Unexpected Private Access rule after rebuilding Global Secure Access v2

Your healthy connector and working TCP sessions do not explain why a broader acquisition rule is delivered to the client. Microsoft documents custom Private Access profiles as separate rule sets, with the highest-priority applicable profile selected . Compare the client’s Advanced diagnostics > Overview profile ID with your custom profile, then check that profile’s priority, assignments, Quick Access inclusion, and application selections. In Forwarding profile, use Policy tester against the unexpected destination and capture the matching rule ID. Export advanced logs; ForwardingProfile.json preserves the delivered policy, and the Traffic tab records rule and correlation identifiers. Those details distinguish an unexpected server-delivered rule from a different applicable profile. Public documentation does not identify your unresolved GUIDs or establish that migration created them. I would not delete system-profile links experimentally. Submit the configuration IDs, timestamps, delivered policy, and Graph results privately to Microsoft Support for inspection and supported cleanup.