Global Secure Access in Microsoft Entra Suite can replace the classic VPN

In many of the tenants I work with, traditional VPNs feel more and more dated, and that impression has only grown since the Microsoft Entra Suite and Global Secure Access (GSA) became generally available this week. The Microsoft Entra Suite bundles Entra Private Access, Entra Internet Access, Entra ID Governance, Entra ID Protection and Entra Verified ID. For most organizations, though, the most interesting part is the Security Service Edge piece, Global Secure Access, which handles remote and web access with modern, identity-based controls.

Global Secure Access moves enforcement from the network to the app layer

Global Secure Access combines Entra Internet Access and Entra Private Access and is Microsoft's own take on Security Service Edge. The difference from a classic VPN or proxy setup is that access is enforced through Conditional Access at the app layer, while the GSA client on the user's device builds the secure connection through Microsoft's cloud stack. I've piloted Private Access in several environments over the past few months, and the basic idea is pleasantly simple. You deploy a connector (a lightweight VM or container in your network) that links internal apps to the cloud. The GSA client on the endpoint picks up traffic for the selected apps and routes it through GSA. Entra ID takes care of authentication and authorization, with Conditional Access policies as fine-grained as you need them.

For Internet Access, GSA sits between the endpoint and web resources as a cloud proxy. That gives you identity-based policy, web content filtering and DLP, all managed in one place. One thing I find especially useful is the Microsoft traffic profile, which comes prebuilt for all key Microsoft 365 cloud services such as Exchange Online, SharePoint Online and Teams. Microsoft's docs cover the basics well (overview).

Small pilots work best for getting started

Most organizations I see start Global Secure Access with a pilot, and I'd strongly recommend doing the same. Everything is configured in the Microsoft Entra admin center → Global Secure Access. For Private Access, choose one internal app that you understand well and that currently depends on VPN. Deploy a GSA connector on-premises, define the app as a private resource, and roll out the GSA client to just a handful of test endpoints (with Intune or a similar tool).

The mermaid diagram below shows the typical flow when a user opens a private app:

flowchart TD
    UserClient["GSA client"] --> TrafficForward["Traffic forwarding"]
    TrafficForward --> GSACloud["Global Secure Access cloud"]
    GSACloud --> ConditionalAccess["Conditional Access evaluation"]
    ConditionalAccess --> GSAPrivateConnector["GSA connector (on-prem)"]
    GSAPrivateConnector --> PrivateApp["Private app"]

Figure: How users reach internal apps through Entra Private Access.

The setup is modular. You can onboard apps at whatever pace suits you and build granular policy with the Conditional Access framework you already know. IT teams tend to see quickly that expensive, complex VPN setups can be phased out for good.

Entra Internet Access controls web traffic with filtering and traffic profiles

Private Access secures connectivity to applications, and Entra Internet Access gives you control over all web traffic. Once you enable the Microsoft traffic profile, all Microsoft 365 traffic is routed through the GSA cloud, which lets you enforce Conditional Access for cloud apps (for example requiring modern auth or restricting regions). You can add web content filtering on top and manage DLP boundaries for uploads and downloads in detail (details on web filtering logic).

My practical tip: Begin with the Microsoft traffic profile and a pilot of one private app. That keeps complexity down and quickly gives you real experience with the integration and the controls.

Traffic forwarding is controlled per device through profiles, and Microsoft's documentation has a useful summary (traffic forwarding profiles). Keep in mind that only endpoints with the GSA client installed and the correct profile are protected by GSA.

Entra Suite licensing depends on which features you need

With Microsoft Entra Suite, each feature is available through specific licensing. Full Global Secure Access (Private + Internet Access) is included in Entra Suite Plan 1 and Plan 2. If you only need certain parts, there are options. Entra Internet Access for Microsoft 365, for example, can be added to existing Entra ID P1/P2 plans. Licensing can get complicated, particularly in international rollouts, because availability and add-ons may vary by region.

In practice, I always suggest checking the tenant's current licensing first and then starting with a contained pilot group. Most of the early problems I see in projects come from unclear scoping, meaning who, which devices and which apps the new policies actually target.

I see access management moving from VPNs to Conditional Access first

After several Entra Suite and Global Secure Access deployments, I'm convinced that access management is moving away from hardware VPNs and network rules toward policy built around identities and apps. For most businesses that means better security, simpler operations and a lot more flexibility. The technology isn't the hard part. Planning, communication and aligning business processes with the new model are, and IT teams are increasingly in a position to lead that work. If you start piloting now and move your first workloads to GSA, you can retire legacy VPNs and also bring web and application access policy together in one place. That is the kind of modernization organizations need at the moment.