusted.

Without completely disabling IPv6 (which is strongly discouraged by Microsoft), what else can we do? Why does GSA and Windows not follow the registry setting

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents HEX 20

0 comments

5 answers

Your answer

Answer 1

Kiranpreet Kaur 0

Hi

It is September 2026 and IPv6 not passing through GSA limitation is still existing,

Has anyone found any workaround for this issue or not yet?

What is the supported enforcement method for compliant-network Conditional Access when a Windows application continues to establish IPv6 connections despite DisabledComponents=0x20, given that GSA does not acquire IPv6?

Thank you.

0 comments

Answer 2

Phil Littlewood 0

It's really unfortunate that this piece is missing from GSA. I hope Microsoft will plug this gap soon

0 comments

Answer 3

Phil Littlewood 0

Hi

Thanks for your response. I'm already aware of all this information. Is there any sign that Microsoft will fix GSA to either support or block ipv6 traffic when in use?

Location based security is a useful protection layer which we are missing.

Anonymous

2025-10-29T08:18:04.08+00:00
Hi Phil,

Thank you for posting your query on Microsoft Q&A.

Regarding your concern about Global Secure Access (GSA) and IPv6 traffic handling, Microsoft currently does not support blocking or fully tunneling IPv6 traffic through GSA. Despite registry and configuration attempts to prefer IPv4, some IPv6 traffic still bypasses the GSA tunnel due to how Windows manages IPv6 as a core networking protocol.

Microsoft recognizes that location-based security via IP addresses is an important protection layer, and the limitation with IPv6 in GSA is a known issue actively tracked by Microsoft. However, as of now, there is no announced timeline for when this will be resolved or if GSA will support full IPv6 tunneling or blocking.

In the meantime, Microsoft recommends focusing on device and network compliance in Conditional Access policies rather than relying solely on IP-based location security. This approach helps secure access even when IP addresses, including IPv6 ones, cannot be fully controlled or filtered.

In brief:

GSA currently handles only IPv4 traffic for tunneling; IPv6 traffic is partially unmanaged.

Disabling IPv6 completely is not advised as it may break essential Windows and cloud features.

No specific update or fix for IPv6 support in GSA is available publicly yet.

Use Conditional Access to require device compliance and trusted network status for better security coverage.

Helpful references:

Known Limitations for Global Secure Access

Global Secure Access FAQ

Conditional Access policies

I hope this updated information clarifies the current state regarding IPv6 and GSA. Please feel free to reach out for further assistance.

Answer 4

Phil Littlewood 0

Hi Praveen

Thanks for sharing the documentation. Prior to asking the question we already followed all the steps described there but we still see traffic flowing over ipv6. For some reason the registry key to prefer ipv6 traffic is not reliable.

Do you have any other suggestions?

Anonymous

2025-10-27T09:38:31.1066667+00:00
Hi Phil,

Thank you for posting your query on Microsoft Q&A.

The issue you’re seeing, where IPv6 traffic still bypasses Global Secure Access (GSA) even after applying the registry settings, is a known limitation. The registry key (DisabledComponents = 0x20) only tells Windows to prefer IPv4, but does not fully block or tunnel all IPv6 traffic. As a result, some apps and system processes may still use IPv6, and GSA currently does not route or secure those IPv6 connections.

In Microsoft Entra and Windows, IPv6 remains partially enabled by design to support core networking services. Microsoft does not recommend completely disabling IPv6, since that can cause problems with Windows and Microsoft 365 features. This means GSA can only guarantee that IPv4 connections are tunneled and managed, which can be a challenge for enforcing location-based Conditional Access for remote users.

Please follow the steps below to handle this scenario:

Use Conditional Access Based on Device or Network Compliance: Instead of relying only on trusted IP addresses, use conditional access policies that check for device compliance or require the session to be routed through a “compliant network” (the GSA tunnel). This is the most reliable way to enforce security when you cannot control every IP assignment.

Do Not Fully Disable IPv6: Avoid completely disabling IPv6 in network adapter settings or with aggressive registry values. This can lead to unexpected connectivity issues or application failures.

Monitor Microsoft Updates and Known Limitations: IPv6 tunneling support in GSA is a top feature request and may be addressed in future releases. You can track ongoing updates and known limitations here:

Known Limitations for Global Secure Access

Global Secure Access FAQ

In brief:

IPv6 traffic may still leak past GSA, and the registry preference does not fully control it.

Use device/network compliance checks rather than IP-based controls for location security.

Don’t completely disable IPv6, as it is unsupported and may cause system problems.

Keep an eye on future GSA updates for expanded IPv6 support.

I hope this information is helpful. Please feel free to reach out if you have any further questions. If the answer is helpful, please click "Accept Answer" and kindly Upvote it.

Answer 5

Hi Phil,

Thank you for posting your query on Microsoft Q&A.

The issue you're experiencing is expected and relates to current IPv6 limitations in Microsoft Entra Global Secure Access (GSA). As of October 2025, GSA supports only IPv4 traffic, and any IPv6 connections bypass the GSA client, which can affect your Conditional Access policies and cause traffic to appear as “untrusted.”

Why You are Seeing This Behavior

1. IPv6 Not Supported by GSA: According to Microsoft’s official documentation, the Global Secure Access client tunnels only IPv4 traffic. IPv6 connections aren’t acquired or processed by the client, so they route directly through the network instead of the GSA tunnel. (Reference: Known Limitations for Global Secure Access)

2. Registry Settings Only Influence Protocol Preference: Your current registry setting

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents = 0x20

tells Windows to prefer IPv4 over IPv6, but it does not completely disable IPv6. The OS design mandates that IPv6 remains partially active to support key Windows and Entra services.

3. Conditional Access Policy Limitation with IPv6: If users’ devices initiate IPv6 connections, Conditional Access policies that rely on IP-based location evaluation may mark IPv6-based sessions as “unknown” or “non-trusted,” since they don’t traverse the GSA tunnel.

Recommended Steps to Fix or Work Around the Issue

1. Confirm Registry Setting and Reboot Ensure your registry value is correctly configured: HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents = 32 (hex 20)
Reboot the system to apply changes. This prioritizes IPv4 without disabling IPv6 entirely.

2. Disable Secure DNS and QUIC in Browsers Some browsers and applications use DNS over HTTPS (DoH), DNS over TLS (DoT), or QUIC—which prefer IPv6 for faster lookups—bypassing GSA. Disable QUIC and DoH in browsers like Microsoft Edge and Chrome to force IPv4 DNS traffic through the GSA client.

3. Use the “Compliant Network” Signal in Conditional Access Instead of enforcing IP-based location conditions, use Global Secure Access Compliant Network Check to evaluate if a session passes through the GSA tunnel. This approach is more robust and eliminates the need to maintain lists of trusted IPv4/IPv6 addresses. To enable this:

In the Entra Admin Center, go to Global Secure Access > Settings > Session management > Adaptive access.
Turn on Enable CA Signaling for Entra ID (covering all cloud apps).
Verify that a named location called All Compliant Network locations exists. (Ref: Enable Compliant Network Check with Conditional Access)

4. Don’t Fully Disable IPv6 Microsoft explicitly discourages disabling IPv6 system‑wide. Some services (Entra ID, DNS, and internal name resolution) depend on IPv6 to function properly. Disabling it completely can lead to connectivity or authentication failures.

5. Monitor Known Limitations and Roadmap Updates IPv6 tunneling support is not yet available for the GSA client. Microsoft has indicated that enhancements including dual‑stack (IPv4 and IPv6) tunneling are under development. You can monitor upcoming updates here: Known Limitations for Global Secure Access

I hope this explanation clarifies the IPv6 behavior with Global Secure Access. Please click “Accept Answer” if this helps resolve your issue, and Upvote to assist others facing similar conditions.