Issue with Global Secure Access – Licensing and "Breakglass Mode" Error

Question

Good morning, Microsoft team,

At the end of last year, I came across the new Global Secure Access feature in Entra ID. I began testing it with only my user account (Global Admin with an active E5 license), and it worked perfectly.

However, when I added a few members of my IT team to begin testing as well — all of whom also have E5 licenses — they received a message from the client on their laptops stating, “Disabled by your organization.” In the Health Check section under Advanced Diagnostics, the error “Breakglass mode is enabled” appeared.

I followed all the troubleshooting steps recommended in the official documentation, but the issue persisted. That’s when I noticed the Entra ID portal was displaying a message stating that my organization does not have the required license.

I turned off the Private Access toggle, and since then, I’m no longer able to re-enable it. I’m stuck at this point, as all users involved have Microsoft 365 E5 licenses with Entra ID P1 and P2 enabled.

Can you help clarify what might be happening or what steps I should take next?

Thank you in advance!

Best regards,

Vitor

Answer 1

Hello @Vitor Santos,

Based on your issue description, I understand that after adding few members of your IT team to use Global Secure Access, they are getting the errors on their devices stating that “Disabled by your organization.” In the Health Check section under Advanced Diagnostics, the error “Breakglass mode is enabled” appeared.

Break-glass mode disabled

Break-glass mode prevents the Global Secure Access client from tunneling network traffic to the Global Secure Access cloud service. In Break-glass mode, all traffic profiles in the Global Secure Access portal are unchecked and the Global Secure Access client isn't expected to tunnel any traffic.

To set the client to acquire traffic and tunnel that traffic to the Global Secure Access service:

1. Sign in to the Microsoft Entra admin center as a Global Secure Access Administrator.
2. Navigate to Global Secure Access > Connect > Traffic forwarding.
3. Enable at least one of the traffic profiles that match your organization's needs.

The Global Secure Access client should receive the updated forwarding profile within one hour after you make changes in the portal.

Reference document: Troubleshoot the Global Secure Access client: Health check - Global Secure Access

The Global Secure Access client - disabled by your organization error message appears when the Global Secure Access client is deliberately deactivated by your organization's administrator.

The warning message also appears when the client receives an empty policy (that is, no traffic forwarding profiles from Microsoft, Private Access, or Internet Access). The empty policy happens in the following cases:

• All traffic forwarding profiles are disabled in the portal.
• Some traffic forwarding profiles are enabled, but the user isn't assigned to any of them (in the User and group assignments section of each profile).
• The user didn't sign in to Windows with a Microsoft Entra user.
• Authentication to get the policy requires user interaction (such as if multifactor authentication (MFA) or terms of use (ToU) are enabled).

In cases 3 and 4, only traffic profiles that are assigned to the entire tenant (Assign to all users in the user and group assignment section is set to Yes) take effect. Traffic profiles assigned to specific users and groups aren't applied since the user identity isn't used to get the policy. In these cases, only the device identity is available to the policy service.

To view the Global Secure Access traffic profile configuration:

1. Sign in to the Microsoft Entra admin center as a Global Secure Access Administrator.
2. Navigate to Global Secure Access > Connect > Traffic forwarding.

Troubleshooting steps

1. View the available traffic forwarding profiles. At least one traffic forwarding profile must be enabled. Verify that the user is assigned to the enabled traffic forwarding profile. Users in your organization who sign in to Windows with a non-Microsoft Entra ID, such as local user or Active Directory Domain Services (AD DS) user not synced to Microsoft Entra, receive only the traffic forwarding profiles assigned to all users in the tenant.

2. Ensure that both the device and the user are successfully authenticated to Microsoft Entra and receive a valid token.

1. Check that the device is joined to Microsoft Entra and signed in to Windows with a Microsoft Entra user.
2. Run the command dsregcmd /status and check the AzureAdPrt field.
3. Check if a conditional access policy is blocking the user. Network blocks can arise from conditional access settings, an unmanaged or noncompliant device, or unfulfilled MFA or ToU policies. To confirm that the Global Secure Access Client authenticated successfully to the policy service, check the list of non-interactive user sign-ins.

Please refer to the below document to check few more troubleshooting steps to know whether every settings is properly configured.

Troubleshoot the Global Secure Access Client: Disabled by Your Organization - Global Secure Access

I hope this above information provided is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".