Domain 2 of 4 · Chapter 4 of 4

Global Secure Access

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Microsoft Certified: Identity and Access Administrator Associate premium course — no separate purchase.

Included in this chapter:

  • The SSE model: one umbrella, two products, four profiles
  • Deploy the Global Secure Access client
  • Deploy and manage Private Access
  • Deploy and manage Internet Access (incl. Microsoft 365)
  • Remote networks, and exam-pattern recognition

The three traffic forwarding profiles compared

DimensionMicrosoft (M365) profileInternet Access profilePrivate Access profile
What it forwardsExchange, SharePoint/OneDrive, Teams, M365 CommonPublic internet and SaaS (prepopulated FQDN/IP list)Your private apps via Quick Access FQDNs/IPs and per-app access
ProductInternet Access for Microsoft servicesMicrosoft Entra Internet AccessMicrosoft Entra Private Access
License (on top of P1/P2)None; ships with Entra ID P1/P2Entra Internet Access or Entra SuiteEntra Private Access or Entra Suite
Onboarding pathsClient or remote networkClient or remote networkClient only (no remote network)
Signature featuresCompliant Network, Universal Tenant Restrictions, source IP restoration, M365 enriched logsSWG, web/FQDN filtering, TLS inspection, threat intelligenceVPN replacement (ZTNA), Quick Access, per-app TCP/UDP, private DNS
Evaluation orderFirstThirdSecond

Decision tree

What is the destination?Pick the traffic forwarding profilePrivate corp appMicrosoft 365Other internet / SaaSPrivate Access profileClient only; needs Quick AccessMicrosoft profileShips in P1 or P2; no add-onInternet Access profileAdd-on or Entra Suitehow to onboard?GSA client + connectorNo remote network for PrivateOnboard via client or remote network (branch)Remote network needs 50+ combined licensesAlways: Entra ID P1/P2 prerequisiteGSA Admin enables profiles; CA Admin links policies
Cheat sheet

Cheat sheet

  • Global Secure Access is the umbrella; Internet Access and Private Access are the products
  • Profiles are evaluated Microsoft first, then Private, then Internet
  • The Microsoft Entra traffic profile is a hidden, always-on system profile
  • Only the Microsoft 365 profile ships in P1/P2; Internet and Private need an add-on
  • The GSA client needs an Entra joined, hybrid-joined, or registered device
  • Private Access is client-only; a remote network can never carry it
  • Private Access publishes apps with Quick Access or per-app access
  • Private network connectors give Private Access its reach, with no inbound ports
  • Compliant Network, Tenant Restrictions, source IP restoration live only on the Microsoft profile
  • Bypassed Microsoft traffic is never picked up by the Internet profile
  • Internet Access is the SWG; pair it with the Microsoft profile for full coverage
  • Remote networks onboard a branch without a client but need 50+ combined licenses
  • Use GSA Administrator to enable profiles and CA Administrator to link policies
  • Deliver a Global Secure Access security profile to users through Conditional Access
  • Enable CA Signaling before using the compliant network check

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. What is Global Secure Access?
  2. Global Secure Access traffic forwarding profiles
  3. Install the Global Secure Access Windows client
  4. Install the Global Secure Access macOS client
  5. Install the Global Secure Access iOS client
  6. Install the Global Secure Access Android client
  7. Private DNS and private name resolution with Private Access
  8. Manage the Microsoft 365 traffic forwarding profile
  9. The Internet access traffic forwarding profile
  10. Configure web content filtering for Internet Access
  11. Universal Conditional Access through Global Secure Access