I have GSA setup for Private Access

Hey Gordon, it sounds like you’ve got your Global Secure Access (GSA) Quick Access app up for private access, but you’re only able to reach it about half the time. Usually when Private Access is inconsistent, it boils down to one or more of these:

1. Unhealthy connectors
2. DNS resolving to multiple connector IPs (and some aren’t reachable)
3. Backend load-balancing or unhealthy application nodes

Here’s how you can narrow it down and fix it:

1. Test with a single connector • In the Entra admin center, go to Global Secure Access > Private Access > Connector groups. • Temporarily remove all but one connector from the group. • Try accessing your private app repeatedly. – If it becomes reliable, you know the issue is with one of the removed connectors, DNS, or backend routing.
2. Check connector health and logs • In Entra admin center, check “Connector health” under the Private Access section. • Look for intermittent offline events or high latency. • On the connector server itself, make sure it can resolve and reach your on-prem resource (ping/FQDN, telnet to port). • Review the connector Windows event logs for errors.
3. Validate DNS resolution • Ensure your device NRPT table (Private DNS) is in place and not overridden by on-prem GPO. • Confirm that the FQDN of your private app always resolves to the connector IPs you expect. • If you’re using secure DNS (DoH/DoT/DNSSEC) in your browser or OS, disable it—GSA needs plain DNS.
4. Verify GSA client settings on the endpoint • Right-click the GSA icon in the system tray, go to Advanced Diagnostics > Health check. All tests should be green. • In Advanced Diagnostics > Forwarding profile, make sure your private app’s FQDN/IP is set to “Tunnel” (not “Bypass”). • Ensure IPv6 is disabled on the client device (GSA only supports IPv4).
5. Review licensing & app assignment • Confirm you have the right licenses: Entra ID P1/P2 plus Entra Private Access or Entra Suite. • Make sure users are assigned to the Quick Access/GSA app directly—no nested groups. • Double-check that the app is linked to an active connector group and that the Private Access profile is enabled in Global Secure Access > Connect > Traffic forwarding.

Follow-up questions to help us zero in on the root cause:

1. Are all your connectors in the same region, or spread globally?
2. Do you see errors in the client Advanced Diagnostics logs when it fails?
3. Have you tried toggling DNS settings (NRPT) or disabling secure DNS on the client?
4. Which OS version is the GSA client running on, and is IPv6 disabled?
5. Any load-balancing in front of your on-prem app that might send you to a bad node?

Hope this helps! Let me know what you find or if you need more pointers.

Reference:

• Troubleshoot Private Access issues: https://learn.microsoft.com/entra/global-secure-access/concept-private-access

• How to configure Quick Access: https://learn.microsoft.com/entra/global-secure-access/how-to-configure-quick-access

• Troubleshoot connectors: https://learn.microsoft.com/entra/global-secure-access/troubleshoot-connectors

• Client Health check & Forwarding profile: https://learn.microsoft.com/entra/global-secure-access/troubleshoot-global-secure-access-client-diagnostics-health-check

• Enable Private Access traffic profile: https://learn.microsoft.com/entra/global-secure-access/how-to-manage-private-access-profile#enable-the-private-access-traffic-forwarding-profile

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.