> For the complete documentation index, see [llms.txt](https://docs.realmjoin.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.realmjoin.com/automation/runbooks/runbook-references/org/applications/add-gsa-application-registration.md).

# Add Gsa Application Registration

Create a Global Secure Access application with its access group

### Description

Creates a Global Secure Access (GSA) application in Entra ID with its application segment (destination, ports, protocol) and connector group, plus a security group that controls who may use it. If the application already exists, only the segment, group and assignment are updated. Everything is validated before anything is created, and objects created in a failed run are removed again.

### Location

Organization → Applications → Add GSA Application Registration

**Full Runbook name**

rjgit-org\_applications\_add-GSA-application-registration

### Details

| Property         | Value                                                                                    |
| ---------------- | ---------------------------------------------------------------------------------------- |
| Version          | 1.3.3                                                                                    |
| Required modules | <p>RealmJoin.RunbookHelper (>= 0.8.10)<br>Microsoft.Graph.Authentication (>= 2.41.2)</p> |
| Schedulable      | no                                                                                       |

### Permissions

#### Application permissions

* **Type**: Microsoft Graph
  * Application.ReadWrite.All
    * *Instantiates the app from the application template, patches onPremisesPublishing and adds app segments*
  * Directory.ReadWrite.All
    * *Required by the App Proxy endpoints: reads connector groups and assigns the app's connectorGroup*
  * Group.ReadWrite.All
    * *Creates the access security group for the app and deletes it on rollback*
  * AppRoleAssignment.ReadWrite.All
    * *Assigns the access group to the app via /servicePrincipals/{id}/appRoleAssignedTo*

### Parameters

#### name

Base name of the application. The final name is prefix plus name, for example GSA-MyApp.

| Property            | Value            |
| ------------------- | ---------------- |
| Required            | true             |
| Default Value       |                  |
| Type                | String           |
| Portal display name | Application name |

#### prefix

Text put in front of the name. A space is inserted unless the prefix ends with a hyphen, underscore or space.

| Property            | Value                   |
| ------------------- | ----------------------- |
| Required            | true                    |
| Default Value       |                         |
| Type                | String                  |
| Portal display name | Application name prefix |

#### groupPrefix

Text put in front of the access group name, independent of the application prefix. Usually preset in the runbook customization.

| Property            | Value               |
| ------------------- | ------------------- |
| Required            | false               |
| Default Value       | App - Entra - GSA - |
| Type                | String              |
| Portal display name | Group name prefix   |

#### groupSuffix

Text appended to the access group name, for example " (users)". Leave empty for none.

| Property         | Value                                  |
| ---------------- | -------------------------------------- |
| Required         | false                                  |
| Default Value    |                                        |
| Type             | String                                 |
| Hidden in portal | yes (preset via runbook customization) |

#### applicationType

Enterprise App creates a new GSA application. Quick Access App adds the segment to the tenant's existing Quick Access app instead.

| Property            | Value            |
| ------------------- | ---------------- |
| Required            | true             |
| Default Value       |                  |
| Type                | String           |
| Portal display name | Application type |

**Portal options**

| Portal option    | Value          |
| ---------------- | -------------- |
| Enterprise App   | nonwebapp      |
| Quick Access App | quickaccessapp |

#### connectorGroup

Connector group that publishes the application. The available groups are set up in the runbook customization.

| Property            | Value           |
| ------------------- | --------------- |
| Required            | false           |
| Default Value       |                 |
| Type                | String          |
| Portal display name | Connector group |

#### destinationHost

Where the application lives: a host name (example.com), a single IP (192.168.0.1), a CIDR range (192.168.0.1/24) or an IP range (192.168.0.1..192.168.0.20).

| Property            | Value                     |
| ------------------- | ------------------------- |
| Required            | false                     |
| Default Value       |                           |
| Type                | String                    |
| Portal display name | Destination host or range |

#### destinationType

Kind of destination, derived automatically from the format of the destination host.

| Property         | Value                                  |
| ---------------- | -------------------------------------- |
| Required         | false                                  |
| Default Value    |                                        |
| Type             | String                                 |
| Hidden in portal | yes (preset via runbook customization) |

#### ports

Ports to publish: a single port (443), several (80,443) or a range (8000-8080).

| Property            | Value  |
| ------------------- | ------ |
| Required            | false  |
| Default Value       |        |
| Type                | String |
| Portal display name | Ports  |

#### protocol

TCP, UDP or both.

| Property            | Value    |
| ------------------- | -------- |
| Required            | false    |
| Default Value       |          |
| Type                | String   |
| Portal display name | Protocol |

**Portal options**

| Portal option | Value   |
| ------------- | ------- |
| TCP           | tcp     |
| UDP           | udp     |
| TCP,UDP       | tcp,udp |

[Back to Runbook Reference overview](/automation/runbooks/runbook-references.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.realmjoin.com/automation/runbooks/runbook-references/org/applications/add-gsa-application-registration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.