Decide, compare and coexist.
Plain-English guides for Entra ID customers: whether to replace your VPN, what GSA actually costs, how it compares to Zscaler and Netskope — and how to run it alongside your incumbent vendor.
Decision guides
Entra Private Access vs VPN
Replace legacy VPN with per-app Zero Trust access — the real differences and an app-by-app migration path.
Read guide → LicensingEntra ID P1 vs P2 & GSA licensing
What Entra ID and Global Secure Access actually cost, and the pricing mistake most M365 customers make.
Read guide → ExplainerWhat is Global Secure Access?
Microsoft's SSE platform, explained — Internet Access, Private Access and the Microsoft traffic profile.
Read guide → ComparisonEntra Internet Access vs Zscaler / Netskope
Where Microsoft's native SWG wins, where the incumbents still lead, and why coexistence is often right.
Read guide → SMBGSA for small & medium business
Is it worth it at 20–500 seats? What it replaces and the SMB licensing maths.
Read guide → ExplainerPrivate Access vs Global Secure Access
One is a capability, the other is the platform — clearing up the most common naming confusion.
Read guide →Coexistence guides — GSA alongside your incumbent vendor
GSA + Zscaler
Split-tunnel, PAC-based and full coexistence for Internet Access and Private Access workloads.
Read guide → Cisco UmbrellaGSA + Cisco Umbrella
DNS-layer security, proxy chaining and selective traffic steering approaches.
Read guide → Cisco Secure AccessGSA + Cisco Secure Access
Secure Internet Access, Zero Trust Access and combined private access patterns.
Read guide → Cisco AnyConnectGSA + Cisco AnyConnect
AnyConnect / Secure Client remote-access VPN split-include coexistence scenarios.
Read guide → Palo AltoGSA + Prisma Access
Tunnel-based, split-tunnel and selective routing coexistence patterns.
Read guide → NetskopeGSA + Netskope
Steering configuration, network location profiles and private access coexistence.
Read guide → Windows 365 / AVDGSA + Windows 365 / Azure Virtual Desktop
Connect Cloud PCs to on-prem apps via Private Access — no ANC or VPN, outbound-only.
Read guide →GSA licensing at a glance
- Microsoft traffic profile — included with Entra ID P1/P2; no extra GSA licence.
- Entra Private Access — requires the Private Access licence or Entra Suite, in addition to Entra ID P1/P2.
- Entra Internet Access — requires the Internet Access licence or Entra Suite, in addition to Entra ID P1/P2.
- Risk-based Conditional Access — requires Entra ID P2; device compliance depends on your device-management entitlement (e.g. Intune).
- Not every Microsoft 365 customer already owns full GSA — check which licences you actually hold before scoping. Full licensing explainer →
Official Microsoft resources & open-source tooling
- Microsoft — Global Secure Access · official scenario guides, step-by-step docs and recorded demos · github.com/microsoft/GlobalSecureAccess
- Migrate2GSA · community tools to speed migration from other SSE vendors — maintained by Microsoft employees, but not an official Microsoft product and not supported through Microsoft support · github.com/microsoft/Migrate2GSA
- Microsoft — GSA Policy Workbench · read-only, single-pane visibility of GSA Internet & Private Access policy · github.com/microsoft/GSA-Policy-Workbench
- Maester · MIT test framework with 9 built-in GSA health checks (connector hygiene, forwarding profiles, Conditional Access) · github.com/maester365/maester
- Microsoft Learn — GSA documentation hub · the authoritative reference for all coexistence patterns · learn.microsoft.com/entra/global-secure-access
- merill/awesome-entra · curated list of Entra tooling and resources · github.com/merill/awesome-entra