Buying Private Access and Internet Access together just got simpler—learn how the new offering works, and what else we've shipped for Global Secure Access recently.
Employees, and now AI agents, need secure access to resources wherever they live: the internet, Microsoft 365 and SaaS, cloud and datacenter workloads, on-premises apps, and AI services. Zero Trust means evaluating every one of those connections against full context, including identity, risk, device, app and data, location, and network, and enforcing the decision continuously, not only at sign-in. Organizations need to do that without stitching together separate tools and policies.
Today, we’re taking the next step in our Secure Access Service Edge (SASE) journey: customers can now purchase Microsoft Entra Private Access and Microsoft Entra Internet Access together as a single Microsoft Entra Global Secure Access offering.
This is not a new product; it’s a simpler way to purchase these capabilities together. Microsoft Entra Private Access and Microsoft Entra Internet Access will also continue to be available individually.
How Microsoft Entra Global Secure Access fits
- Microsoft Entra Global Secure Access offering, available starting November 2, 2026, is for organizations that want identity-aware network access for private and internet traffic as a unified offering.
- Microsoft Entra Suite includes Microsoft Entra Global Secure Access alongside Microsoft Entra ID Governance, Microsoft Entra ID Protection, and Microsoft Entra Verified ID for organizations that want a broader identity and access offering.
- Microsoft 365 E7 includes Microsoft Entra Suite and its Global Secure Access capabilities, bringing identity-aware network access alongside Microsoft 365 E5, Microsoft 365 Copilot, and Microsoft Agent 365. Customers can apply consistent Zero Trust access controls across users and AI agents, while bringing identity, security, productivity, and AI capabilities into a more unified experience.
Building your access fabric: identity awareness for every connection
Most network security tools treat identity as an outside input. They sync users, groups and applications from your identity provider and keep their own policies in a separate console. The result is two systems, two sets of policies, and gaps between them that attackers exploit.
Entra Global Secure Access takes a different approach. It brings identity and network together into one access fabric, so every connection carries identity awareness:
- Microsoft Entra is your identity provider, so there are no policy seams. Entra Global Secure Access uses the same users, groups, applications, and Conditional Access policies you already manage in Microsoft Entra. You don't need to sync anything, and you don't need to keep a second set of policies aligned with the first.
- Conditional Access goes beyond single sign-on to any destination. The same identity, device, and risk conditions that protect sign-in, apply to private apps, internet and SaaS destinations, and AI services. That includes apps and protocols that never sign in through Microsoft Entra.
- Protection lasts for the entire session, not only at sign-in. With Universal Continuous Access Evaluation, when a device falls out of compliance or a user's risk becomes high, access is reevaluated in near real time. Customers don't have to wait for a token to expire, and the destination app doesn't need to support Continuous Access Evaluation.
- Agents get the same controls as people. AI agents acting on behalf of users now account for a growing share of traffic. The access fabric applies the same identity-aware controls to agent traffic as to human traffic.
Continuing to deliver on what customers asked for
We’re investing heavily in Entra Global Secure Access and moving quickly on what customers tell us they need: broader traffic coverage, easier deployment, stronger data protection, and better operational insight. Here’s what we’ve shipped in just the last two months, with more on the way.
Public preview capabilities
- Cloud Firewall for client with Microsoft Entra Internet Access extends security beyond web traffic, enabling organizations to control broader TCP and UDP connections with granular Allow and Block rules based on destinations, ports, and protocols, with identity-aware policy assignment through Conditional Access.
- "Continue" Default Action gives administrators greater flexibility to layer independently managed web content filtering policies across security profiles. When traffic doesn’t match an enabled rule, evaluation continues to the next applicable security profile in priority order. This allows organizations to maintain application-specific exceptions alongside a shared enterprise baseline without creating separate policies for every combination of applications.
- Home Network Support for Microsoft Entra Private Access enables remote users to access local resources such as printers, routers, and wireless displays without disconnecting Private Access, while giving administrators control over when local subnet traffic can bypass Private Access.
- Microsoft Entra Health and Alerts for Microsoft Entra Global Secure Access help administrators proactively identify connectivity and deployment issues and accelerate troubleshooting. By bringing health and operational insights into the Microsoft Entra experience, security and network teams can more easily monitor Microsoft Entra Global Secure Access and reduce time spent diagnosing connectivity issues.
- Multiple Traffic Forwarding Profiles for Microsoft Entra Private Access provide more granular control over traffic acquisition, allowing organizations to tailor Private Access profiles across different users, devices, and applications and support more flexible, phased deployments.
- Transport Layer Security (TLS) inspection, now easier to deploy with Microsoft-managed certificates, helps organizations gain deeper visibility into encrypted web traffic and apply granular security controls. Microsoft-managed certificates simplify deployment by eliminating the need to provision and manage your own certificate authority (CA) or public key infrastructure (PKI), making it easier to get started with TLS inspection.
Generally available capabilities
- Custom headers in Microsoft Entra Internet Access give organizations more flexibility to customize HTTP traffic based on their security requirements. Administrators can apply custom headers for specific applications and services, extending granular controls over internet and SaaS access and supporting application-specific security and access scenarios.
- Microsoft Entra and Microsoft Purview bring data security to the network, across human actions and on-behalf-of (OBO) agentic traffic, helping organizations stop sensitive data from reaching risky destinations. Context-aware Microsoft Purview classification and policies are enforced by Microsoft Entra at the network layer, helping organizations discover sensitive files and text in real time and block them from being shared to risky destinations, including unsanctioned AI tools.
- Private Network Connector Smart Load Balancing with Session Affinity keeps requests from the same user and device routed to the same connector throughout a session, helping maintain session continuity and reduce unnecessary reauthentication.
- New device and risk signals for Universal Continuous Access Evaluation (CAE) help organizations make access decisions more adaptive. When a device is disabled, deleted, or falls out of compliance, or when Microsoft Entra ID Protection detects high user risk, Universal CAE can trigger reauthentication so that Microsoft Entra Conditional Access policies can reevaluate access based on the current security state of the device and user.
One unified approach to securing access
Entra Global Secure Access is how we bring the access fabric to life: one identity foundation, one policy engine in Conditional Access, and Zero Trust enforcement on every connection, for employees and AI agents alike. Bringing Private Access and Internet Access together in a single offering makes it simpler to get started, and the capabilities above show how fast we’re moving. This is just the next step. We’re excited to keep building it with you, and we’ll have more to share in the coming weeks.
Learn more about Microsoft Entra Global Secure Access and try it for free.
Yair Tor | Partner Product Management, Identity and Network Access
Additional resources
- Microsoft Entra Global Secure Access
- Secure AI, web, and private apps with Zero Trust | Microsoft Community Hub
Learn more about Microsoft Entra
Prevent identity attacks, ensure least privilege access, unify access controls, and improve the experience for users with comprehensive identity and network access solutions across on-premises and clouds.
Microsoft