Your users are complaining about the correct thing. That extra click is a design failure masquerading as a security feature.
Appgate's client defaults to the "manual start" model. It loads on boot but doesn't establish the tunnel until you click "Connect". This breaks automation and user workflows. The argument is it prevents unwanted network exposure if the machine is compromised at the login screen. In reality, if an attacker has that level of access, your SDP is already irrelevant.
You can fix it. Set the client to auto-start the tunnel. On Linux, you'll be editing the systemd unit or init script. On Windows, it's a registry key. Here's the Ansible to push the Windows registry change, because managing this manually is how you get drift.
```yaml
- name: Configure Appgate client for auto-start
win_regedit:
path: HKLM:SOFTWAREWOW6432NodeAppGateClient
name: AutoStart
data: 1
type: dword
state: present
```
Now your users get a working network on login. The trade-off? A marginally smaller attack surface during the few seconds between OS login and client launch. If that's your biggest threat, you have bigger problems.
Don't panic, have a rollback plan.