Part of it is already in your Entra ID P1 licence, including the control that stops data leaving to a personal account.
Global Secure Access covers Internet Access and Private Access, both licensed through the Entra Suite. Internet Access for Microsoft services is different: Microsoft states it is included in Entra ID P1 or P2, and it carries Universal Tenant Restrictions, compliant network check and source IP restoration.
- P1 includedInternet Access for Microsoft services
- 190+ edgesAcross 70 regions on Microsoft network
- No VPNPer-app access to private resources
- 50 licencesMinimum for remote network connectivity
Three products, three licensing positions, and one of them you probably hold.
Microsoft sets these out separately, and conflating them is why organisations either overestimate what they must buy or miss what they already own.
- Internet Access for Microsoft services is included in Entra ID P1 or P2. That covers the Microsoft traffic forwarding profile, direct Microsoft services connectivity, the compliant network check, Universal Tenant Restrictions, source IP restoration and Microsoft 365 enriched logs. If you hold P1, that set is available to you now.
- Microsoft Entra Internet Access, the full secure web gateway, comes through the Entra Suite licence or standalone. This is where web category and domain filtering, TLS inspection, threat intelligence, data loss prevention, shadow AI discovery and context-aware network security live.
- Microsoft Entra Private Access, the zero trust network access product, also comes through the Entra Suite or standalone. This is VPN replacement, Quick Access, per-app TCP and UDP access, application discovery, private name resolution and single sign-on across private applications.
- One further constraint worth knowing before planning branch connectivity: Microsoft states you must have a combined total of at least fifty licences from Entra ID P1 and Entra Internet Access to enable remote network connectivity. Below that threshold the branch scenario is unavailable regardless of design.
Eight capabilities, split across three licensing positions.
Part of it comes with Entra ID P1, and most people do not know
Microsoft states that Internet Access for Microsoft services capabilities are included in an Entra ID P1 or P2 licence. That tier carries direct Microsoft services connectivity, the compliant network check, Universal Tenant Restrictions, source IP restoration and Microsoft 365 enriched logs. Internet Access and Private Access proper come through the Entra Suite or standalone, and both additionally require P1 or P2 for the users.
Universal Tenant Restrictions, which stops a specific leak
Microsoft describes applying Universal Tenant Restrictions to reduce the risk of data exfiltration to unauthorised foreign tenants or personal accounts. That is the scenario where somebody signs into a personal Microsoft account, or another organisation tenant, from a corporate device and moves data across. Most organisations have no control over it at all, and this one sits in the P1 tier.
Source IP restoration, which fixes your sign-in logs
Microsoft describes increasing the accuracy of threat detections with source IP restoration for Entra ID sign-in logs. Where traffic passes through a network service, the original client address is normally lost, which degrades every location-based policy and risk detection you have. Restoring it means Conditional Access and identity risk see where the user actually is.
Private Access, which is a VPN replacement rather than a VPN
Microsoft describes it as building on Entra application proxy and extending access to any private resource, port and protocol, letting remote users reach private applications across hybrid and multicloud environments from any device and network without requiring a VPN, with per-app adaptive access based on Conditional Access policies for more granular security than a VPN provides.
Per-app access, not network access
The distinction is the whole point. A VPN puts a device on the network and then trusts it. Private Access offers per-app access for TCP and UDP applications, with Quick Access covering a range of IP addresses or fully qualified domain names, so a user reaches the specific application they are entitled to rather than everything the network can see.
A secure web gateway that knows who the user is
Internet Access protects access to internet and SaaS applications with an identity-based secure web gateway, blocking threats, unsafe content and malicious traffic, with web content filtering by category or fully qualified domain name, TLS inspection, threat intelligence and data loss prevention. Identity-aware is the differentiator: policy can vary by user, device, location, risk and compliance rather than by IP address.
Conditional Access reaching destinations it never could before
Microsoft describes applying universal Conditional Access policies for all internet destinations, even where those destinations are not federated with Entra ID, through integration with Conditional Access session controls. That extends your existing access policy from applications you own to the internet generally, which is a genuinely different reach from what Conditional Access alone offers.
Shadow AI discovery and prompt injection protection
The Internet Access feature list includes shadow AI discovery and prompt injection protection, alongside data loss prevention and network controls for agents, the last of which Microsoft notes requires a separate agent licence. For organisations trying to understand what AI tools staff are actually using, and to control what goes into them, this is a newer and increasingly relevant angle.
Four things that make this a project rather than a purchase.
We start with the part you already own
Internet Access for Microsoft services is included in Entra ID P1 or P2, and it carries Universal Tenant Restrictions, the compliant network check, source IP restoration and enriched Microsoft 365 logs. Deploying that first delivers real control, proves the client and the traffic profile model in your environment, and costs nothing beyond the work.
We treat tenant restrictions as a control worth having on its own
Reducing the risk of data exfiltration to unauthorised foreign tenants or personal accounts addresses a gap almost every organisation has and almost none can currently close. Somebody signing into a personal Microsoft account on a corporate device is a route out that no firewall rule addresses, and this is the mechanism that does.
We scope Private Access per application, not as a VPN swap
The point of zero trust network access is that a user reaches the application they are entitled to rather than the network it sits on. Migrating a VPN by recreating full network access through a different product delivers none of the benefit. Working out what each population actually needs to reach is the project, and it is where the security improvement comes from.
We check the constraints that stop designs late
The fifty licence combined minimum for remote network connectivity, which platforms need the client, whether an existing secure service edge product is staying alongside, and where TLS inspection is acceptable. Each of these has stopped a design we have been asked to review, and each takes minutes to establish at the start.
Six UAE situations where secure service edge changes the position.
An organisation whose VPN grants far more than anybody needs
The default state: connect, and you are on the network with whatever that reaches. Per-app access for TCP and UDP applications, with Quick Access covering specific addresses or domains, means a contractor reaching one application reaches one application. That is a security improvement a VPN cannot deliver regardless of how it is configured.
A regulated firm worried about data reaching personal accounts
Universal Tenant Restrictions reduce the risk of exfiltration to unauthorised foreign tenants or personal accounts. For firms where a staff member signing into a personal Microsoft account on a corporate machine is a genuine concern and currently an uncontrolled one, this is a specific control with a specific answer, and it sits in the P1 tier.
A business with branch offices to connect
Remote network connectivity acquires traffic from a branch location rather than requiring a client on every device, which suits sites with shared equipment or unmanaged devices. Microsoft states you need a combined total of at least fifty licences from Entra ID P1 and Entra Internet Access to enable it, which is the first thing to check.
An organisation whose sign-in logs show the wrong location
Where traffic passes through a network service and the original client address is lost, every location-based Conditional Access policy and identity risk detection degrades. Source IP restoration for Entra ID sign-in logs addresses that directly, and it improves the accuracy of controls you already rely on rather than adding new ones.
A business still maintaining a web filtering appliance
An on-premises box that only sees traffic from inside the building, in an organisation where most people are not in the building. An identity-aware cloud-delivered secure web gateway with category and domain filtering applies the same policy wherever the user is, and removes the hardware and the backhaul that made the old model work.
An organisation trying to see what AI tools staff use
Shadow AI discovery, prompt injection protection and data loss prevention sit within Internet Access, and network controls for agents are listed as available with a separate agent licence. For organisations where AI adoption is happening faster than policy, this is one of the few places to get visibility and control at the network layer rather than after the fact.
How remote and internet access is actually controlled here.
| Feature | Global Secure Access | VPN plus an appliance | VPN only |
|---|---|---|---|
Access granted per application | Yes | No, per network | No, per network |
Conditional Access applies to the connection | Yes | No | No |
Policy varies by user, device, risk and compliance | Yes | Rarely | No |
Web filtering by category and domain | Yes | Yes | No |
Conditional Access reaches non-federated destinations | Yes | No | No |
Exfiltration to personal accounts restricted | Yes | No | No |
Sign-in logs show the real client address | Yes | Frequently not | Frequently not |
Works the same in an office and at home | Yes | No | No |
Hardware to maintain | None | Yes | Yes |
Frequency in the UAE market | Rare | Common | Very common |
Reproduced from the published comparison table.
| Feature | Where it sits | |
|---|---|---|
| Windows, macOS, iOS and Android clients | All three licensing positions | |
| Universal Continuous Access Evaluation | All three licensing positions | |
| Direct Microsoft services connectivity | Entra ID P1 or P2, Microsoft traffic profile | |
| Universal Tenant Restrictions | Entra ID P1 or P2, Microsoft traffic profile | |
| Compliant network check | Entra ID P1 or P2, Microsoft traffic profile | |
| Source IP restoration | Entra ID P1 or P2, Microsoft traffic profile | |
| Microsoft 365 enriched logs | Entra ID P1 or P2, Microsoft traffic profile | |
| Universal Conditional Access | Microsoft traffic profile and Internet Access | |
| Remote network branch connectivity | Microsoft traffic profile and Internet Access, with a 50 licence minimum | |
| Web category and FQDN filtering, TLS inspection, threat intelligence | Internet Access licence | |
| Data loss prevention and shadow AI discovery | Internet Access licence | |
| VPN replacement, Quick Access, per-app TCP and UDP | Private Access licence | |
| Application discovery, private DNS, single sign-on across private apps | Private Access licence |
Five steps, and the first is free if you hold P1.
- 1
Establish which of the three positions you hold
Entra ID P1 or P2 for Internet Access for Microsoft services, and the Entra Suite or standalone licences for Internet Access and Private Access, noting that both of those additionally require P1 or P2 for the users. This determines what is available now and what is a purchase decision.
- 2
Deploy the Microsoft traffic profile first
Because it is included with P1 or P2 and delivers real controls: the compliant network check, Universal Tenant Restrictions, source IP restoration and enriched logging. It also proves the client deployment and the traffic forwarding model in your environment before anything larger depends on it.
- 3
Map what each population actually needs to reach
The core work of any Private Access deployment. Which applications, which ports and protocols, and which users, so that access is granted per application rather than per network. Application discovery helps here, and it does not remove the need for the conversation with each business area.
- 4
Design the internet policy set
Web category and domain filtering, threat intelligence, where TLS inspection is appropriate and where it is not, data loss prevention rules, and universal Conditional Access reaching destinations that are not federated with Entra ID. Plus shadow AI discovery where understanding tool usage is a priority.
- 5
Migrate in waves, side by side where needed
Microsoft supports deploying alongside existing non-Microsoft secure service edge solutions, which makes a phased migration realistic rather than a cutover. Population by population, with the VPN retired only once each group has per-application access to everything it genuinely needs.
What organisations ask about Global Secure Access.
Fifteen questions worth answering first.
What you already have
- Are your users on Entra ID P1 or P2?The Microsoft services tier comes with it.
- Do you hold the Entra Suite?That covers Internet Access and Private Access.
- Have you enabled the Microsoft traffic profile?It is the part you may already own.
- Are Universal Tenant Restrictions configured?They address exfiltration to personal accounts.
- Are your sign-in logs showing real client addresses?Source IP restoration fixes that.
What you are replacing
- What does your VPN actually give access to?Usually more than any one user needs.
- Do you run another SSE product already?Side-by-side deployment is supported.
- Is web filtering currently done on-premises?That appliance is what this replaces.
- How do remote users reach private applications today?And what else can they reach.
- Do you use Entra application proxy?Private Access builds on it.
Practical constraints
- Do you have at least 50 combined licences?Required for remote network connectivity.
- Which platforms need the client?Windows, macOS, iOS and Android are supported.
- Are branch locations in scope?That is the remote network scenario.
- Do you need TLS inspection?It is an Internet Access capability with its own considerations.
- Are AI tools in scope for discovery or control?Shadow AI discovery sits in Internet Access.
The pages around this one.
Conditional Access
The policy layer this extends, including to internet destinations that are not federated with your tenant.
Defender for Cloud Apps
What happens inside the SaaS applications, alongside the network controls governing how users reach them.
Entra ID P1 versus P2
Where the licence tiers sit, including the Internet Access for Microsoft services capabilities included with P1.
Switch on the part that comes with your P1 licence.
Universal Tenant Restrictions, the compliant network check and source IP restoration are included with Entra ID P1 or P2 through the Microsoft services tier. In most tenants none of them are enabled, which makes this the cheapest security improvement in the whole product family.
Related Services
Explore more solutions that work great with this service
Microsoft Tunnel
Mobile VPN gateway with Conditional Access at the door
Entra Conditional Access
The control that decides who reaches your data
Defender for Cloud Apps
Shadow IT, SaaS posture and the OAuth apps already reading your mail
Entra ID P1 vs P2
What P2 genuinely adds, and what quietly moved
Microsoft Entra
Identity and access management solutions
Entra ID Protection
On P1 you see a flag. On P2 you see why, and can act on it
Microsoft Security Dubai
Entra, Defender, Purview, Sentinel, and what you already own
Network Monitoring NOC
24/7 NOC monitoring with named engineers