Free tools Windows power users keep installed
One-click scans. No signup required.
Plan two separate recovery mechanisms: make the normal branch path resilient with redundant Microsoft Global Secure Access (GSA) remote-network tunnels, deliberate routing and health monitoring; then prepare an administrator-controlled emergency procedure for Microsoft 365 resources protected by GSA’s compliant-network Conditional Access condition.
Decide in advance whether an outage should preserve the security boundary by blocking traffic or preserve productivity through an approved, secured direct-internet path. Microsoft 365 still requires internet connectivity, so resilient design also depends on local egress, current endpoint data and rehearsed recovery procedures.
As an Amazon Associate I earn from qualifying purchases.
Start with the failure you are trying to survive
A Microsoft 365 outage and a secure-access outage are different events. Microsoft 365 is a distributed cloud service reached through internet-connected service front doors; a failed GSA control plane, gateway, backend, tunnel, branch router, DNS resolver, identity dependency or ISP can prevent users from reaching it even when Microsoft’s service is operating normally.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchSeparate a control-plane incident from a forwarding incident. A tenant-management problem may leave existing tunnels passing traffic, while a gateway or backend failure can leave an IPsec security association established but unable to forward packets. A branch circuit or CPE failure is local to one site; a regional edge or upstream-peering problem can affect many sites at once. Each condition needs different evidence and a different fallback.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Microsoft’s network principles describe why local internet access matters: centralized WAN hairpins, VPN concentrators, proxies and unnecessary inspection can add latency or send a connection to a more distant Microsoft front door. Read the full guidance at Microsoft 365 network connectivity principles.
Build an inventory before choosing a fallback. Record, for each branch and user group:
- Which Microsoft 365 workloads use the GSA path, including Exchange Online, SharePoint, OneDrive, Teams and browser-based administration.
- Which private applications, networks and DNS zones depend on the same tunnels.
- Which Conditional Access policies contain the Global Secure Access compliant-network condition, and which users, groups and applications those policies target.
- Which components can fail independently: GSA control plane, GSA gateway or backend, IPsec tunnel, customer-premises equipment (CPE), branch ISP, DNS resolver, identity provider and the Microsoft 365 service itself.
- Which telemetry shows each failure, who can authorize a change, which administrator account can execute it and how users will be notified.
- Which traffic is business-critical, which can wait, and which destinations must never use an emergency direct path.
This dependency map prevents a generic “internet outage” response from being applied to a policy failure or a single tunnel failure. It also prevents an organization from claiming that Microsoft 365 is unavailable when only its chosen access path has failed.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use two recovery mechanisms, not one
A resilient plan separates infrastructure failover from policy recovery:
- Normal-path resilience: redundant GSA remote-network connections, controlled route selection and a health signal that can identify a failed path.
- Emergency access: a privileged, temporary procedure for users who cannot satisfy a compliant-network requirement while GSA is unavailable.
These mechanisms solve different problems. Redundant tunnels can keep traffic inside the intended security path, but they do not make a Conditional Access policy succeed when the tenant cannot see a compliant GSA network. Conversely, putting a policy into report-only mode may restore access while leaving the branch’s routing problem untouched. Assign separate owners and approval paths for network failover and identity-policy changes.
Build redundant Global Secure Access remote networks
Use independent tunnels and failure domains
Microsoft’s remote-network resilience guidance recommends multiple IPsec tunnels from the CPE to different GSA edges or points of presence. Zone redundancy places two tunnels in different availability zones within one Azure region. Geographic redundancy uses a second remote network in another region, protecting against a regional failure or loss of reachability to one location. See Enhance Remote Network Resilience with Global Secure Access (updated September 3, 2025).
Independence matters more than tunnel count. Two tunnels that share one router, ISP circuit, power feed or upstream peering path can fail together. Document the physical and logical dependencies of each tunnel, including public addresses, authentication material, region, zone, carrier and maintenance windows. If a second region is used, verify that DNS, identity and application routes remain usable from that region rather than assuming geographic separation solves every dependency.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Control route selection
Use CPE tunnel weights to prefer one path while retaining a ready alternative. Where the design supports it, use BGP to learn and withdraw routes dynamically. Static routes can also work when you set deliberate metrics and define exactly which prefixes use each tunnel. Record the expected route table for healthy, degraded and failed states; an unplanned metric can create asymmetric paths, black holes or a routing loop.
Test route convergence with real Microsoft 365 transactions, not just a ping. Check sign-in, Exchange, SharePoint file access and a Teams call while withdrawing each tunnel in turn. Confirm that return traffic follows a compatible path and that stateful firewalls do not discard sessions during a switchover. Document whether existing sessions survive or must be re-established so service-desk messaging is accurate.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Add an application-level health signal
Link failover to a health check that tests the GSA remote-network service rather than only checking whether an IPsec security association is established. Microsoft documents an IP SLA Layer 7 probe endpoint:
http://m365.remote-network.edgediagnostic.globalsecureaccess.microsoft.com:6544/ping
The documented alternative probe address is 198.18.1.101. These values are specific to GSA remote-network connectivity; verify the current Microsoft configuration instructions and your CPE’s probe behavior before deployment. A tunnel can remain “up” while the gateway or backend that forwards traffic is unhealthy, so a simple tunnel-state check is insufficient.
Define probe intervals, failure thresholds, recovery thresholds and alert recipients. A probe that fails once during a transient packet loss should not flap every branch route; a probe that waits too long can expose users to a prolonged outage. Keep probe results with tunnel, route and sign-in logs so operators can correlate a path change with user impact.
Choose the outage posture before the outage
Microsoft describes two route policies. The choice is a risk decision for your organization, not a universal best practice.
| Decision axis | Security-first design | Productivity-first design |
|---|---|---|
| Route when a GSA gateway or backend fails | Do not configure a default route. Statically route required traffic over the GSA IPsec tunnel. | Configure a default route so traffic can use direct internet egress when the GSA path fails. |
| Likely user impact | Traffic may stop when GSA is unavailable, preserving the intended boundary. | Internet access may continue, subject to the controls on the direct path. |
| Additional preparation | Redundant GSA paths and a tested emergency procedure for protected resources. | Redundant GSA paths, a Layer 7 health probe, secured direct egress and explicit authorization. |
| Microsoft-documented mechanism | Static routes over the GSA IPsec tunnel. | Default route plus an IP SLA Layer 7 probe. |
| Governing question | Is bypassing the secure-access path unacceptable? | Is temporary access worth an approved change in path and security posture? |
A direct fallback changes where traffic is inspected and which controls are enforced. Before enabling it, document who can authorize the change, which branches and destinations qualify, how endpoint protection and cloud controls continue to apply, what logging is required and how the normal route will be restored. Decide whether users may reach all internet destinations or only Microsoft 365 prefixes, and whether private applications remain blocked. Do not assume direct egress works for every application or Conditional Access policy.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Security-first does not mean “no continuity.” It requires a clear user-impact message, a tested break-glass process for protected resources and a way to prove that traffic really remains on the GSA path. Productivity-first does not mean “turn off security.” It requires secured DNS, endpoint protection, firewall policy, monitoring and a time limit for the exception. The risk owner should approve the posture, not leave it to an engineer changing a route during an incident.
Prepare emergency access for compliant-network policies
Understand the specific restriction
Microsoft’s Global Secure Access deployment guide states that users cannot access resources secured by the GSA compliant-network check while GSA is down. This restriction is separate from ordinary internet reachability: a user may have a functioning ISP connection and still fail the policy condition. Identify affected applications in advance, including administrative portals that responders may need during the outage.
Use the documented break-glass sequence
Microsoft documents a temporary operation named GsaBreakglassEnforcement. It changes enabled Conditional Access policies that use the compliant-network condition to report-only mode, allowing access without the GSA signal. After service is restored, run GsaBreakglassRecovery to return the affected policies to enforcement.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Microsoft’s sample-script guidance describes related actions that disable traffic-forwarding profiles and move applicable policies into Report-Only mode. Treat the scripts as privileged production changes:
- Review the current script source and confirm that the tenant’s policy names, state and conditions match its scope.
- Use an emergency-access administrator account that is not subject to the same compliant-network policy. Protect that account with the organization’s emergency-account controls and keep its credentials available through an independent channel.
- Run the procedure only after the incident authority records the outage, approval, intended duration and affected population.
- Verify that the expected users and applications can connect, and monitor sign-ins, policy results and anomalous activity while the exception is active.
- When GSA is healthy, run
GsaBreakglassRecovery, confirm that forwarding profiles are restored and verify policy status in the tenant. - Capture audit evidence, including the approver, operator, timestamps, changed policy identifiers, script version and restoration test.
The sample requires the Microsoft Graph Beta PowerShell module version 2.10 or newer and PowerShell 5.1 x64 or later. Validate those prerequisites in a nonproduction tenant, confirm permissions, and keep a tested copy of the procedure available through an independent administrative channel. Do not discover during an outage that the only administrator who can run it is blocked by the policy being changed.
Report-only mode is not a universal Conditional Access bypass. The documented operation concerns policies using the compliant-network condition; device-compliance, multifactor, location, risk and other controls may still apply. Review the tenant’s actual policy dependencies before promising access. Limit the exception to the shortest practical interval and communicate when normal enforcement is restored.
Keep Microsoft 365 on a reliable internet path
Prefer local egress and DNS
Microsoft’s published principle is explicit: “Regardless of how you manage vital Microsoft 365 network traffic, Microsoft 365 requires Internet connectivity.” Use a local, well-connected internet breakout where practical, with local DNS resolution. Ask ISPs about proximity and peering with the Microsoft Global Network rather than assuming the cheapest or geographically nearest circuit is the best path.
A centralized security stack can be appropriate for some traffic, but forcing every Microsoft 365 connection through a distant data center can increase round-trip time and cause a farther service front door to be selected. Measure the real path from each major region. Compare normal GSA forwarding, secondary-region forwarding and direct egress; record latency, packet loss, DNS response and observed front-door location.
Apply endpoint-specific inspection decisions
Microsoft advises differentiating Microsoft 365 endpoint categories and, where appropriate, bypassing TLS decryption, traffic interception, deep packet inspection and similar intermediation for those endpoints. This is not a blanket instruction to bypass security for all internet traffic. Security, networking and compliance owners should approve exceptions for the relevant Microsoft 365 categories, preserve logging where possible and document compensating controls.
Use Microsoft’s endpoint service instead of a manually frozen list. The authoritative management guidance is at Managing Microsoft 365 endpoints. Ensure the same endpoint categories and inspection decisions exist on both the GSA path and the emergency direct path; otherwise failover can create an unexpected block or an unintended inspection gap.
Assess the design before buying or changing equipment
Measure the path to Microsoft front doors
Run Microsoft’s Microsoft 365 connectivity assessment from representative offices and user locations. Check egress location, DNS behavior and the path to the nearest service front door. Repeat the measurements through the primary GSA route, the secondary tunnel and the proposed direct-egress route. Save baseline results so a later incident can be compared with normal performance.
Test real-time workloads separately
Teams voice and video need end-to-end assessment rather than a generic web test. Use the Teams Network Assessment Tool where appropriate, and include packet loss, latency, jitter and failover behavior in the test record. A path that loads Outlook Web quickly may still produce unacceptable media quality. Test calls with representative branch sizes and concurrent traffic, not only an idle lab connection.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Plan for multi-region routing
Microsoft notes that a multi-region enterprise may need SD-WAN or other optimized routing infrastructure. That is an architectural consideration, not an automatic purchase recommendation. Confirm that any CPE or SD-WAN platform supports the required IPsec, BGP or static-route behavior, health probes, logging and GSA interoperability; no particular hardware model is established by Microsoft’s guidance. Validate licensing, support escalation and configuration portability before standardizing a platform.
Do not treat ExpressRoute as a routine fallback
ExpressRoute for Microsoft 365 is not a general-purpose outage workaround. Microsoft says authorization is required and is granted only when a regulatory requirement mandates direct connectivity. A desire for another resilient path, by itself, does not meet that condition. Treat any regulatory case as a separate architecture and authorization project rather than an emergency purchase.
Keep endpoint data and changes current
Microsoft 365 endpoint data changes over time. The endpoint-management guidance says updates are usually published near the end of each month and recommends checking the service version regularly. Some additions include an effective date; operational or security changes may not follow the usual advance notice. A monthly calendar reminder alone is insufficient if a security change is published outside the normal cadence.
Assign an owner for endpoint updates and connect that work to change management:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches- Check the Microsoft 365 IP Address and URL Web Service on a scheduled basis and record the service version reviewed.
- Compare new versions with firewall, proxy, DNS, TLS-inspection and routing rules on both normal and fallback paths.
- Classify endpoints by required handling instead of applying one rule to every Microsoft 365 URL.
- Test changes from each major region and record rollback actions.
- Notify the incident team when endpoint changes could affect the direct-egress or GSA-failover path.
Stale endpoint data can make an apparently healthy fallback fail because a firewall blocks a newly added service dependency. Keep ownership clear when network, security and Microsoft 365 administration are separate teams.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Write and rehearse the incident runbook
Exercise the following scenarios independently, recording expected user impact, decision authority, telemetry and recovery evidence:
- One GSA tunnel or edge fails while the branch ISP and CPE remain healthy.
- The local ISP, CPE or DNS resolver fails.
- GSA is unavailable while compliant-network Conditional Access policies remain enforced.
- The organization authorizes direct internet egress.
- GSA returns and normal routing and Conditional Access enforcement must be restored.
For each exercise, verify that operators can distinguish a route failure from an identity or policy failure, see which tunnel is carrying traffic, identify users affected by the compliant-network condition, and prove that the emergency exception was removed. Include service-desk scripts for communicating whether users should retry, switch networks or wait. Capture route tables, probe alerts, sign-in logs, policy audit records and screenshots or command output that demonstrate restoration.
Set a recovery-time objective from business requirements; Microsoft’s cited guidance does not publish one that applies universally. Also set a maximum approved duration for direct egress or report-only policies, a review point if the outage continues and a named person responsible for closing the exception. After every exercise or incident, update dependencies, thresholds and contact details.
Practical decision checklist
- Have you mapped every branch, user group, application and Conditional Access policy that depends on GSA?
- Do tunnels terminate in independent zones, regions or upstream paths?
- Are route metrics, BGP behavior or static prefixes documented for each failure state?
- Does the health probe test the forwarding service, not only tunnel establishment?
- Has the security-versus-productivity route policy been approved by the risk owner?
- Is direct egress protected, monitored and limited to an explicit scope?
- Can an exempt emergency administrator run and audit the break-glass procedure?
- Are Graph PowerShell and PowerShell prerequisites installed and tested?
- Are Microsoft 365 endpoint updates assigned to an owner and included in change review?
- Have you tested restoration, including re-enabling compliant-network policies?
Make the trade-off explicit
The durable design is not simply “add another VPN.” Keep the ordinary path resilient with independent GSA tunnels, route control and service-level health monitoring. Separately, maintain a controlled emergency procedure for compliant-network restrictions. Then choose, document and rehearse whether a GSA failure should stop traffic at the security boundary or permit a temporary direct path under approved controls. That explicit decision, combined with current Microsoft 365 endpoint data and tested restoration, is what turns an outage from an improvised exception into an executable continuity plan.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Frequently Asked Questions
What happens to Microsoft 365 if Global Secure Access goes down?
Users may lose access even when Microsoft 365 itself is healthy. Traffic can stop at the GSA route, and applications protected by the compliant-network Conditional Access condition can remain blocked despite a working ISP connection. The outcome depends on your tunnel, route and policy design.
Should a branch use a default route during a GSA failure?
Only if the organization has approved a productivity-first posture. A default route can permit direct internet egress when a GSA gateway or backend fails, but it changes the traffic path and security controls. Pair it with the documented Layer 7 health probe, secured direct egress, monitoring and a restoration procedure.
Do two IPsec tunnels guarantee resilience?
No. Tunnels that share a CPE, ISP, power feed, region or upstream path can fail together. Use independent zones or regions where appropriate, document shared dependencies and test each failure domain.
Recommended Free Tools
How can users access resources protected by the GSA compliant-network condition during an outage?
An authorized administrator can use Microsoft’s GsaBreakglassEnforcement procedure to move affected compliant-network Conditional Access policies to Report-Only mode temporarily. After recovery, run GsaBreakglassRecovery and verify that enforcement and traffic-forwarding profiles are restored. Other Conditional Access controls may still block access.
What tools are needed for the break-glass scripts?
Microsoft’s sample-script guidance requires the Microsoft Graph Beta PowerShell module version 2.10 or newer and PowerShell 5.1 x64 or later. Test the scripts in a controlled tenant and use an emergency administrator account that is not subject to the same compliant-network policy.
How often should Microsoft 365 endpoint rules be reviewed?
Check the Microsoft 365 IP Address and URL Web Service regularly. Updates are usually published near the end of each month, but some operational or security changes may not follow the usual advance notice. Route the review through change management for both normal and fallback paths.
Is ExpressRoute a standard backup for Microsoft 365?
No. Microsoft requires authorization for ExpressRoute for Microsoft 365 and authorizes it only when a regulatory requirement mandates direct connectivity. It is not a routine response to a GSA outage.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The Bottom Line
Resilience requires both a redundant GSA forwarding path and a controlled way to handle compliant-network policy failures. Approve the security-versus-productivity route choice, maintain current Microsoft 365 endpoint data, and rehearse failover and restoration before users need them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
