Seamless, Secure, and VPN-Free: How Microsoft Global Secure Access Redefines Hybrid Work

Modern Work Challenges

Even before the COVID-19 pandemic, more and more companies and employees were discovering the ability to work from anywhere in the world. However, this increased flexibility also presents numerous challenges:

• Flexibility and Mobility: Employees are increasingly working from various locations—whether at home, on the go, or in external offices.

• Secure Access to Data and Applications: Sensitive corporate data must be protected at all times, regardless of the workplace.

• Bring Your Own Device (BYOD): Employees may use personal devices, requiring additional security measures.

• Corporate Devices: Managing and securing company-owned devices is just as crucial as with BYOD.

• Compliance and Data Protection: Companies must comply with legal regulations and internal policies to protect personal data.

• Geographical Differences: Different locations come with varying security requirements and risks.

How Have These Challenges Been Addressed Until Now?

Traditional VPN Solutions

Virtual Private Networks (VPNs) have long been the standard solution for remote access to corporate networks. Users launch their VPN client on their PC and connect to the company network to access internal resources over an encrypted connection. VPNs were often used for accessing local resources within the corporate network, while proxies and VPN solutions were also employed to secure standard internet traffic and enable additional security features such as web filtering.

Disadvantages of Traditional VPNs:

• Complexity: Setting up and managing VPNs is often time-consuming and requires significant IT resources. The need to secure both access to local resources and the internet often leads to a complex infrastructure.

• Scalability: With a large number of users, VPNs quickly reach their limits. These solutions are often not designed to efficiently manage a high number of simultaneous connections.

• Security Risks: Once connected, the user often has access to the entire network, including local resources. In the case of a compromised device, this can pose a significant security risk. Additionally, access control for internet traffic secured through proxies or VPNs is often difficult to manage, leading to insufficient protection.

• MFA Configuration: Many traditional VPN solutions do not always offer native, integrated Multi-Factor Authentication (MFA) and require additional configurations or external MFA solutions. This increases the configuration effort and the likelihood of errors, as various security mechanisms need to be coordinated.

The Solution – Microsoft’s Global Secure Access

What Is an SSE Solution?

A Security Service Edge (SSE) solution integrates three core services that help businesses provide employees with secure access to corporate resources—no matter where they are. In this scenario, these resources include SaaS, web, and private applications.

Components of an SSE Solution:

• Zero Trust Network Access (ZTNA): Secure access to resources without traditional VPN solutions.

• Secure Web Gateway (SWG): Protects and monitors internet traffic.

• Cloud App Security Broker (CASB): Controls and secures the use of cloud services.

Components of Microsoft Global Secure Access

Microsoft Entra Private Access (ZTNA)

Microsoft Entra Private Access enables secure access to (legacy) applications, cloud environments, and corporate resources without requiring a traditional VPN. Access is granted only after successful evaluation of Conditional Access rules (e.g., device security status).

Quick Facts:

• Access to Private Clouds and Corporate Networks: Secure access without VPN. No inbound firewall rules are required, drastically reducing external attack surfaces.

• Routing via Microsoft’s Private Global Network: Data is routed through Microsoft’s private backbone, ensuring efficient and secure transmission.

• GSA Client: Installed on endpoints and supports Continuous Access Evaluation (CAE)—even for applications that do not natively support it.

• Dedicated Tunnels: Each resource and session establishes separate connections, increasing security by limiting unnecessary access.

• Protocol Support: The GSA Client supports all TCP- and UDP-based protocols, such as SMB and RDP, and is not restricted to HTTP/HTTPS like the Entra App Proxy.

Microsoft Entra Internet Access (SWG)

Microsoft Entra Internet Access filters and monitors internet traffic, blocks malicious content and URLs, and protects users from malware and other threats when accessing the internet or SaaS applications.

Quick Facts:

• Smart Filtering: Monitors data traffic between corporate devices and the internet.

• Data Privacy and Access Control: Protects sensitive data and allows only authorized access.

• Independent of Work Location: Protects against threats such as malware and phishing, no matter where the user is located.

• Policy Enforcement: Determines which websites or apps can be accessed based on user role or location.

Microsoft Defender for Cloud Apps (CASB)

Microsoft Defender for Cloud Apps controls and secures the use of cloud and SaaS services (e.g., Microsoft 365, Google Workspace, Salesforce). Features include Data Loss Prevention (DLP), user behavior analysis, and session-based access control.

Example:

If a user attempts to upload a sensitive file to an unauthorized cloud service, CASB automatically blocks the process.

Quick Facts:

• Secure Cloud Usage: Monitors and controls SaaS and cloud application usage.

• Anomaly Detection: Identifies unusual activities such as irregular login attempts or suspicious data movements.

• Real-Time Session Control: Enforces security policies instantly during active sessions.

• Compliance Support: Helps businesses meet legal and regulatory requirements.

Requirements for Using Global Secure Access

Global Secure Access

Supported Operating Systems:

• Windows

• Android

• macOS

• iOS

Device Registration:

Devices must be registered as Entra ID Joined (formerly Azure AD Joined) or Hybrid Entra ID Joined.

For macOS, iOS, and Android, devices only need to be Entra ID registered.

Entra Private Access

Part of the Microsoft Entra Suite

Licensing:

• Available as a standalone license – requires an additional Entra ID P1 or P2 license (formerly Azure AD Premium P1/P2).

Installation:

• The Entra Private Access Connector must be installed on a dedicated server in the on-premises environment.

Network Requirements:

• Outbound connections over port 443 must be allowed.

System Requirements:

• The connector requires Windows Server 2012 R2 or later.

• .NET Framework 4.7.1 (or higher) must be installed.

• TLS 1.2 must be enabled – additional registry modifications may be necessary.

Entra Internet Access

Part of the Microsoft Entra Suite

Licensing:

• Also available as a standalone license, with the additional requirement of an Entra ID P1 or P2 license.

Real-World Use Cases

The following examples showcase realistic scenarios of companies operating hybrid infrastructures. In these cases, the Global Secure Access Client is used in combination with Microsoft Entra Private Access—a particularly valuable approach for hybrid IT environments.

Example Domain and Servers

• Domain: securecloudexperts.local

• Terminal Server: terminal.securecloudexperts.local (IP: 10.1.1.10, Port: 3389)

• File Server: file.securecloudexperts.local (IP: 10.1.1.20, Port: 445)

• Intranet Portal: intranet.securecloudexperts.local (IP: 10.1.1.30, Ports: 80/443)

• Legacy Application: legacy.securecloudexperts.local (IP: 10.1.1.40, Ports: 80/443)

Scenario 1 – RDP from Cloud Devices to On-Premises Servers

Configuration Steps:

1. Sign-In:

Log in to the Microsoft Entra Portal.

2. Enable GSA:

Navigate to the GSA section and select Activate GSA for your tenant.

3. Configuration:

• Go to the GSA Configuration section.

• Click Connect and select Traffic forwarding.

• Enable Private Access at the tenant level.

4. Install the Connector:

Deploy the Entra Private Access Connector in your on-premises environment.

5. Application Configuration:

• Navigate to Global Secure Access under Microsoft Entra ID.

• Expand Applications, click Enterprise applications, and select New application.

6. Application Segment – RDP:

• Destination Type: Select Remote Desktop.

• Destination Values:

• FQDN: rdpserver.securecloudexperts.local

• (Optional) IP Address: 10.1.1.10

• Port: 3389

• Comment: (Optional) “RDP access to terminal.securecloudexperts.local”

7. Access Control:

• Go back to Enterprise Applications and open the newly created application.

• In Users and Groups, define who should have access.

8. Client Deployment:

• Install the Global Secure Access Client on endpoint devices (recommended via Intune).

9. Testing:

• Open the Remote Desktop Client on your Entra-joined/hybrid-joined device.

• Enter terminal.securecloudexperts.local or 10.1.1.10 and authenticate with your Entra ID credentials.

• The connection will be securely established through the GSA tunnel.

Scenario 2 – Accessing On-Premises SMB File Shares from Cloud Devices

Note on Accessing Local File Shares (e.g., Home Drive):

Even if a device is only Entra ID Joined and not part of a local AD domain, it can still access local file shares—without requiring additional user authentication (SSO).

This is made possible by the Entra Private Access Connector, which runs on a member server in the local Active Directory domain where Hybrid Cloud Kerberos is configured.

• When a user authenticates via Entra ID, the connector requests a Kerberos ticket from the local AD on behalf of the user.

• This allows seamless access to local file shares, such as a home drive, without additional authentication.

Prerequisites:

• The Entra Private Access Connector must be configured in the local AD and authorized for Kerberos Constrained Delegation (KCD).

• The appropriate delegation settings must be configured in AD to allow the connector to request Kerberos tickets for the desired file share.

Configuration Steps:

1. Sign-In:

   Log in to the Microsoft Entra Portal.

2. Enable GSA:

   Navigate to GSA settings and activate it for your tenant.

3. Configuration:

• Go to the GSA Configuration section.

• Click Connect and select Traffic forwarding.

• Enable Private Access at the tenant level.

4. Install the Connector:

   Deploy the Entra Private Access Connector in your on-premises environment.

5. Application Configuration:

• Navigate to Global Secure Access in the Microsoft Entra ID section.

• Open Applications > Enterprise Applications and click New Application.

6. Application Segment – SMB:

• Destination Type: Select TCP (File Share).

• Destination Values:

  • FQDN: file.securecloudexperts.local

  • (Optional) IP Address: 10.1.1.20

  • Port: 445

  • Comment: (Optional) “SMB file shares on file.securecloudexperts.local”

7. Access Control:

• Go back to Enterprise Applications and open the newly created application.

• Define user and group access.

8. Client Deployment:

• Install the Global Secure Access Client on endpoint devices (Intune deployment recommended).

9. Testing:

• Open the File Explorer on a cloud device.

• Enter the UNC path (e.g., \\file.securecloudexperts.local\Share1).

• The connection will be securely established through the GSA tunnel.

Scenario 3 – Secure Access to Internal Web Portals & Legacy Applications

Configuration Steps:

1. Sign-In:

   Log in to the Microsoft Entra Portal.

2. Enable GSA:

• Navigate to GSA settings and activate it for your tenant.

3. Configuration:

• Go to the GSA Configuration section.

• Click Connect and select Traffic forwarding.

• Enable Private Access at the tenant level.

4. Install the Connector:

• Deploy the Entra Private Access Connector in your on-premises environment.

5. Application Configuration:

• Navigate to Global Secure Access in Microsoft Entra ID.

• Open Applications > Enterprise Applications and click New Application.

6. Application Segments:

Segment A – Intranet Portal

• Destination Type: Web Access

• FQDN: intranet.securecloudexperts.local

• (Optional) IP Address: 10.1.1.30

• Ports: 80 (HTTP) / 443 (HTTPS)

• Comment: “Internal access to Intranet Portal”

Segment B – Legacy Application

• Destination Type: Web Access

• FQDN: legacy.securecloudexperts.local

• (Optional) IP Address: 10.1.1.40

• Ports: 80 (HTTP) / 443 (HTTPS)

• Comment: “Access to Legacy Application”

7. Access Control:

• Define user and group access.

8. Client Deployment:

• Install the Global Secure Access Client (Intune deployment recommended).

9. Testing:

• Open a browser and access https://intranet.securecloudexperts.local.

• Authenticate if required—the connection is established securely via GSA.

Conclusion

Microsoft Global Secure Access (GSA) modernizes remote access security by integrating Zero Trust, Secure Web Gateway, and Cloud App Security Broker, providing secure, flexible, and efficient access to corporate resources. 🚀