Every so often Microsoft quietly adds something to Business Premium that would have been a separate product a few years ago, and almost nobody notices. Global Secure Access is the current example. Part of it is already included in the licence you are paying for, it does something genuinely useful for security, and it is switched off in nearly every tenant we look at. This post covers what it is, what you get for free, whether it helps on public Wi-Fi (partly, and we will be precise about that), and how the paid half of it can retire your VPN.
What Global Secure Access actually is
Global Secure Access is Microsoft’s name for two products that live together in the Entra admin centre: Microsoft Entra Internet Access and Microsoft Entra Private Access. The idea is that instead of your office network being the thing that decides who is trusted, a small client on each device sends traffic through Microsoft’s own global network, where your identity, your device and your policies decide what is allowed. Microsoft calls this category Security Service Edge. You can think of it as the network equivalent of what conditional access already does for sign-ins.
There are three traffic “profiles” the client can handle, and this is where the licensing gets interesting:
- Microsoft traffic: Exchange, SharePoint, Teams and the rest of Microsoft 365. Included with Entra ID P1, which is part of Business Premium.
- Internet Access: everything else on the internet, with web filtering and threat protection. A paid add-on.
- Private Access: your on-premises servers, file shares and line-of-business apps. Also a paid add-on, and the part that replaces a VPN.
So if you have Business Premium, the first profile is yours already. It just needs turning on.
The free part, and why it is worth switching on
The Microsoft traffic profile does not sound exciting until you look at what it unlocks. Once the client is on your devices and your Microsoft 365 traffic is flowing through it, you can add a compliant network condition to your conditional access policies. That means: only allow access to company data if the request is coming through our Global Secure Access tunnel, from our tenant.
Here is why that matters. The attack that catches most small businesses now is not a cracked password, it is a stolen session token. The user signs in properly, passes MFA, and a phishing kit sitting in the middle copies the token. The attacker then replays that token from their own machine, anywhere in the world, and walks straight in without ever seeing an MFA prompt. Microsoft’s documentation is blunt about it: without extra controls, a stolen access token stays valid for its full lifetime, typically 60 to 90 minutes, which is plenty.
With the compliant network check in place, a token replayed from a device that is not connected through your tenant’s Global Secure Access is rejected at sign-in, and for apps that support continuous access evaluation it is rejected in near real time even mid-session. The attacker has a valid token and it is useless to them. That is a bigger security gain than most of the products people pay for, and it is included.
A few other things come along with the free profile:
- Universal tenant restrictions: stops someone on a company device signing in to a personal Microsoft account or another company’s tenant and quietly moving data across.
- Source IP restoration: your sign-in logs and existing location-based policies keep working properly, because Microsoft restores the original device IP rather than showing everything as coming from its own network.
- Enriched Microsoft 365 logs: better visibility of who reached what, from where.
- No more maintaining office IP lists: “trusted location” policies that depend on your office’s public IP address become unnecessary, which also means they stop breaking when your internet provider changes it.
Does it protect work data on public Wi-Fi?
This is the question we get asked, so here is the honest answer rather than the marketing one.
Your Microsoft 365 traffic was already encrypted before Global Secure Access existed. Outlook, Teams and SharePoint all use TLS, so someone on the same café network cannot simply read your email off the air. Global Secure Access does add an encrypted tunnel from the device to Microsoft’s nearest edge location, and it handles name resolution for Microsoft services itself, so a dodgy hotspot cannot redirect that traffic somewhere else. That is a real improvement, particularly against tampered DNS and rogue access points, but it is a layer on top of encryption you already had.
The bigger public Wi-Fi win is the compliant network check described above. The scenario that actually hurts businesses on untrusted networks is a phishing page or a man-in-the-middle capturing a session token. With the check in place, that captured token cannot be used from anywhere except a device running your client. So yes, it protects work data on public Wi-Fi, but the mechanism is “stolen credentials do not work from anywhere else”, not “your traffic is now secret”. Both are good. It is worth knowing which one you are getting.
Why is nobody talking about it?
A few reasons, none of them good. It lives in the Entra admin centre rather than the Microsoft 365 admin centre, so plenty of people running small tenants never see it. It arrived alongside two paid products, and the free portion got lost in the noise about the paid ones. And it needs three things done on purpose: an administrator has to enable the Microsoft traffic profile, the client has to be deployed to devices (Windows, macOS, and on phones through the Defender app), and the conditional access signalling has to be switched on before the compliant network condition even appears as an option. None of that happens on its own, so in most tenants it simply never happens at all.
This is the same pattern we see across Business Premium generally. The licence is excellent; the number of businesses using more than a third of it is small. We have written before about how the Essential Eight maps onto tools that are already in the box, and Global Secure Access belongs on that list.
Private Access: the VPN replacement
Now the paid half, because for businesses that still have a server, a NAS or a line-of-business application in the office, this is the part that changes how people work.
A traditional VPN puts the remote user onto your network. Once connected, they can reach everything that network can reach, and so can anything on their laptop. It needs a firewall port open to the world, it needs certificates or shared secrets maintained, it slows down the connection because all the traffic hairpins through the office, and it is one of the most common ways attackers get in when a VPN appliance has an unpatched vulnerability.
Private Access flips that around. A small connector runs on a server inside your network and makes an outbound connection to Microsoft. Nothing inbound is opened on your firewall. When a user needs the file server, their client sends that traffic to Microsoft’s edge, which hands it to the connector, which delivers it to the server. The user never “joins the network”; they get a path to the specific thing they are allowed to reach, and conditional access decides whether they are allowed, per application, using the same policies you already use for Microsoft 365. Managed device only, MFA, block from risky sign-ins, all of it applies to the file share or the RDP session the same way it applies to email.
What is good about it in practice:
- No open ports and no VPN appliance to patch. The connector dials out; there is nothing on the internet for an attacker to find.
- Per-app rather than all-or-nothing. Microsoft’s own guidance is to start with “Quick Access” (publish your internal subnets, so it behaves like the VPN people are used to) and then move the important systems to per-app access with their own conditional access policies. Quick Access also feeds an application discovery report, which is a gentle way of finding out what people actually use on that old server.
- Works with old applications. It handles TCP and UDP, so RDP, SMB file shares, printers and legacy client-server apps all work, and it can do single sign-on into Kerberos-based apps without the user typing a second password.
- Private DNS just works. Internal names like
fileserver.company.localresolve for remote users without any hosts-file fiddling. - Better performance. Users take the shortest path to Microsoft’s edge rather than dragging all their traffic back through the office link.
The cost is real but modest. Private Access on its own is listed at AU$7.50 per user per month on an annual plan; the full Entra Suite, which adds Internet Access web filtering and the identity governance tools, is AU$18. For a business paying for a VPN appliance, its support contract and the occasional emergency patch, that often comes out ahead before you count the security difference.
Where to start
If you are on Business Premium, the free step is a small project: deploy the client, enable the Microsoft traffic profile, turn on conditional access signalling, then roll out a compliant network policy in report-only mode first so you can see what it would block before it blocks anything. Do not forget your break-glass admin accounts need excluding, and if you use Intune, its enrolment apps need excluding too or new devices cannot get set up.
If you still run a VPN, Private Access is worth a proper look before the next appliance renewal. Start with Quick Access so nothing changes for users, then tighten to per-app access over a few weeks.
This is the kind of work we do as part of managed Microsoft 365 and IT security for our clients, and it is a good example of why the security conversation in 2026 is less about buying new tools and more about switching on the ones you already own. If you would like us to check whether Global Secure Access is enabled in your tenant, and what it would take to get there, get in touch.
Adam leads the Itopia team in Brisbane, helping professional-services firms get secure, productive and confident with their technology, in plain English.