Security service edge (SSE) used to be something only large enterprises bought: a cloud proxy for web filtering, a zero trust replacement for VPN, and a lot of integration work. Global Secure Access is Microsoft’s SSE, built into Microsoft Entra, and it changes the math for smaller businesses because it uses the identities, devices and Conditional Access policies you already have. This article explains what it includes, what it costs, and where it makes sense for a 20 to 500 person organization.
What Global Secure Access is
Global Secure Access is the umbrella name for two Microsoft Entra products and the shared platform underneath them:
Microsoft Entra Internet Access secures access to the internet and SaaS apps, with web content filtering, threat intelligence filtering, TLS inspection and network data loss prevention.
Microsoft Entra Private Access gives users access to internal apps and file shares without a traditional VPN, using connectors installed in your network.
Users run the Global Secure Access client on Windows, macOS, iOS or Android. The client captures selected traffic and sends it through Microsoft’s network, where identity-aware policies are applied. Branch offices can also connect through remote network connectivity instead of a client on every device.
How traffic forwarding profiles work
You decide what traffic Global Secure Access handles using traffic forwarding profiles, configured under Global Secure Access > Connect > Traffic forwarding. There are three you control:
Profile
What it covers
License needed
Microsoft traffic
Exchange Online, SharePoint Online, Teams and other Microsoft 365 services
Microsoft Entra ID P1 or P2
Private Access
Internal apps, file shares and servers you publish
Entra ID P1/P2 plus Microsoft Entra Private Access or Microsoft Entra Suite
Internet Access
Public internet and third-party SaaS apps
Entra ID P1/P2 plus Microsoft Entra Internet Access or Microsoft Entra Suite
Traffic is evaluated against the Microsoft profile first, then Private Access, then Internet Access. Microsoft 365 traffic is only ever handled by the Microsoft traffic profile, so for full internet coverage you enable the Microsoft and Internet Access profiles together.
What you get with just Entra ID P1
This is the part most SMBs overlook. If you have Microsoft 365 Business Premium or E3, you already have Entra ID P1, which unlocks the Microsoft traffic profile. That gives you several useful controls with no extra license:
Universal tenant restrictions. Stop users signing in to other organizations’ Microsoft 365 tenants from your managed devices, a common data exfiltration path.
Compliant network check. A Conditional Access condition that requires Microsoft 365 access to come through Global Secure Access, which helps against stolen tokens being replayed from elsewhere.
Source IP restoration. Keeps the user’s original public IP visible to Entra ID and Microsoft 365 so location-based Conditional Access and sign-in logs stay accurate.
Enriched Microsoft 365 logs and traffic logs for visibility.
Universal continuous access evaluation for the network connection itself.
For a business that worries about staff copying data to personal or partner tenants, universal tenant restrictions alone justify testing the Microsoft traffic profile.
Where Private Access fits: replacing the VPN
Many SMBs still run a firewall VPN so remote staff can reach a file server, an accounting package or an on-premises line-of-business app. Those VPNs tend to grant broad network access, and they are a frequent target for attackers.
Private Access changes the model. Instead of putting the user on the network, it publishes specific apps or IP and port combinations. Users get to the accounting server on its required ports and nothing else. Every connection goes through Conditional Access, so you can require MFA, a compliant device or a phishing-resistant method per app.
Two common ways to start:
Quick Access publishes a broad set of internal ranges, which is the fastest path to retiring the VPN.
Per-app access publishes each application separately, which is better for least privilege once you know what users actually need. App Discovery helps you find that out.
Where Internet Access fits
Internet Access is the secure web gateway side: blocking categories of websites, filtering by domain, using threat intelligence to block known malicious destinations, and inspecting TLS traffic where you choose to. Because policies link to Conditional Access, you can apply different web rules to different groups, such as a stricter profile for front-desk kiosks.
If you already run Microsoft Defender for Endpoint, its web protection and network protection features cover some of the same ground at the device level. For many SMBs, the decision is less about having web filtering at all and more about whether you want identity-aware filtering managed in the same place as Conditional Access.
Questions to answer before you commit
Global Secure Access is not right for every business on day one. Before buying add-on licenses, I ask clients to answer a few questions honestly:
What does your VPN actually protect? List the internal apps and file shares people reach through it. If the answer is “one file server we plan to move to SharePoint”, fix that first.
Are your devices managed? The client needs to be deployed and kept updated. Without Intune or another management tool, rollout gets painful fast.
How do you filter the web today? If a firewall subscription or Defender for Endpoint already covers it well, Internet Access may be a later phase.
Who supports it? A new traffic path means new troubleshooting. Decide who owns client issues before users start calling.
Clear answers usually point to a phased approach: Microsoft traffic profile now, Private Access when the VPN renewal comes up, Internet Access when the current web filter contract ends.
A practical rollout plan for SMBs
Activate Global Secure Access in the Microsoft Entra admin center under Global Secure Access > Get started.
Enable the Microsoft traffic profile and assign it to a pilot group of users.
Deploy the client to pilot devices using Intune. Windows devices should be Entra joined or hybrid joined.
Turn on universal tenant restrictions and test that users can still reach partner tenants they legitimately need through cross-tenant access settings.
Evaluate Private Access for one internal app currently reached by VPN. Install a private network connector on a server that can reach it.
Decide on Internet Access based on what your current web filtering does and costs.
Microsoft’s What is Global Secure Access page has the current feature-by-license table, which is worth checking because the product is evolving quickly. If you want help with the pilot, our managed security team can run it alongside your existing setup, and our Intune deployment service covers rolling out the client. To compare what different license bundles add, our E5 vs E3 calculator is a good starting point.
Frequently asked questions
Do I need Microsoft Entra Suite to use Global Secure Access?
No. The Microsoft traffic profile only needs Microsoft Entra ID P1 or P2. Private Access and Internet Access each need their own license, or Microsoft Entra Suite, which includes both.
Can Global Secure Access replace our firewall?
Not entirely. It can replace remote access VPN for many apps and provide cloud web filtering, but you still need a firewall at the office edge for local network protection and any traffic that does not go through the client.
Does the client work on Macs and phones?
Yes. Microsoft provides Global Secure Access clients for Windows, macOS, iOS and Android, and you can deploy them through Intune.
Wondering whether Global Secure Access could replace your VPN or tighten Microsoft 365 access? Book a free Microsoft 365 security assessment and we will map what your current licenses already include.
Security service edge (SSE) used to be something only large enterprises bought: a cloud proxy for web filtering, a zero trust replacement for VPN, and a lot of integration work. Global Secure Access is Microsoft’s SSE, built into Microsoft Entra, and it changes the math for smaller businesses because it uses the identities, devices and Conditional Access policies you already have. This article explains what it includes, what it costs, and where it makes sense for a 20 to 500 person organization.
What Global Secure Access is
Global Secure Access is the umbrella name for two Microsoft Entra products and the shared platform underneath them:
Users run the Global Secure Access client on Windows, macOS, iOS or Android. The client captures selected traffic and sends it through Microsoft’s network, where identity-aware policies are applied. Branch offices can also connect through remote network connectivity instead of a client on every device.
How traffic forwarding profiles work
You decide what traffic Global Secure Access handles using traffic forwarding profiles, configured under
Global Secure Access > Connect > Traffic forwarding. There are three you control:Traffic is evaluated against the Microsoft profile first, then Private Access, then Internet Access. Microsoft 365 traffic is only ever handled by the Microsoft traffic profile, so for full internet coverage you enable the Microsoft and Internet Access profiles together.
What you get with just Entra ID P1
This is the part most SMBs overlook. If you have Microsoft 365 Business Premium or E3, you already have Entra ID P1, which unlocks the Microsoft traffic profile. That gives you several useful controls with no extra license:
For a business that worries about staff copying data to personal or partner tenants, universal tenant restrictions alone justify testing the Microsoft traffic profile.
Where Private Access fits: replacing the VPN
Many SMBs still run a firewall VPN so remote staff can reach a file server, an accounting package or an on-premises line-of-business app. Those VPNs tend to grant broad network access, and they are a frequent target for attackers.
Private Access changes the model. Instead of putting the user on the network, it publishes specific apps or IP and port combinations. Users get to the accounting server on its required ports and nothing else. Every connection goes through Conditional Access, so you can require MFA, a compliant device or a phishing-resistant method per app.
Two common ways to start:
Where Internet Access fits
Internet Access is the secure web gateway side: blocking categories of websites, filtering by domain, using threat intelligence to block known malicious destinations, and inspecting TLS traffic where you choose to. Because policies link to Conditional Access, you can apply different web rules to different groups, such as a stricter profile for front-desk kiosks.
If you already run Microsoft Defender for Endpoint, its web protection and network protection features cover some of the same ground at the device level. For many SMBs, the decision is less about having web filtering at all and more about whether you want identity-aware filtering managed in the same place as Conditional Access.
Questions to answer before you commit
Global Secure Access is not right for every business on day one. Before buying add-on licenses, I ask clients to answer a few questions honestly:
Clear answers usually point to a phased approach: Microsoft traffic profile now, Private Access when the VPN renewal comes up, Internet Access when the current web filter contract ends.
A practical rollout plan for SMBs
Global Secure Access > Get started.Microsoft’s What is Global Secure Access page has the current feature-by-license table, which is worth checking because the product is evolving quickly. If you want help with the pilot, our managed security team can run it alongside your existing setup, and our Intune deployment service covers rolling out the client. To compare what different license bundles add, our E5 vs E3 calculator is a good starting point.
Frequently asked questions
Do I need Microsoft Entra Suite to use Global Secure Access?
No. The Microsoft traffic profile only needs Microsoft Entra ID P1 or P2. Private Access and Internet Access each need their own license, or Microsoft Entra Suite, which includes both.
Can Global Secure Access replace our firewall?
Not entirely. It can replace remote access VPN for many apps and provide cloud web filtering, but you still need a firewall at the office edge for local network protection and any traffic that does not go through the client.
Does the client work on Macs and phones?
Yes. Microsoft provides Global Secure Access clients for Windows, macOS, iOS and Android, and you can deploy them through Intune.
Wondering whether Global Secure Access could replace your VPN or tighten Microsoft 365 access? Book a free Microsoft 365 security assessment and we will map what your current licenses already include.