Global Secure Access apply only to platform Windows and exclude any other platform

Question

Hello team,

We are implementing global Secure access in our company.

We know GSA is available in Windows with a client and in Android using defender for endpoint.
For iOS and MAC, it is in Preview.

• Objective:
  We would like to deploy the Global Secure Access to only Windows, Meaning that, all the windows OS must connect from Global secure access.
  If Windows devices try to access the cloud resources using internet, it should be blocked.
• If the connection comes from Android, iOS or MAC from internet, it should be allowed.

I am being trying to do it from conditional access policies adding:

• Locations: "All compliant networks"
• Platform: Include "Any platform " and exclude Windows.

the issue with this Conditional access policy is that the windows can connect either from internet or GSA agent,
If the GSA agent is disabled, the user can access the Sharepoint because the exclusion in the platform allow it.

So, the objective is force Windows use GSA.

Do you have any idea how to configure the conditional access policy to achieve it?

Answer 1

Hello @Sergio Londono,

Thank you for posting your query on Microsoft Q&A.

Based on your description, I understand that your main objective is to block access to cloud resources for users accessing them from any public internet/IP address, except for the GSA Internet. This should only apply target Windows device platforms.

From the screenshot you provided, it appears that you have configured conditions for the device platform and locations. In the device platform section, I noticed that you have enabled the setting to include any device platform but have excluded Windows. To properly target Windows devices with your policy, you should configure it to include only Windows devices instead of including all devices and excluding Windows.

This is the main reason why the Conditional Access (CA) policy is not applying to user sign-ins when they access it from outside GSA network.

To resolve this issue, I recommend modifying your policy to include only Windows devices in the device platform section and test the policy.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.