Fix false "Private Access is not enabled" error when tenant has multiple forwarding profiles

Migrate2GSA/Migrate2GSA.psd1

@@ -12,7 +12,7 @@
 RootModule = 'Migrate2GSA.psm1'
 
 # Version number of this module.
-ModuleVersion = '2026.6.18.1'
+ModuleVersion = '2026.8.13.1'
 
 # Supported PSEditions
 CompatiblePSEditions = 'Core'

Migrate2GSA/functions/GSA/Export-EntraInternetAccessConfig.ps1

@@ -144,15 +144,21 @@ function Export-EntraInternetAccessConfig {
     Write-LogMessage "Global Secure Access tenant status validated: $($tenantStatus.onboardingStatus)" -Level SUCCESS -Component "Validation"
 
     # Validate Internet Access feature is enabled
+    # A tenant can have multiple Internet Access forwarding profiles; the feature counts as
+    # enabled when at least one of them is enabled.
     Write-LogMessage "Validating Internet Access feature is enabled..." -Level INFO -Component "Validation"
-    $iaProfile = Get-IntNetworkAccessForwardingProfile -ProfileType 'internet'
+    $iaProfiles = @(Get-IntNetworkAccessForwardingProfile -ProfileType 'internet')
     $graphApiCalls++
-    if (-not $iaProfile -or $iaProfile.state -ne 'enabled') {
-        $currentState = if ($iaProfile) { $iaProfile.state } else { 'not found' }
+    $enabledIaProfiles = @($iaProfiles | Where-Object { $_.state -eq 'enabled' })
+    if ($enabledIaProfiles.Count -eq 0) {
+        $currentState = if ($iaProfiles.Count -gt 0) {
+            ($iaProfiles | ForEach-Object { "$($_.name): $($_.state)" }) -join '; '
+        }
+        else { 'not found' }
         Write-LogMessage "Internet Access is not enabled on this tenant. Current state: $currentState" -Level ERROR -Component "Validation"
         throw "Internet Access feature validation failed. Please enable Internet Access before exporting."
     }
-    Write-LogMessage "Internet Access feature validated: enabled" -Level SUCCESS -Component "Validation"
+    Write-LogMessage "Internet Access feature validated: enabled ($($enabledIaProfiles.Count) of $($iaProfiles.Count) forwarding profile(s) enabled)" -Level SUCCESS -Component "Validation"
     #endregion
 
     #region Export Web Content Filtering Policies

Migrate2GSA/functions/GSA/Export-EntraPrivateAccessAppDiscovery.ps1

@@ -164,14 +164,20 @@ function Export-EntraPrivateAccessAppDiscovery {
     Write-LogMessage "Global Secure Access tenant status validated: $($tenantStatus.onboardingStatus)" -Level SUCCESS -Component "Validation"
 
     # Validate Private Access feature is enabled
+    # A tenant can have multiple Private Access forwarding profiles; the feature counts as
+    # enabled when at least one of them is enabled.
     Write-LogMessage "Validating Private Access feature is enabled..." -Level INFO -Component "Validation"
-    $paProfile = Get-IntNetworkAccessForwardingProfile -ProfileType 'private'
-    if (-not $paProfile -or $paProfile.state -ne 'enabled') {
-        $currentState = if ($paProfile) { $paProfile.state } else { 'not found' }
+    $paProfiles = @(Get-IntNetworkAccessForwardingProfile -ProfileType 'private')
+    $enabledPaProfiles = @($paProfiles | Where-Object { $_.state -eq 'enabled' })
+    if ($enabledPaProfiles.Count -eq 0) {
+        $currentState = if ($paProfiles.Count -gt 0) {
+            ($paProfiles | ForEach-Object { "$($_.name): $($_.state)" }) -join '; '
+        }
+        else { 'not found' }
         Write-LogMessage "Private Access is not enabled on this tenant. Current state: $currentState" -Level ERROR -Component "Validation"
         throw "Private Access feature validation failed. Please enable Private Access before exporting."
     }
-    Write-LogMessage "Private Access feature validated: enabled" -Level SUCCESS -Component "Validation"
+    Write-LogMessage "Private Access feature validated: enabled ($($enabledPaProfiles.Count) of $($paProfiles.Count) forwarding profile(s) enabled)" -Level SUCCESS -Component "Validation"
     #endregion
 
     #region Compute Date Range

Migrate2GSA/functions/GSA/Export-EntraPrivateAccessConfig.ps1

@@ -115,15 +115,21 @@ function Export-EntraPrivateAccessConfig {
     Write-LogMessage "Global Secure Access tenant status validated: $($tenantStatus.onboardingStatus)" -Level SUCCESS -Component "Validation"
 
     # Validate Private Access feature is enabled
+    # A tenant can have multiple Private Access forwarding profiles; the feature counts as
+    # enabled when at least one of them is enabled.
     Write-LogMessage "Validating Private Access feature is enabled..." -Level INFO -Component "Validation"
-    $paProfile = Get-IntNetworkAccessForwardingProfile -ProfileType 'private'
+    $paProfiles = @(Get-IntNetworkAccessForwardingProfile -ProfileType 'private')
     $graphApiCalls++
-    if (-not $paProfile -or $paProfile.state -ne 'enabled') {
-        $currentState = if ($paProfile) { $paProfile.state } else { 'not found' }
+    $enabledPaProfiles = @($paProfiles | Where-Object { $_.state -eq 'enabled' })
+    if ($enabledPaProfiles.Count -eq 0) {
+        $currentState = if ($paProfiles.Count -gt 0) {
+            ($paProfiles | ForEach-Object { "$($_.name): $($_.state)" }) -join '; '
+        }
+        else { 'not found' }
         Write-LogMessage "Private Access is not enabled on this tenant. Current state: $currentState" -Level ERROR -Component "Validation"
         throw "Private Access feature validation failed. Please enable Private Access before exporting."
     }
-    Write-LogMessage "Private Access feature validated: enabled" -Level SUCCESS -Component "Validation"
+    Write-LogMessage "Private Access feature validated: enabled ($($enabledPaProfiles.Count) of $($paProfiles.Count) forwarding profile(s) enabled)" -Level SUCCESS -Component "Validation"
 
     # Check connector groups availability and build cache
     Write-LogMessage "Checking connector groups availability..." -Level INFO -Component "Validation"

Migrate2GSA/internal/functions/Get-IntNetworkAccessForwardingProfile.ps1

@@ -14,14 +14,16 @@ function Get-IntNetworkAccessForwardingProfile {
 
     .OUTPUTS
         Returns the forwarding profile object(s) matching the specified criteria.
+        A tenant can have more than one profile per traffic forwarding type, so callers
+        must wrap the result in @() and evaluate every returned profile.
 
     .EXAMPLE
         Get-IntNetworkAccessForwardingProfile
         Retrieves all forwarding profiles.
 
     .EXAMPLE
         Get-IntNetworkAccessForwardingProfile -ProfileType 'private'
-        Retrieves the Private Access forwarding profile.
+        Retrieves the Private Access forwarding profile(s).
     #>
     [CmdletBinding()]
     param (