How to Reprovision GSA home region to Europe/UK South

Question

How to Reprovision GSA home region to Europe/UK South

Neville 0

Our Global Secure Access (GSA) was provisioned with Australia Southeast as the home region. Our Azure infrastructure and connector VM are in UK South (Europe). The Quick Access app cannot be assigned to our European connector group due to error "A quick access app cannot be assigned to a group outside parent region." This is reproduced in both the portal and via Microsoft Graph API (beta endpoint).

Would appreciate a steer on how to undertake the reprovision. Thank you.

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-31T18:32:41.3466667+00:00

Hello Neville

This is by design: Global Secure Access Quick Access apps are region-locked to the GSA home region (Australia Southeast), so they cannot be assigned to connector groups in UK South.

Hence, to fix the issue GSA home region cannot be changed → deprovision and reprovision GSA in UK South, then recreate connectors and apps.
Neville 0 Reputation points

2026-03-31T19:20:04.54+00:00

Hello Rukmni,

Thank you for prompt reply. To clarify what we have already attempted:

Deleted all custom connector groups via Microsoft Graph API

Created a new connector group via Graph API specifying region 'eur' — confirmed created with region: eur

Reinstalled the Private Network Connector on our UK South VM and assigned it to the new eur group

Attempted to save the Quick Access app with the new eur connector group — same error both in portal and via Graph API PUT to applications/{id}/connectorGroup/$ref

The tenant's GSA home region appears to be locked at Australia Southeast at the platform level regardless of connector group region. The Default connector group also shows region 'aus' and cannot be deleted.

Could you advise the specific steps or API calls required to deprovision GSA entirely and reprovision it in UK South? Or alternatively, is this something that requires a Microsoft backend operation?"
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-31T19:42:49.6033333+00:00

Hello Neville

Thank you for sharing the details will check internally and get back to you!

1 answer

Your answer

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-31T18:32:41.3466667+00:00

Hello Neville

This is by design: Global Secure Access Quick Access apps are region-locked to the GSA home region (Australia Southeast), so they cannot be assigned to connector groups in UK South.

Hence, to fix the issue GSA home region cannot be changed → deprovision and reprovision GSA in UK South, then recreate connectors and apps.
Neville 0 Reputation points

2026-03-31T19:20:04.54+00:00

Hello Rukmni,

Thank you for prompt reply. To clarify what we have already attempted:

Deleted all custom connector groups via Microsoft Graph API

Created a new connector group via Graph API specifying region 'eur' — confirmed created with region: eur

Reinstalled the Private Network Connector on our UK South VM and assigned it to the new eur group

Attempted to save the Quick Access app with the new eur connector group — same error both in portal and via Graph API PUT to applications/{id}/connectorGroup/$ref

The tenant's GSA home region appears to be locked at Australia Southeast at the platform level regardless of connector group region. The Default connector group also shows region 'aus' and cannot be deleted.

Could you advise the specific steps or API calls required to deprovision GSA entirely and reprovision it in UK South? Or alternatively, is this something that requires a Microsoft backend operation?"
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-31T19:42:49.6033333+00:00

Hello Neville

Thank you for sharing the details will check internally and get back to you!

Answer 1

Global Secure Access (GSA) resources are region-bound, and Quick Access apps can only be assigned to connector groups in the same parent region as the GSA home region. The error “A quick access app cannot be assigned to a group outside parent region” is the expected behavior when the connector group is in a different region (UK South/Europe) than the provisioned GSA home region (Australia Southeast).

The provided context does not describe any supported process or tooling to reprovision or move an existing GSA home region from one geography/region (Australia Southeast) to another (Europe/UK South). It only specifies:

Quick Access requires a connector group with at least one active private network connector, and the connector version requirement.
The list of Global Secure Access locations (points of presence) across regions, including UK South and other European locations.

Because no reprovisioning or migration steps for the GSA home region are documented in the context, the only supported guidance from the available information is:

Ensure connector groups and Quick Access apps are created and used within the same parent region.
If a different home region is required (for example, to align with UK South/Europe), this must be handled via Azure support so that engineering can review and process the request, similar to other region-related changes that require support and engineering validation.

The documented region access request process indicates that such region-related changes are processed through a support ticket and validated by the Azure Engineering team before access or changes are granted. For a GSA home-region reprovision, open a support request with Microsoft, clearly stating:

Current GSA home region (Australia Southeast).
Target region/geography (Europe/UK South).
Impact (inability to assign Quick Access apps to UK South connector groups).

The support and engineering teams can then confirm whether reprovisioning or tenant-level changes are possible for the specific GSA deployment and perform any required backend operations.

References: