Global Secure Access Client Partially Connected (Entra Not Connected)

Question

Hello,

I'm hoping someone can give me a little advice on how to troubleshoot the following:

Context

• I have the Global Secure Access (GSA) Client installed across Mac and Windows devices.
• All 3 Traffic Forwarding profiles are enabled, private, internet and Microsoft
• Both Mac and Windows devices are assigned to all three profiles
• Devices are all managed via Intune and all are enrolled into Entra
• There are no CA policies applying
• The GSA client is pushed to Macs via Intune / Company Portal
  • Allow System Extensions and Transparent application proxy policies are also pushed out to Macs via Intune

Issue

When the GSA Client is installed on a Mac, the client connects to GSA and the globe with a smaller circle with a tick is shown.

After some time, or a restart of the client, the GSA client reconnects but shows the triangle with an exclamation mark. Partially connected, due to the Entra channel / tunnel not succeeded:

This doesn't affect internet or private connectivity. However, I think it may cause issues when I look to implement Conditional Access policies.

In the GSA Client logs, I see errors like this:

[2026-02-23 09:27:28.654][Error][79091][3305012][XplatCommon][NAAS_BL]:Connecting to cloud failed (GRPC connection not established) -  "destinationIP":"be2320dc-accb-49b0-9448-4459a0db4cb5.auth.client.globalsecureaccess.microsoft.com"  "destinationPort":"443"  "userNetworkProfileId":"46150960-9197-52b0-9749-6cbc6dd88c87"  "channelName":"Entra"  "channelState":"GRPC_CHANNEL_TRANSIENT_FAILURE" 
[2026-02-23 09:27:28.656][Error][79091][3305012][XplatCommon][NAAS_BL]:Connection to Global Secure Access edge failed (GRPC connection could not be established). Channel Name: Entra Destination IP/Port: be2320dc-accb-49b0-9448-4459a0db4cb5.auth.client.globalsecureaccess.microsoft.com/443, Is Secure: 1, Channel State: GRPC_CHANNEL_TRANSIENT_FAILURE - 
[2026-02-23 09:27:28.656][Error][79091][3305012][PacketTunnelProviderModule][FailedToConnectToEdgeMsg]:Connection to Global Secure Access edge failed (GRPC connection could not be established). Channel Name: Entra Destination IP/Port: be2320dc-accb-49b0-9448-4459a0db4cb5.auth.client.globalsecureaccess.microsoft.com/443, Is Secure: 1, Channel State: GRPC_CHANNEL_TRANSIENT_FAILURE

I can't find any Microsoft documentation which explains how to troubleshoot this issues.

Can anyone help?

Thanks