GSA traffic forwarding profile user/group assignment shows "temporarily unavailable" for all three default profiles.

Question

GSA traffic forwarding profile user/group assignment shows "temporarily unavailable" for all three default profiles.

Larry Yuan 0

Summary: GSA traffic forwarding profile user/group assignment shows "temporarily unavailable" for all three default profiles. Root cause identified: the profile backing service principals do not exist in the tenant.

Evidence gathered via Graph:

GET /beta/networkAccess/tenantStatus returns onboardingStatus: onboarded, onboardingErrorMessage: null.
GET /beta/networkaccess/forwardingProfiles returns all three default profiles, state: enabled, each with a servicePrincipal reference.
GET /v1.0/servicePrincipals/{id} returns 404 Request_ResourceNotFound for all three backing SPs. None appear in Enterprise applications.
Affected appIds: eeb422fa-f490-4dbf-a1d7-9eea09648a00 (M365), fc54344a-4028-4f64-b219-be825b729175 (Private), 075900dc-44c3-4ced-a401-bba5d923be2c (Internet).
POST /beta/networkAccess/microsoft.graph.networkaccess.onboard returns 409 Conflict, "The tenant has already been onboarded" — so re-onboard cannot recreate the SPs.

Request: Re-provision the traffic forwarding profile backing service principals. Suspected orphaned state from GSA preview onboarding, where the onboarded flag is set but the downstream backing apps were never created or were cleaned up. Admin-side onboard is blocked by the conflict, so this requires a backend reset.

0 comments

1 answer

Your answer

Answer 1

Hello Larry Yuan,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that your GSA traffic forwarding profile user/group assignment shows "temporarily unavailable" for all three default profiles.

This is not the assignment UI itself, but one of the documented assignment eligibility requirements: the traffic profile must be enabled, the user must be directly assigned or directly belong to a supported group, nested groups are not supported, the GSA client must be version 1.7.376.0 or later, and the profile is fetched for the Microsoft Entra user signed into the Windows device, not merely the user visible in the GSA client. - https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-manage-users-groups-assignment

What you can do is to:

Confirm the required GSA traffic forwarding profile is enabled, because assignment alone does not forward traffic.
Assign the affected user directly, or assign a supported group where the user is a direct member. Nested groups must not be used.
Use only supported groups: Security groups or Microsoft 365 groups withSecurityEnabled=True.
Upgrade the Global Secure Access client to at least 1.7.376.0, because older clients do not receive user/group-assigned traffic forwarding profiles.
Confirm the Windows signed-in Microsoft Entra user is the same user assigned to the profile, or is a direct member of the assigned group.
Validate the result from Global Secure Access Client > Advanced Diagnostics > Overview and Forwarding profile, then confirm whether the traffic action is Tunnel, Bypass, or Block from the Traffic tab. - https://learn.microsoft.com/en-us/entra/global-secure-access/troubleshoot-global-secure-access-client-advanced-diagnostics

After correcting the assignment scope, group membership, client version, and signed-in user context, the traffic forwarding profile should be delivered to the client and the expected forwarding rules should appear in Advanced Diagnostics. If the profile still does not appear after all these checks pass, this becomes a backend/service investigation and should be escalated to Microsoft Support with the client diagnostic package, profile ID, tenant ID, affected UPN, device ID, timestamp, destination FQDN/IP, and correlation vector ID. - https://learn.microsoft.com/en-us/entra/global-secure-access/troubleshoot-global-secure-access-client-advanced-diagnostics. Use the above associated official Microsoft resources for more reading and steps.

I hope this is helpful. Please! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please do not close the thread by upvoting and accepting the answer if any part of it is helpful.

Larry Yuan 0 Reputation points

2026-07-22T23:14:53.28+00:00

The solution you provided has absolutely nothing to do with the issue I'm having.
Sina Salam 31,456 Reputation points Volunteer Moderator

2026-07-23T14:30:05.2333333+00:00

Hello @Larry Yuan,

You are correct. My earlier response was on a normal user/group assignment or client-delivery issue.

In this case, the issue occurs before client policy delivery and should be handled as a backend provisioning issue. Kindly open a Microsoft Support case via your Azure Portal or contact Priority Customer Service (PCS) and request backend reprovisioning or reset of the Global Secure Access traffic forwarding profile backing service principals. Include the tenant ID, all three forwarding profile IDs, the missing service principal object IDs, the app IDs, Graph responses showing 404, the tenantStatus output, the forwardingProfiles output, and the 409 Conflict response from the onboard call.

Cheers.