Replacing a VPN with Microsoft Entra Private Access only improves security if access is split into per-app policies, the connectors are hardened like the privileged servers they are, and the compliant network and tenant restriction controls are actually switched on. Global Secure Access is Microsoft's Security Service Edge offering, the umbrella for Microsoft Entra Private Access (zero trust network access to private apps) and Microsoft Entra Internet Access (an identity aware secure web gateway), managed in the Entra admin center. This guide covers how identity drives access in Private Access, Quick Access versus per-app access, private network connectors, the compliant network check and universal tenant restrictions, admin roles, traffic logging and a hardening baseline. It is written for identity and network engineers planning or running Global Secure Access. The vendor-neutral concepts are in the ZTNA Guide and are not repeated here.
This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.
Key takeaways
- Quick Access is a VPN-shaped starting point. It tunnels one primary set of FQDNs and IP ranges under one enterprise application; move sensitive resources into per-app Global Secure Access apps with their own Conditional Access policies.
- Every app is an enterprise application. Users and groups are assigned to it and Conditional Access policies target it, so Private Access inherits your MFA, device compliance and risk controls.
- Connectors are tier zero adjacent. The private network connector sits inside your network, makes outbound only connections on 443 (and 80 for revocation checks) and brokers every session, so harden, patch and monitor it.
- Compliant network blocks token replay. A Conditional Access policy that blocks access from anything other than All Compliant Network locations stops stolen refresh tokens being replayed from outside your Global Secure Access tenant.
- Universal tenant restrictions close the side door. Tenant restrictions v2, enforced by the client, stops users on managed devices signing in to foreign tenants to move data out.
How identity and access work in Global Secure Access
Global Secure Access forwards traffic from the Global Secure Access client (Windows, macOS, iOS and Android) or from a configured remote network to Microsoft's edge. Three traffic forwarding profiles decide what is captured: the Microsoft traffic profile (direct connectivity to Microsoft services), the Internet Access profile, and the Private Access profile. Private Access builds on Microsoft Entra application proxy and supports TCP and UDP applications, not only web apps.
For Private Access, both Quick Access and per-app access are implemented as enterprise applications that act as containers for private resources. A user reaches a resource only if they are assigned to the application that contains it and they satisfy the Conditional Access policies that target it. Identity therefore replaces the network location as the primary decision point, and every session is attributable to a named user and device.
| Aspect | Quick Access | Per-app access (Global Secure Access app) |
|---|---|---|
| Purpose | The primary group of FQDNs, IP addresses and ranges you always want tunnelled | A subset of private resources that needs its own controls |
| Number | One primary set | Many apps |
| Conditional Access | One set of policies for everything in Quick Access | Different policies per app, for example phishing resistant MFA or compliant device for admin interfaces |
| Assignment | Broad user population | Only the users or groups that need that resource |
| Typical use | Migration day one, broad internal ranges | Admin portals, finance systems, jump hosts, time-limited access |
Decision guidance: Microsoft's documentation frames the choice around which resources you always want tunnelled and which need separate or time-bound policies, rather than mandating a migration. In practice a Quick Access definition covering whole subnets reproduces the flat reach of a VPN. Small organisations can start with Quick Access for a short migration window; larger estates should inventory application usage from traffic logs and carve high-value systems into per-app apps early, leaving Quick Access as a shrinking catch-all. See the Secure Remote Access Beyond VPN Guide for the wider migration pattern.
Licensing: Private Access and Internet Access need users licensed for Microsoft Entra ID P1 or P2, and are sold standalone or within Microsoft Entra Suite. Internet Access for Microsoft services (which brings the compliant network check and universal tenant restrictions) is included with Entra ID P1 or P2. Remote networks need a combined total of at least 50 Entra ID P1 and Internet Access licences.
Admin roles and privileged access
| Role | What it controls | Guidance |
|---|---|---|
| Global Secure Access Administrator | Traffic profiles, Quick Access and per-app definitions, session management settings | PIM eligible; changes can expose internal networks |
| Application Administrator | Installing and registering private network connectors, enterprise app assignments | Credentials are needed during connector registration; use a just-in-time assignment |
| Conditional Access Administrator | Enabling signalling and building compliant network policies | Pair changes with report-only testing |
| Security Administrator | Enabling universal tenant restrictions (with Global Secure Access Administrator) and diagnostic settings | Restrict to the security team |
| Global Secure Access Log Reader / Reports Reader | Viewing traffic logs | Grant to SOC analysts instead of admin roles |
Anyone who can edit a Quick Access definition can widen network reach for every assigned user, so treat Global Secure Access configuration with the same change control as firewall rules. The Conditional Access Guide covers policy design, and the Break-Glass Account Guide covers the emergency accounts you must exclude.
Integrations, API tokens and service accounts
Private network connectors
- Platform: Windows Server 2016 or later, .NET Framework 4.7.2 or later, TLS 1.2 enabled before installation, connector version 1.5.3417.0 or later for Private Access.
- Network: outbound only, TCP 443 to the service (for example *.msappproxy.net and *.servicebus.windows.net) and TCP 80 for certificate revocation lists. No inbound ports are needed. Microsoft advises against TLS inspection or termination on connector to cloud traffic.
- Services: two Windows services run on each server, the connector and the connector updater, which applies updates automatically.
- Resilience: group connectors into connector groups per application set and run more than one server per group; for maintenance, move a connector to a dedicated maintenance group, drain, patch and return it.
- Co-location: do not install the connector on the same machine as Microsoft Entra Password Protection Proxy, because their updater versions conflict.
Because a connector can reach every resource its applications define, a compromised connector server is a pivot point into the internal network. Place connectors in a segment that can reach only the published applications, restrict local administrator rights, and apply the server baseline you use for other identity infrastructure. See the Microsoft Entra Connect and Cloud Sync Hardening Guide for comparable treatment of hybrid identity servers.
Clients and remote networks
The compliant network check and universal tenant restrictions only work where traffic actually reaches Global Secure Access, either through the client or a remote network. That makes client coverage a security control, not an operational detail.
- Managed laptops: deploy the Global Secure Access client through your device management tooling to every corporate Windows and macOS device, and report devices where the client is missing or not running.
- Mobile: on iOS and Android the Global Secure Access app is delivered as part of Microsoft Defender, so Defender resources need the exclusions Microsoft documents in compliant network policies.
- Branches: remote networks forward branch traffic without a client on each device, useful for fixed devices, but the per-user identity signal is weaker than with the client.
- Coexistence: Microsoft documents that the Private Access client can run side by side with an existing non-Microsoft SSE client, which allows a phased move of private app traffic without first ripping out internet filtering.
- Unmanaged devices: decide explicitly whether contractors on personal devices may use Private Access at all; if they can, scope them to per-app apps only, never to Quick Access.
Service accounts and workload identities
Conditional Access for users does not block service principal calls, as Microsoft's compliant network guidance notes. Scripts that run as user service accounts will fail or need exclusions once compliant network enforcement covers all resources. Move them to managed identities and use Conditional Access for workload identities rather than excluding service accounts from user policies. See the Workload Identity Federation Guide.
Logging and detection
Traffic logs record each connection by its five-tuple (source and destination IP and port, plus FQDN), the user principal name, device category (client or remote network), action (allowed or denied), transaction and connection IDs, bytes sent and received, and web category. Export them through Entra diagnostic settings using the NetworkAccessTrafficLogs category to a Log Analytics workspace, storage account or event hub; the portal does not state a retention period, so set retention at the destination. Global Secure Access also restores the original source IP into Entra sign-in logs, which keeps location based detections working once traffic flows through Microsoft's edge.
- Alert on: denied private connections in bulk from one user (scanning internal ranges), access to admin ports from users outside admin groups, connector health changing to inactive, and changes to Quick Access or traffic profiles.
- Correlate: sign-in failures caused by the compliant network policy with the user's risk level; repeated blocks for a valid user may mean a token has been stolen and is being replayed elsewhere.
| Metric | What it shows |
|---|---|
| Share of private resources in per-app apps rather than Quick Access | Progress away from VPN-style flat access |
| Users assigned to Quick Access versus users who used it in 30 days | Over-assignment |
| Connector groups with fewer than two healthy connectors | Resilience risk |
| Sign-ins blocked by the compliant network policy | Token replay attempts and client deployment gaps |
| Managed devices without a running client | Coverage of compliant network and tenant restrictions |
Hardening baseline
- Inventory first: list private apps, ports and the users who need them; use existing VPN logs as the starting point.
- Deploy connectors properly: at least two servers per connector group, segmented, patched, TLS 1.2, no TLS inspection in the path.
- Start narrow: publish Quick Access for a pilot group only, with Conditional Access requiring MFA and a compliant device, while the VPN stays available as rollback.
- Carve out per-app apps: move admin interfaces, jump hosts and sensitive line-of-business apps into their own apps with stricter policies and narrow assignments.
- Enable compliant network: turn on Conditional Access signalling under Global Secure Access settings, confirm the All Compliant Network locations named location exists, and build a policy for All resources that blocks any location except compliant networks, in report-only first. Exclude break-glass accounts and, where you enrol devices, the Intune enrolment apps.
- Enable universal tenant restrictions: define tenant restrictions v2 default and partner policies in cross-tenant access settings, tunnel Entra ID endpoints in the Microsoft traffic profile, then turn on Enable Tenant Restrictions for Microsoft Entra ID and Microsoft Graph. See the Entra ID Cross-Tenant Access and B2B Guest Governance Guide.
- Retire the VPN: once usage logs show no VPN-only resources, remove VPN access group by group; rollback is re-enabling the VPN profile for the affected group.
Common misconfigurations
- Quick Access as the end state: whole subnets in Quick Access recreate lateral movement paths the migration was meant to remove.
- Single connector per group: one server outage takes the application offline and pressures teams to bypass controls.
- TLS inspection on connector traffic: Microsoft advises against it and it breaks the trust path.
- Compliant network without CAE awareness: already signed-in sessions are not interrupted, and for applications without Continuous Access Evaluation a stolen access token stays valid for its lifetime, typically 60 to 90 minutes. See the Token and Session Security Guide.
- Expecting tenant restrictions to cover guests: tenant restrictions are not enforced for users accessing their own tenant, and guest users in your tenant are not subject to the policy.
- Assigning all users to Quick Access: copying the old VPN group into the Quick Access assignment keeps every joiner's reach as wide as the most privileged user's; assign by role and review assignments in the same cycle as other access reviews.
- Service accounts excluded from everything: exclusions added to keep scripts working become an unmonitored bypass.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | AC-17 | Remote access mediated by identity and policy |
| NIST SP 800-53 Rev. 5 | SC-7 | Boundary protection through connectors and per-app segmentation |
| NIST SP 800-53 Rev. 5 | AC-6 | Least privilege through narrow per-app assignment |
| NIST CSF 2.0 | PR.IR-01, PR.AA-05 | Protecting environments from unauthorised logical access; managed access permissions |
| MITRE ATT&CK | T1550.001 Application Access Token | Token replay that the compliant network check is designed to block |
Practitioner checklist
- Confirm licensing for Private Access users and Entra ID P1 or P2 for the compliant network check.
- Run at least two segmented, patched connectors per connector group with outbound only 443 and 80.
- Keep Quick Access small and move sensitive apps to per-app apps with their own Conditional Access.
- Make Global Secure Access Administrator and Application Administrator PIM eligible.
- Deploy the compliant network block policy for All resources in report-only, then enforce, excluding break-glass accounts.
- Enable universal tenant restrictions with a tenant restrictions v2 default deny policy.
- Export NetworkAccessTrafficLogs to your SIEM and alert on internal scanning and connector health.
- Replace service accounts in scripts with managed identities before enforcing network conditions.
Standards and references
- Microsoft Learn: What is Global Secure Access?
- Microsoft Learn: Learn about Microsoft Entra Private Access
- Microsoft Learn: Configure private network connectors
- Microsoft Learn: Enable compliant network check with Conditional Access
- Microsoft Learn: Universal tenant restrictions
- Microsoft Learn: Global Secure Access traffic logs
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: ZTNA Guide · Conditional Access Guide · Secure Remote Access Beyond VPN Guide · Entra ID Security Guide