Global Secure Access

What it is

Global Secure Access is Microsoft's Security Service Edge, or SSE, solution. It secures network access for users wherever they are, using identity based policies instead of a traditional VPN. It has two parts: Microsoft Entra Private Access, which connects users to private apps and resources, and Microsoft Entra Internet Access, which secures access to the internet and to Microsoft 365.

It is managed in the Microsoft Entra admin center and works with Conditional Access, so network access follows the same Zero Trust rules as sign in.

How it works

The client and traffic forwarding

A Global Secure Access client is installed on the user's device, for Windows, macOS, iOS and Android. It sends chosen network traffic to the service. What traffic is sent is controlled by traffic forwarding profiles.

Each profile can be turned on or off, and assigned to users and groups. In the admin center, the client is downloaded under Connect > Client download.

Microsoft Entra Private Access

Private Access replaces a VPN for reaching private resources.

• Connectors. A lightweight private network connector is installed on a server in the network that hosts the resources, such as on premises or an Azure virtual network. It makes only outbound connections, so no inbound firewall rules are needed. Connectors are managed under Connect > Connectors and are grouped into connector groups.
• Quick Access. A broad setup that publishes IP ranges, subnets and fully qualified domain names, so users reach many private resources with no per app configuration.
• Per app access. An enterprise application for a particular private app, which can carry its own Conditional Access policy, such as MFA only for the finance app.
• Private DNS. A private DNS suffix lets remote users resolve internal host names.

Microsoft Entra Internet Access

Internet Access protects users browsing the web and using SaaS.

• Web content filtering blocks or allows sites by category or by fully qualified domain name. Policies are created under Secure > Web content filtering policies and grouped in a security profile.
• A security profile can be linked to Conditional Access, so the filtering applies to the right users.
• It supports threat protection features and universal tenant restrictions.

Conditional Access and compliant network

A compliant network check lets Conditional Access allow access only when the user's traffic comes through Global Secure Access, so a stolen token used from another network is rejected. It is useful for SharePoint and other Microsoft 365 apps.

Monitoring

The Monitor section holds Traffic logs, which show each connection, such as who connected, to where and whether it was allowed or blocked. To review a user's blocked requests, use Monitor > Traffic logs.

Licensing

Private Access and Internet Access are licensed separately, or together in the Microsoft Entra Suite, and they need Microsoft Entra ID P1.

A worked scenario

A company retires its VPN. It installs the Global Secure Access client on staff laptops, deploys two connectors in a connector group inside the data centre, and publishes the finance application as a per app access enterprise application, so it can demand phishing resistant MFA. Everything else internal uses Quick Access. A private DNS suffix lets remote staff resolve internal host names. For internet use, an Internet Access policy blocks gambling and malware categories. Conditional Access requires a compliant network for SharePoint, and Traffic logs show the helpdesk what was blocked when users call.