disable globalprotect app option missing in 10.1.10

[PA_nts]

Hi Guys

think i am going mad...

anyways, panorama running 10.1.10-h2. i have some users connecting via gp but they are unable to disable the app.

my agent config in my Network\GlobalProtect\Portals\<portal-config>\Agent\<agent-config>\App does not show the option under app config to 'allow user to disable globalprotect' it appears to be missing.

it does show on the right hand side (see image)  but this is not configured.. by default, this setting 'max times a user can disable'  is set to 0, this means that the users have no limit to the number of times that they can disable the app

my connection method is set to 'On-Demand'

this is primarily for our macos user base.. not checked yet for windows apps but suspect they will have the same issues

edit: could it be that the disable option only works if connection method is set to user-logon(always on)?

any ideas?

thanks in adv

[BPry · Accepted solution]

@PA_nts,

Your edit is correct, you shouldn't expect to see disable when you're in On-Demand mode. If a user wants to disconnect they would simply hit disconnect, there's no reason for the disable option to be present.