Share via

Can't add new "application segment" to Global Secure Access Enterprise Application

Trey Contello 20 Reputation points
2026-03-31T02:18:51.34+00:00

I recently created a new Enterprise Application for an internal website. Normal process, done it lots of times before. However, the new enterprise application never showed up under Global Secure Access \ Applications \ Enterprise Applications. However, the private access rule did show up on clients.

I found the app located in Entra (Identity) under "Enterprise Apps". However, when I click on this Enterprise App, there was no "Network access properties" link for me to edit/make changes like I would normally see.

I decided to clean it up and deleted the Enterprise App. It deleted. I purged it under "App Registrations", "Deleted applications". Assumed it was gone along with the private access rules.

However, that is not the case. I can no longer find it anywhere, but the Private Access rule is still deploying to clients. When I try to create a new application segment, it errors with "Application segment host and port already exists on application." Then it lists the conflicting application ID. This application ID DOES NOT EXIST.

I'm at a loss as to how to proceed. There should be no conflict, but somehow some remnant of the deleted enterprise app is hanging around somewhere and needs to be removed.

Microsoft Security | Microsoft Entra | Microsoft Entra Private Access
Answer accepted by question author
  1. Shubham Sharma 12,525 Reputation points Microsoft External Staff Moderator
    2026-04-01T12:19:47.66+00:00

    Trey Contello

    Thank you for reaching out to Microsoft Q&A.

    Global Secure Access (GSA) Enterprise Applications and their application segments are NOT fully governed by Entra ID Enterprise App deletion.

    Key points confirmed by Microsoft:

    • Application segments are enforced inside the Global Secure Access service, not only in Entra ID.
    • Deleting or purging:
      • Entra Enterprise Application
      • App Registration
      • Deleted applications does NOT immediately remove Global Secure Access application segments.
    • GSA enforces strict non-overlap:
      • Same FQDN/IP + port + protocol cannot exist in more than one application segment.
    • If a segment still exists in GSA (even orphaned), you get

    Application segment host and port already exists on application

    Why “Network access properties” was missing

    If an Enterprise App is created or partially created outside the GSA workflow, or the GSA backend fails mid-provisioning, the app can appear in:

    • Entra → Enterprise Applications

    but not in:

    • Global Secure Access → Applications → Enterprise applications

    Such apps do not expose “Network access properties**”**, because that blade only appears for GSA-managed Enterprise Apps, not standard Entra Enterprise Apps.

    Below are the resolution:-

    Option 1: Remove the orphaned segment using Entra PowerShell

    Microsoft provides Entra PowerShell (Beta) cmdlets specifically for managing Private Access application segments, including orphaned ones.

    What this allows you to do:

    • Enumerate all Private Access application segments
    • Identify the segment using the conflicting ApplicationId
    • Delete it directly from the GSA backend

    For your reference: https://microsoft.github.io/GlobalSecureAccess/Entra%20Private%20Access/powershell/

    Option 2: Natural backend cleanup

    GSA policies and segments are eventually garbage-collected, even when the Enterprise App no longer exists.

    Option 3: Verify via Global Secure Access only

    Enterprise apps and their segments must be managed ONLY from:

    Global Secure Access → Applications → Enterprise applications

    Deleting apps from:

    • Entra → Enterprise Applications
    • App registrations does not guarantee GSA cleanup.

    For your reference: https://dori-uw-1.kuma-moon.com/en-us/entra/global-secure-access/how-to-configure-per-app-access

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Q&A Assist
    2026-03-31T02:19:03.88+00:00
    AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

    The behavior indicates that an Enterprise application object with that application segment still exists in Global Secure Access, even if the corresponding Entra ID app was deleted or purged. The Global Secure Access service enforces these rules based on its own Enterprise application configuration, not only on the Entra ID app registration list.

    From the documented behavior:

    • Application segments are defined on Global Secure Access Enterprise applications and must not overlap: if two or more application segments include the same destination, port, and protocol, they are considered overlapping and are blocked from being created.
    • The service enforces that no overlapping FQDNs, IPs, or IP ranges exist within or between any Private Access apps (except for the special Quick Access overlap case). If a segment already exists on any Enterprise app, attempts to create the same destination/port/protocol on another app fail with the conflict error.
    • Enterprise apps and their segments are managed only under Global Secure Access > Applications > Enterprise applications. Deleting or purging an app registration under App registrations or Identity > Enterprise applications does not remove Global Secure Access application segments by itself.

    To clear the conflict and regain the ability to create the segment:

    1. In the Microsoft Entra admin center, go to Global Secure Access > Applications > Enterprise applications and carefully review all listed Global Secure Access Enterprise apps.
    2. For each app, open Network access properties and review the configured application segments. Look for any segment that matches the exact destination, port, and protocol that is causing the conflict.
    3. When the conflicting segment is found, either:
      • Remove that application segment from the existing Enterprise app, or
      • Change its destination/port/protocol so it no longer overlaps.
    4. Allow up to ~15 minutes for configuration changes to synchronize to Global Secure Access clients.
    5. After the conflict segment is removed or changed, create the new Enterprise application or add the new application segment again with the desired destination/port/protocol.

    If the conflicting application ID shown in the error truly does not appear under Global Secure Access > Applications > Enterprise applications, and no Enterprise app in that blade contains the overlapping segment, then the configuration is out of sync and requires support intervention. In that case, open a support ticket for Global Secure Access so the backend Enterprise application and its segments can be removed from the service.

    As a preventive measure once the environment is clean:

    • Always create and manage per-app access only through Global Secure Access > Applications > Enterprise applications, including deletions of apps and segments.
    • Avoid overlapping segments between Enterprise apps; if Quick Access is in use, follow the documented best practice to remove Enterprise-app destinations from Quick Access and split IP ranges so that overlaps are avoided.

    References:

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.