Issues with Microsoft Entra Private Access POC: Breakglass and Magic IP

Question

I'm currently doing a Proof of Concept (POC) of Microsoft Entra Private Access, but I'm having issues with it.

I'm doing this 100% on Azure. I have 3 VMs on a different VNet each. (Client - Proxy - App)

I have the private connector working, along with the app and application segment, but when I download the Global Secure Access client on a Windows 11 VM, I encounter two problems:

• Breakglass enabled
• Magic IP Received

Can someone explain why this happens?

Answer 1

Hello @Gerardo Barboza,

Thank you for posting your query on Microsoft Q&A.

It seems you're experiencing issues with Microsoft Entra Private Access, specifically seeing "Breakglass enabled" and "Magic IP Received" errors when using the Global Secure Access client on a Windows 11 VM.

If Break-glass mode is enabled, the client is not expected to tunnel any traffic.

Based on the screenshot you shared, I see you've enabled the Private Access profile, which should allow the client to capture traffic and send it to the Global Secure Access service. If you made this change to the Private Access profile in the portal within the last hour, I recommend waiting an hour to ensure the updated forwarding profile is received by the clients.

Have you checked if the forwarding profile registry key is correctly configured on the device?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Global Secure Access Client Since you've already enabled the forwarding profile, it's possible that the client is having trouble connecting to the GSA backend service. I suggest you also examine the GSA client boot-trace ETL for more details.

Start the Connection Diagnostics

Click on Global Secure Access tray icon:

• Right click the tray Icon and press the Connection Diagnosis menu item.
• On the Summary tab, check when the policy was last updated and verify the policy version.

Magic IP received for FQDN

This check verifies that the client is able to acquire traffic by FQDN. As the test fails:

1. Restart the client and test again.

Please follow the troubleshooting checklist to review the logs:

Global Secure Access Client Windows Troubleshooting Checklist

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know. Thanks,
Raja Pothuraju.