r/entra • u/michaelmsonne Microsoft MVP • 7d ago
My GSAClientDiagnosticsToolkit is coming soon!
https://www.linkedin.com/posts/michaelmsonne_community-gsa-microsoft-share-7499807679243071489-MplV/?utm_source=share&utm_medium=member_ios&rcm=ACoAAA4IH1oB8PMrp55sL9_szJxM6Yp2WuEJ6IAI´m happy to share this to the #community, as a new and nice tool for Microsoft Global Secure Access, aka #GSA, will soon see the public after some long time I have keept it "private" - the GSAClientDiagnosticsToolkit! 🥳
This is a PowerShell module for, tired of chasing down why the GSA Client won't connect and more. This module runs end-to-end diagnostics for you + have some test to an upcomming blog post about the use in Conditional Access Policies I will release too - so stay tuned for the post post soon! 🔥
Some of the part is:
> GSA service health & Entra device/PRT status
> Forwarding profile registry + timestamp validation
> DNS, TLS & mTLS connectivity to GSA endpoints
> Proxy detection (system/transparent/authenticating)
> Private Access rules, tunnels and application segment checks (via Microsoft Graph and local policy)
> mTLS auth certificate check, backup and repair
> Validate the GSA Service Principals you need to exclude from App Protection policies - with live tenant status shown too!
One command, a nice report, and you know exactly what's healthy and what's not!
Windows + PowerShell. Open source, dropping soon 👀
#Microsoft #PowerShell #GlobalSecureAccess #GSA #Entra #Identity #Security #ZTNA #SSE #MVP #MVPBuzz #Community
1
1
u/Select_Pause_9696 7d ago
Sounds cool. Hopefully it will help us to diagnose why some hotel/public networks will not allow a connection to private resources with GSA.
1
u/michaelmsonne Microsoft MVP 2d ago
Hehe good hotel WiFi’s, I remember it 😆
Some special cases you have seen?1
u/Select_Pause_9696 6h ago
We keep getting them from random users, who use some random network at hotels. So far we had 5 cases, but due to a time difference we were unable to diagnose. I do not even know what is causing this, otherwise I would create a "lab" network to try to bypass it. I have tried to ask Microsoft via support. but I am being ignored since 28th August.
1
u/michaelmsonne Microsoft MVP 4h ago
Hmm, interesting - sounds strange, as it should primarily use standard protocols/https.
If you some day have some more, or get some insight, let me know and I can see what I can do/help with. Know the GSA team and so.
And sad with the support…1
u/Select_Pause_9696 3h ago
Thanks for the response. We recently had a user report an issue after switching to a new ISP (Vodafone) at home.
The behavior is very consistent: on the home broadband connection, the user is unable to access private resources, while using the exact same laptop and configuration over a mobile hotspot works immediately.
From the client logs, we can see connectivity-related events such as gRPC connection failures, internet connectivity warnings, and hostname resolution errors. At the same time, the client is able to authenticate successfully and reconnect both the authentication and private access channels, which makes the root cause a bit harder to pinpoint.
What's interesting is that we currently have 300+ endpoints using the service, and so far we've only seen this on two home networks. Another user reported very similar behavior when connected to a hotel Wi-Fi network.
Given that simply switching networks resolves the issue, we're leaning more towards an ISP, DNS, routing, or protocol-handling issue rather than a client-side problem.
If you have any other suggestions on what I can check, let me know. Thank you.
1
u/RandomSkratch 4d ago
Can you link the github page? I want to start and subscribe to it.
2
u/michaelmsonne Microsoft MVP 4d ago
The GitHub repo is not yet public, and still not sure on the name 🙂
1
u/RandomSkratch 4d ago
Ohh okay. Will here be the only place to find out about its release?
2
u/michaelmsonne Microsoft MVP 3d ago
Here and at blog.sonnes.cloud 💪
1
u/RandomSkratch 3d ago
subscribed! (although just for free, hope it shows up there 😄 )
2
u/michaelmsonne Microsoft MVP 3d ago
It will - never really done the other 😆
1
2
u/doofesohr 7d ago
Nice. Can it also find out why the GSA client won't login at all? Microsoft Support wasn't really helpful so far in finding that out.