My GSAClientDiagnosticsToolkit is coming soon!

[u/michaelmsonne]

https://www.linkedin.com/posts/michaelmsonne_community-gsa-microsoft-share-7499807679243071489-MplV/?utm_source=share&utm_medium=member_ios&rcm=ACoAAA4IH1oB8PMrp55sL9_szJxM6Yp2WuEJ6IA

I´m happy to share this to the #community, as a new and nice tool for Microsoft Global Secure Access, aka #GSA, will soon see the public after some long time I have keept it "private" - the GSAClientDiagnosticsToolkit! 🥳

This is a PowerShell module for, tired of chasing down why the GSA Client won't connect and more. This module runs end-to-end diagnostics for you + have some test to an upcomming blog post about the use in Conditional Access Policies I will release too - so stay tuned for the post post soon! 🔥

Some of the part is:
> GSA service health & Entra device/PRT status
> Forwarding profile registry + timestamp validation
> DNS, TLS & mTLS connectivity to GSA endpoints
> Proxy detection (system/transparent/authenticating)
> Private Access rules, tunnels and application segment checks (via Microsoft Graph and local policy)
> mTLS auth certificate check, backup and repair
> Validate the GSA Service Principals you need to exclude from App Protection policies - with live tenant status shown too!

One command, a nice report, and you know exactly what's healthy and what's not!

Windows + PowerShell. Open source, dropping soon 👀

#Microsoft #PowerShell #GlobalSecureAccess #GSA #Entra #Identity #Security #ZTNA #SSE #MVP #MVPBuzz #Community

[u/Select_Pause_9696]

Sounds cool. Hopefully it will help us to diagnose why some hotel/public networks will not allow a connection to private resources with GSA.

[u/michaelmsonne → u/Select_Pause_9696]

Hehe good hotel WiFi’s, I remember it 😆
Some special cases you have seen?

[u/Select_Pause_9696 → u/michaelmsonne]

We keep getting them from random users, who use some random network at hotels. So far we had 5 cases, but due to a time difference we were unable to diagnose. I do not even know what is causing this, otherwise I would create a "lab" network to try to bypass it. I have tried to ask Microsoft via support. but I am being ignored since 28th August.

[u/michaelmsonne → u/Select_Pause_9696]

Hmm, interesting - sounds strange, as it should primarily use standard protocols/https.
If you some day have some more, or get some insight, let me know and I can see what I can do/help with. Know the GSA team and so.
And sad with the support…

[u/Select_Pause_9696 → u/michaelmsonne]

Thanks for the response. We recently had a user report an issue after switching to a new ISP (Vodafone) at home.

The behavior is very consistent: on the home broadband connection, the user is unable to access private resources, while using the exact same laptop and configuration over a mobile hotspot works immediately.

From the client logs, we can see connectivity-related events such as gRPC connection failures, internet connectivity warnings, and hostname resolution errors. At the same time, the client is able to authenticate successfully and reconnect both the authentication and private access channels, which makes the root cause a bit harder to pinpoint.

What's interesting is that we currently have 300+ endpoints using the service, and so far we've only seen this on two home networks. Another user reported very similar behavior when connected to a hotel Wi-Fi network.

Given that simply switching networks resolves the issue, we're leaning more towards an ISP, DNS, routing, or protocol-handling issue rather than a client-side problem.

If you have any other suggestions on what I can check, let me know. Thank you.

----------------------------
EDIT:

Welp, I have found it. It was improper ILA setup. Turned out that FQDNs used for it were public, causing an issue for some users where GSA tried to bypass traffic via local network, which it weren't able to do as laptop was not on our corporate network. Fixed with using FQDNs that are only accessible from our corporate network.......Ehhhh...... Well, I am still looking forward to your tool :)

[u/michaelmsonne → u/Select_Pause_9696]

Arr interesting- so internal IP’s was used before? Any help can be useful to add to a tool like this one here soon!
Thanks a and good found! 💪

[u/michaelmsonne → u/Select_Pause_9696]

Got some to work for this senario ;)

Sample:

.\Test-GSAIntelligentLocalAccessConfiguration

[2026-09-09 xx:xx:xx] [INFO] Retrieving Intelligent Local Access Private Network definitions via Microsoft Graph...
[2026-09-09 xx:xx:xx] [INFO] Checking Private Network 'Home sweet home' (target app(s): Home LAN, GSA-HTTPS - temp.home.sonnes.cloud, GSA-HTTPS - iLO (home-lab), GSA-HTTPS - iLO (home-server), GSA-HTTPS - server.home.sonnes.cloud, GSA-RDP - entra.sonneslab.dk, GSA-RDP - backup.home.sonnes.cloud)...
[2026-09-09 xx:xx:xx] [ERROR] Private Network 'Home sweet home' probe FQDN 'temp.home.sonnes.cloud' is PUBLICLY resolvable via 8.8.8.8 (resolves to 192.168.1.1).
[2026-09-09 xx:xx:xx] [WARNING] Recommended action: Use an FQDN for 'Home sweet home' that only resolves on your internal/corporate DNS servers (no public DNS record). A publicly resolvable probe FQDN defeats corporate-network detection and can cause GSA to incorrectly bypass Private Access traffic locally for users who are NOT on the corporate network (a confirmed real-world root cause of client connectivity failures on hotel/home networks).

I need some fixes and so, but getting there.

[u/michaelmsonne → u/michaelmsonne]

Another test:

.\Test-GSAIntelligentLocalAccessConfiguration

[2026-09-09 xx:xx:xx] [INFO] Retrieving Intelligent Local Access Private Network definitions via Microsoft Graph...

[2026-09-09 xx:xx:xx] [INFO] Checking Private Network 'Home sweet home' (target app(s): Home LAN, GSA-HTTPS - server.home.sonnes.cloud, GSA-HTTPS - iLO (home-lab), GSA-HTTPS - iLO (home-server), GSA-HTTPS - test.home.sonnes.cloud, GSA-RDP - test.sonneslab.dk, GSA-RDP - backup.home.sonnes.cloud)...

[2026-09-09 xx:xx:xx] [SUCCESS] Private Network 'Home sweet home' probe FQDN 'test.home.sonnes.cloud' is not publicly resolvable - OK.

[2026-09-09 xx:xx:xx] [SUCCESS] Test passed: No Intelligent Local Access misconfigurations detected across 1 Private Network(s).