diff --git a/Migrate2GSA/Migrate2GSA.psd1 b/Migrate2GSA/Migrate2GSA.psd1
index 2809766..a519d41 100644
--- a/Migrate2GSA/Migrate2GSA.psd1
+++ b/Migrate2GSA/Migrate2GSA.psd1
@@ -12,7 +12,7 @@
 RootModule = 'Migrate2GSA.psm1'
 
 # Version number of this module.
-ModuleVersion = '2026.6.18.1'
+ModuleVersion = '2026.8.13.1'
 
 # Supported PSEditions
 CompatiblePSEditions = 'Core'
diff --git a/Migrate2GSA/functions/GSA/Export-EntraInternetAccessConfig.ps1 b/Migrate2GSA/functions/GSA/Export-EntraInternetAccessConfig.ps1
index c2620f3..3a511a0 100644
--- a/Migrate2GSA/functions/GSA/Export-EntraInternetAccessConfig.ps1
+++ b/Migrate2GSA/functions/GSA/Export-EntraInternetAccessConfig.ps1
@@ -144,15 +144,21 @@ function Export-EntraInternetAccessConfig {
     Write-LogMessage "Global Secure Access tenant status validated: $($tenantStatus.onboardingStatus)" -Level SUCCESS -Component "Validation"
 
     # Validate Internet Access feature is enabled
+    # A tenant can have multiple Internet Access forwarding profiles; the feature counts as
+    # enabled when at least one of them is enabled.
     Write-LogMessage "Validating Internet Access feature is enabled..." -Level INFO -Component "Validation"
-    $iaProfile = Get-IntNetworkAccessForwardingProfile -ProfileType 'internet'
+    $iaProfiles = @(Get-IntNetworkAccessForwardingProfile -ProfileType 'internet')
     $graphApiCalls++
-    if (-not $iaProfile -or $iaProfile.state -ne 'enabled') {
-        $currentState = if ($iaProfile) { $iaProfile.state } else { 'not found' }
+    $enabledIaProfiles = @($iaProfiles | Where-Object { $_.state -eq 'enabled' })
+    if ($enabledIaProfiles.Count -eq 0) {
+        $currentState = if ($iaProfiles.Count -gt 0) {
+            ($iaProfiles | ForEach-Object { "$($_.name): $($_.state)" }) -join '; '
+        }
+        else { 'not found' }
         Write-LogMessage "Internet Access is not enabled on this tenant. Current state: $currentState" -Level ERROR -Component "Validation"
         throw "Internet Access feature validation failed. Please enable Internet Access before exporting."
     }
-    Write-LogMessage "Internet Access feature validated: enabled" -Level SUCCESS -Component "Validation"
+    Write-LogMessage "Internet Access feature validated: enabled ($($enabledIaProfiles.Count) of $($iaProfiles.Count) forwarding profile(s) enabled)" -Level SUCCESS -Component "Validation"
     #endregion
 
     #region Export Web Content Filtering Policies
diff --git a/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessAppDiscovery.ps1 b/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessAppDiscovery.ps1
index 230771b..efaf2c9 100644
--- a/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessAppDiscovery.ps1
+++ b/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessAppDiscovery.ps1
@@ -164,14 +164,20 @@ function Export-EntraPrivateAccessAppDiscovery {
     Write-LogMessage "Global Secure Access tenant status validated: $($tenantStatus.onboardingStatus)" -Level SUCCESS -Component "Validation"
 
     # Validate Private Access feature is enabled
+    # A tenant can have multiple Private Access forwarding profiles; the feature counts as
+    # enabled when at least one of them is enabled.
     Write-LogMessage "Validating Private Access feature is enabled..." -Level INFO -Component "Validation"
-    $paProfile = Get-IntNetworkAccessForwardingProfile -ProfileType 'private'
-    if (-not $paProfile -or $paProfile.state -ne 'enabled') {
-        $currentState = if ($paProfile) { $paProfile.state } else { 'not found' }
+    $paProfiles = @(Get-IntNetworkAccessForwardingProfile -ProfileType 'private')
+    $enabledPaProfiles = @($paProfiles | Where-Object { $_.state -eq 'enabled' })
+    if ($enabledPaProfiles.Count -eq 0) {
+        $currentState = if ($paProfiles.Count -gt 0) {
+            ($paProfiles | ForEach-Object { "$($_.name): $($_.state)" }) -join '; '
+        }
+        else { 'not found' }
         Write-LogMessage "Private Access is not enabled on this tenant. Current state: $currentState" -Level ERROR -Component "Validation"
         throw "Private Access feature validation failed. Please enable Private Access before exporting."
     }
-    Write-LogMessage "Private Access feature validated: enabled" -Level SUCCESS -Component "Validation"
+    Write-LogMessage "Private Access feature validated: enabled ($($enabledPaProfiles.Count) of $($paProfiles.Count) forwarding profile(s) enabled)" -Level SUCCESS -Component "Validation"
     #endregion
 
     #region Compute Date Range
diff --git a/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessConfig.ps1 b/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessConfig.ps1
index 324bbe9..dd5c23c 100644
--- a/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessConfig.ps1
+++ b/Migrate2GSA/functions/GSA/Export-EntraPrivateAccessConfig.ps1
@@ -115,15 +115,21 @@ function Export-EntraPrivateAccessConfig {
     Write-LogMessage "Global Secure Access tenant status validated: $($tenantStatus.onboardingStatus)" -Level SUCCESS -Component "Validation"
 
     # Validate Private Access feature is enabled
+    # A tenant can have multiple Private Access forwarding profiles; the feature counts as
+    # enabled when at least one of them is enabled.
     Write-LogMessage "Validating Private Access feature is enabled..." -Level INFO -Component "Validation"
-    $paProfile = Get-IntNetworkAccessForwardingProfile -ProfileType 'private'
+    $paProfiles = @(Get-IntNetworkAccessForwardingProfile -ProfileType 'private')
     $graphApiCalls++
-    if (-not $paProfile -or $paProfile.state -ne 'enabled') {
-        $currentState = if ($paProfile) { $paProfile.state } else { 'not found' }
+    $enabledPaProfiles = @($paProfiles | Where-Object { $_.state -eq 'enabled' })
+    if ($enabledPaProfiles.Count -eq 0) {
+        $currentState = if ($paProfiles.Count -gt 0) {
+            ($paProfiles | ForEach-Object { "$($_.name): $($_.state)" }) -join '; '
+        }
+        else { 'not found' }
         Write-LogMessage "Private Access is not enabled on this tenant. Current state: $currentState" -Level ERROR -Component "Validation"
         throw "Private Access feature validation failed. Please enable Private Access before exporting."
     }
-    Write-LogMessage "Private Access feature validated: enabled" -Level SUCCESS -Component "Validation"
+    Write-LogMessage "Private Access feature validated: enabled ($($enabledPaProfiles.Count) of $($paProfiles.Count) forwarding profile(s) enabled)" -Level SUCCESS -Component "Validation"
 
     # Check connector groups availability and build cache
     Write-LogMessage "Checking connector groups availability..." -Level INFO -Component "Validation"
diff --git a/Migrate2GSA/internal/functions/Get-IntNetworkAccessForwardingProfile.ps1 b/Migrate2GSA/internal/functions/Get-IntNetworkAccessForwardingProfile.ps1
index a46dba5..89a1de6 100644
--- a/Migrate2GSA/internal/functions/Get-IntNetworkAccessForwardingProfile.ps1
+++ b/Migrate2GSA/internal/functions/Get-IntNetworkAccessForwardingProfile.ps1
@@ -14,6 +14,8 @@ function Get-IntNetworkAccessForwardingProfile {
 
     .OUTPUTS
         Returns the forwarding profile object(s) matching the specified criteria.
+        A tenant can have more than one profile per traffic forwarding type, so callers
+        must wrap the result in @() and evaluate every returned profile.
 
     .EXAMPLE
         Get-IntNetworkAccessForwardingProfile
@@ -21,7 +23,7 @@ function Get-IntNetworkAccessForwardingProfile {
 
     .EXAMPLE
         Get-IntNetworkAccessForwardingProfile -ProfileType 'private'
-        Retrieves the Private Access forwarding profile.
+        Retrieves the Private Access forwarding profile(s).
     #>
     [CmdletBinding()]
     param (