12.5 Microsoft Entra Private Access & Global Secure Access

Microsoft Entra Private Access & Global Secure Access

Web Application Proxy and Microsoft Entra Application Proxy (section 12.4) share a hard limitation: both speak only HTTP and HTTPS. Real hybrid estates still depend on Remote Desktop, SMB file shares, SSH, Kerberos, LDAP, SQL Server, and bespoke client-server ERP systems. Historically the only way to reach those from outside the corporate network was a full-tunnel VPN, which places the remote device on the corporate network and therefore grants far more reach than the user's task requires.

Microsoft Entra Private Access is Microsoft's Zero Trust Network Access (ZTNA) answer. It is delivered as one half of Microsoft Entra Security Service Edge (SSE) — the other half being Microsoft Entra Internet Access — under the umbrella product name Global Secure Access (GSA).

---

1. Where Private Access Sits in Global Secure Access

+-----------------------------------------------------------------------------------+
|                    MICROSOFT ENTRA PRIVATE ACCESS (ZTNA) FABRIC                   |
|                                                                                   |
|   [REMOTE ENDPOINT]           [MICROSOFT SSE EDGE (PoP)]    [ON-PREM / CLOUD LAN] |
|   +---------------------+     +-----------------------+     +-------------------+ |
|   | Global Secure Access|     | Global Secure Access  |     | Private Network   | |
|   | Client              | ===>| Cloud Processing Edge | <== | Connector Group   | |
|   | - Traffic Filter Drv| Enc | - Conditional Access  | Out | (Outbound 443)    | |
|   +---------------------+ tun | - Identity Validation |     +-------------------+ |
|          |                    +-----------------------+               |           |
|          | Intercepts:                                    Routes to:  |           |
|          | - RDP (TCP 3389)  ---------------------------------------->| [RDP Host]|
|          | - SMB (TCP 445)   ---------------------------------------->| [File Svr]|
|          | - SSH (TCP 22)    ---------------------------------------->| [Linux VM]|
|          | - ERP (TCP/UDP)   ---------------------------------------->| [SQL/ERP] |
+-----------------------------------------------------------------------------------+

The Global Secure Access client installs a kernel-level network filter driver on the endpoint. That driver inspects outbound connections and, when a destination matches a configured traffic forwarding profile, tunnels the connection to the nearest Microsoft SSE point of presence instead of letting it take the normal network path. The user never launches a VPN client and the physical network adapter is never bridged into a corporate subnet.

---

2. Quick Access vs. Per-App Global Secure Access Apps

Private Access offers two ways to describe the private resources you want to tunnel. Both create a real enterprise application object in Microsoft Entra ID, which is what makes user/group assignment and Conditional Access possible.

Choose a per-app Global Secure Access app when you need to apply a different set of Conditional Access policies to a subset of users, when a handful of resources deserve stricter policy than the rest, or when you want to secure resources only for a specific time frame.

---

3. Application Segments

Inside either app type you define application segments, which are what the GSA client actually matches against:

• Fully qualified domain names, including wildcard forms for whole internal namespaces.
• Individual IP addresses.
• IP address ranges, expressed in CIDR or start–end form.
• Port and port ranges paired with each destination, and the protocol (TCP, UDP, or both).

Because a segment binds a destination to specific ports, an administrator can publish RDP (TCP 3389) to a jump host without simultaneously publishing SMB (TCP 445) on that same host. This is the concrete mechanism behind the "least privilege" claim: the tunnel is per-application, not per-network.

---

4. The Microsoft Entra Private Network Connector

Private Access reuses the same on-premises agent as Entra Application Proxy — the Microsoft Entra private network connector.

Two Windows services are installed: Microsoft Entra private network connector (which carries traffic) and Microsoft Entra private network connector updater (which self-updates the agent). Verify both are Running in services.msc after installation.

Connector groups are the unit of high availability and traffic steering. Each application is assigned to a group, and the service load-balances across the healthy connectors in that group; if one connector goes offline, new requests are routed to its peers automatically because connectors are stateless. A useful operational pattern for patching is a dedicated maintenance connector group bound only to a test application — moving a connector into it stops new sessions being routed to that connector while existing sessions drain gracefully, after which you patch, validate, and move it back.

Deployment note: for SSO with Integrated Windows Authentication, the connector server and the backend application servers should be in the same Active Directory domain or in trusting domains. If they are in different domains, use resource-based constrained delegation instead.

---

5. Conditional Access for Protocols That Never Had It

The strategic payoff is that Conditional Access — historically a control that only applied to web and modern-auth applications — now gates raw protocols. An administrator can require phishing-resistant MFA (FIDO2) and a compliant device before an RDP session to a domain controller is permitted, or block SMB access from non-compliant devices entirely. Neither control is expressible with a traditional IPsec VPN, which authenticates once at tunnel establishment and then forwards packets indiscriminately.

---

6. Exam Decision Table

Exam trap: Private Access requires the Global Secure Access client on the endpoint, whereas Application Proxy is clientless (browser only). If a question specifies that no agent may be installed on the user's device, Private Access is eliminated regardless of how well it otherwise fits.