What is Global Secure Access Client

Global Secure Access is Microsoft’s answer to replacing your VPN. It puts network access decisions behind the same identity controls you already use for applications.

It is worth understanding properly, because the licensing is not obvious and the name covers two quite different products.

The two products

Global Secure Access is the umbrella. Two things sit underneath it.

Microsoft Entra Private Access replaces a VPN. Users reach internal applications, file shares and servers without being put on your network.

Microsoft Entra Internet Access controls outbound internet traffic. It applies Conditional Access to SaaS applications and adds web content filtering.

You can deploy either on its own. Most organisations start with Private Access, because the VPN is usually the thing causing pain.

What the client does

The client runs on the device. It captures the traffic you tell it to and routes it through Microsoft’s network, where your policy gets applied.

Windows, macOS, Android and iOS are supported. There is also a remote network option that connects an entire site without a client on each device, which suits branch offices and anything that cannot run an agent.

Why it beats a VPN

A VPN makes one decision, at connection time, and then hands over the network.

Global Secure Access decides per application, continuously, through Conditional Access. User identity, device compliance, sign-in risk and the sensitivity of what is being reached all feed that decision.

The practical difference shows up quickly. A contractor on an unmanaged laptop can reach exactly one internal application and nothing else. With a VPN that is a firewall project. Here it is a policy.

Step-up authentication falls out of the same design. Someone connected under ordinary conditions who reaches for the finance system can be asked for a stronger credential at that moment, rather than for everything at the start of the day.

SMB shares without a domain join

This is the capability that sells it in most rooms.

Private Access can reach SMB file shares from devices that were never domain joined, authenticated through Entra ID and governed by device compliance. No VPN, no domain join, no jump box.

For anyone supporting contractors, BYOD, or an acquisition that never made it into the domain, that removes a whole category of problem.

Licensing, which is the part people miss

Global Secure Access is not included in Entra ID P1 or P2 the way people assume.

The traffic profile covering Microsoft’s own services is available with Entra ID P1 and P2. Everything past that, meaning full Internet Access with web content filtering, and Private Access, needs paid add-on licensing. Both also come bundled in the Microsoft Entra Suite.

Price it before you design around it. We have watched this assumption break a business case late in the day, and checking early costs nothing.

What it does not do

It is not a firewall replacement. You still need edge controls for traffic that never passes through a managed device.

It is not a full SASE platform in the way some competitors are, although the gap has narrowed. If you are comparing it against Zscaler or Netskope, compare feature by feature rather than category by category.

It also depends on Entra ID already being in good order. If your Conditional Access policies are a thicket nobody fully understands, this will make that worse before it makes it better.

Who it suits

Organisations already committed to Microsoft, with Entra ID doing real work, and a VPN concentrator they would like to switch off.

If that describes you, the payoff is fewer appliances, less on-premises infrastructure, and one place where access decisions get made and audited.

If you are early in your Entra journey, or identity hygiene is shaky, do that work first. Global Secure Access amplifies whatever posture you already have, in both directions.

Element Digital offers IT consulting services in Hobart. If you are looking at replacing a VPN, get in touch.