GSA authentication issues

The behavior is caused by how Global Secure Access (GSA) and Conditional Access (CA) interact when internet traffic is forced through the GSA tunnels.

With Microsoft Entra Internet Access enabled, the users’ browser sessions to the financial app and its embedded Power BI/Power Automate features are now evaluated through the GSA internet traffic profile. That changes:

1. How CA is enforced on the traffic
   • Both the Microsoft and Internet access forwarding profiles use Microsoft Entra Conditional Access policies to authorize access to their tunnels. If CA doesn’t grant access to the tunnel, users can be partially or fully blocked from reaching the app or its dependent services.
   • When authorization to a tunnel isn’t granted or is constrained (for example, by strict session controls or device conditions), users can end up in a state where some resources or embedded components fail to load while others work.
2. Tunnel authorization and recovery limitations
   • Known tunnel authorization limitations explicitly call out that CA is used to Grant/Block access to the Microsoft and Internet access forwarding profiles, and that misconfigured policies can lock users out or prevent them from restoring compliance.
   • If the CA policy that disables session persistence is also impacting the GSA tunnel authorization (for example, by device compliance, location, or session controls that don’t account for GSA), the result is broken or incomplete app functionality once traffic is forced through GSA.
3. Why it only appears with GSA turned on
   • Before GSA, the same CA policy was evaluated directly against the app sign-in and its embedded services, without the extra GSA tunnel authorization step.
   • After enabling GSA Internet Access, the same users and sessions must satisfy CA both for the app and for the GSA internet traffic profile. Any mismatch or overly strict condition (especially around session persistence, device state, or location/IP) can cause the tunnel to not fully authorize or to drop/interrupt flows that the app and embedded Power BI/Power Automate features depend on.
   • Disabling the CA policy removes that extra constraint, so the GSA tunnel no longer conflicts with session behavior and the app features start working again.

Practical next steps based on the documented limitations:

• Review the CA policy that disables session persistence and how it applies to:
  • The Internet access forwarding profile target resource.
  • The users and devices now using GSA.
• Consider scoping or adjusting the CA policy so that:
  • It does not unintentionally block or over-constrain access to the GSA internet traffic tunnel for these traveling users.
  • Any required compliance or discovery endpoints (for example, Intune or custom compliance scripts, if used) are bypassed in the Internet access forwarding profile so users can maintain or regain compliance.

These limitations are expected behavior when CA is tightly controlling tunnel authorization for GSA internet traffic. The issues appear only when GSA is on because that is when CA is being enforced at the tunnel level in addition to the application level.

References:

• Universal Conditional Access through Global Secure Access
• Known limitations for Global Secure Access