66 questions
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(131.20000000000002, 23%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJH%3C/text%3E%3C/svg%3E)
What is the best way to do this with Firefox. I have added the correct entries for it to be disabled but it still shows up in the GSA client as being enabled?
GSA: QUIC is disabled in Chrome and Egde policy, but still fail health check
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(185.6, 57.99999999999999%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETR%3C/text%3E%3C/svg%3E)
Thorbjørn Henriksen
20
Reputation points
On the Global Secure Access client for Windows , QUIC show warning for Edge and Chrome on health check. However on both Chrome and Egde in the Policy: "QuicAllow" is set to "false", and I can also see it in the registry.
On flags Quic is set to "default". If I change it manually in flags to "disabled" it becomes compliant.
So it seems the health check checks the setting under flags, not under policy.
The problem is that from what I understand on flags settings in Chrome and Edge can´t be managed by GPO/Intune, only the policy settings.
Any solution to this ?
Microsoft Security | Microsoft Entra | Microsoft Entra Internet Access
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(188.79999999999998, 26%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EN%3C/text%3E%3C/svg%3E)
Navya 20,575 Reputation points Microsoft External Staff Moderator2024-11-01T18:16:18.8233333+00:00 Thank you for posting this in Microsoft Q&A.
I understand you're encountering an issue where the Global Secure Access client for Windows is showing a warning for QUIC in Edge and Chrome, despite having the policy setting
QuicAllowset tofalse. The health check appears to be checking the flags setting instead of the policy, which is causing a compliance issue.However, it is important to note that flags settings in Chrome and Edge cannot be managed by GPO/Intune, only the policy settings. Therefore, you may not be able to manage the Quic flag setting through GPO/Intune.
If you want to disable Quic for Chrome and Edge, you can try disabling it through the command line. Here are the steps:
1.Open Command Prompt as an administrator.
2.Type the following command for Chrome:
chrome.exe --disable-quic3.Type the following command for Edge:
msedge.exe --disable-quic(OR) You can manually set the QUIC protocol to "disabled" in the flags settings by navigating to:
- For Chrome:
chrome://flags/#enable-quic - For Edge:
edge://flags/#enable-quic
I hope this helps! Let me know if you have any other questions.
Thanks,
Navya.
- For Chrome:
-
Thorbjørn Henriksen 20 Reputation points
2024-11-01T19:44:41.5033333+00:00 So does the Quic flag setting actually need to be disabled for GSA to work properly if the Quic policy setting is disabled?
If it's not needed the health check should be changed to look at the policy setting, not the flag, since the policy setting be easily managed by IT Admins.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(252.8, 92%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETG%3C/text%3E%3C/svg%3E)
Timmothy Green 5 Reputation points2024-11-21T18:06:05.13+00:00 Yes, please make it check the policy instead of or in addition to the flags. Relying on flags is not scalable.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(102.4, 76%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGT%3C/text%3E%3C/svg%3E)
Greg Thomson 0 Reputation points2024-12-05T19:50:28.71+00:00 I agree that the QUIC Health Check isn't helpful. I have policy deployed to disable QUIC. I can see the registry key is set to disable, the flags in both Chrome and Edge show QUIC as disabled. All this and the Health Check still reports False.... I don't know what it's checking but it's not a meaningful check.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(278.4, 99%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECW%3C/text%3E%3C/svg%3E)
Chris Waddington 0 Reputation points2025-01-21T11:24:09.5333333+00:00 I see the GSA client disconnect a few times a day and wondered if I needed to fix the QUIC error in the GSA Health Check. From what is being said the error showing a reporting bug rather than an incorrect setting in Edge - I have manually set the flag to disabled in both Edge and Chrome.
Sign in to comment