Global Secure Access is signing into my account by default on user's device. Cannot change login.

Global Secure Access (GSA) signs in silently with the Microsoft Entra user who is signed into Windows and uses that identity to fetch traffic forwarding profiles. The client itself doesn’t support multiple simultaneous users on the same device and doesn’t expose a simple “switch account” if Windows is still logged in with the original Entra user.

To stop it defaulting to the wrong account and repeatedly prompting, focus on the Windows sign-in and the traffic profile assignment rather than only clearing credentials:

1. Ensure the correct Entra user is signed into Windows
   • GSA traffic profiles are fetched on behalf of the Microsoft Entra user logged into Windows, not just the user logged into the client.
   • Have the user sign out of Windows completely and sign back in with their own Microsoft Entra account (not the admin’s account).
   • Users who sign in with a local or non-synced AD DS account only receive profiles that are assigned to all users; if your admin account is the only one assigned, GSA will keep trying to use that identity.
2. Verify traffic forwarding profile assignments
   • As a Global Secure Access Administrator, go to Global Secure Access > Connect > Traffic forwarding in the Microsoft Entra admin center.
   • Confirm at least one traffic forwarding profile is enabled.
   • In User and group assignments for that profile:
     • Either set Assign to all users to Yes so any signed-in Entra user on that device gets a valid policy, or
     • Explicitly assign the actual user (or a group they are a direct member of) and remove any unnecessary assignment to the admin account.
   • This prevents the client from trying to use the admin’s identity when the user signs in.
3. Confirm device and user authentication state
   • On the user’s laptop, sign in as the user’s Entra account and run:
     • dsregcmd /status and check AzureAdPrt is YES (indicates a valid Primary Refresh Token for the user).
   • Ensure the device is joined to the correct tenant and that both device and user can authenticate to Microsoft Entra.
4. Check for Conditional Access or policy issues
   • In the Entra admin center, review non-interactive sign-in logs for the user to confirm the Global Secure Access client is authenticating successfully.
   • If Conditional Access, MFA, or Terms of Use are blocking or requiring interaction, the client may keep prompting. Adjust policies or ensure the user completes MFA/ToU as required.
5. Use the client UI and diagnostics to confirm the correct user
   • On the user’s device, check the GSA system tray icon:
     • Red circle: signed out or not running.
     • Green circle: signed in and running.
   • Right-click the icon → Advanced Diagnostics → Overview and verify the Username shown is the user’s UPN, not the admin’s.
   • If it still shows the admin, sign out of Windows and sign back in as the correct user, then restart the client.

If the client ever shows “Global Secure Access – disabled by your organization,” verify that:

• At least one traffic forwarding profile is enabled, and
• The user is assigned to it (or Assign to all users is enabled), and
• The policy service hostname resolves and is reachable in the client’s Health check.

These steps ensure the laptop uses the user’s own Entra identity for Global Secure Access and stops prompting for the admin’s account on startup.

References:

• Troubleshoot the Global Secure Access client: disabled by your organization
• Troubleshoot the Global Secure Access client for Windows: Advanced diagnostics
• Universal Conditional Access through Global Secure Access