Unable to add users to traffic forwarding profiles in GSA in MS Entra

Hello New Var,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well. 

I got that you're asking why the "User and group assignments" option in Microsoft Entra Global Secure Access (GSA) traffic forwarding profiles is showing as "temporarily unavailable", even though you have the Entra Suite license.
We will recommend you to clarify few points as: Do you have the required administrative roles?(please confirm your account has both the Global Secure Access Administrator role and the Application Administrator role assigned in Microsoft Entra ID)

Is the Global Secure Access service activated? (Have you completed the initial onboarding/activation step under Global Secure Access > Overview (or Get started) to enable all core security settings in the tenant?)

What is the status of the profiles? (Are all three profiles (Microsoft 365, Private Access, Internet Access) currently enabled/set to On in the Traffic Forwarding settings?)

we will recommend you to try below solutions:

So, the "temporarily unavailable" message is most often caused by the administrator missing a required role, or the core GSA service not being fully activated in the tenant.

Verify Administrative Roles

• The account performing the assignment must hold both the Global Secure Access Administrator and the Application Administrator roles. Many users only have the GSA role, but the Application Administrator role is often required for the underlying service principal setup.
• Go to Microsoft Entra admin center > Identity > Roles & admins > Roles, and verify your account has both roles. more at: https://free.blessedness.top/en-us/entra/global-secure-access/how-to-manage-users-groups-assignment https://free.blessedness.top/en-us/entra/identity/role-based-access-control/permissions-reference

Ensure GSA Service is Fully Activated:

• Even if you have the license, the entire GSA service often requires a one-time activation/onboarding step to fully initialize the required backend service principals.
• Navigate to Global Secure Access > Overview (or Get started). Ensure all necessary setup steps have been acknowledged or completed to fully activate the security service edge (SSE) features.
• also Ensure the GSA client version is 1.7.376.0 or higher. Older versions won’t support user assignment. more at: https://free.blessedness.top/en-us/entra/global-secure-access/troubleshoot-global-secure-access-client-disabled

Enable the Traffic Profiles and Re-check:

• Once the roles are confirmed and the service is activated, you must explicitly enable the profiles. If a profile is disabled, it will prevent user assignment.
• Go to Global Secure Access > Connect > Traffic forwarding, for all three profiles (Microsoft 365, Internet Access, Private Access), ensure the switch is set to On.
• After confirming roles and profile enablement, try to assign users again: Click View under "User and group assignments" on the desired profile -> Select Add user/group for better understanding and steps: https://free.blessedness.top/en-us/entra/global-secure-access/how-to-manage-users-groups-assignment

Enable the Traffic Profile First

• If the profile is disabled, the assignment UI will show “temporarily unavailable.” You must enable the profile before assigning users. more at: https://free.blessedness.top/en-us/entra/global-secure-access/how-to-manage-microsoft-profile

Kindly let us know if the above helps or you need further assistance on this issue. 

Please "Accept the answer" if the information helped you and 'upvote' for it. This will help us and others in the community as well. 

Regards,

Monalisha