Global Secure Access for small & medium business
GSA isn't only for enterprises. If you're an SMB already on Microsoft 365, you may already hold the entitlement — and it can replace a legacy VPN appliance you'd otherwise keep paying for.
01You may already have a head start
If you run Microsoft 365 Business Premium (or E3), you already hold Entra ID P1 — which means the Microsoft traffic profile for GSA is included at no extra cost. That's the lowest-risk GSA capability, and it's yours to enable today.
02What it replaces at SMB scale
Most SMBs run a handful of remote-access needs: a file share, a line-of-business app, RDP to a terminal server. A legacy VPN appliance (or an open inbound RDP port — worse) is expensive, risky and oversized for that. Private Access replaces it with per-app access, outbound-only connectors and Conditional Access — no appliance to buy or patch.
03The SMB licensing maths
If you're on Business Premium, per-app private access to your core apps typically means adding Entra Private Access (list ~$5/user/mo on top of P1) — not the whole Entra Suite. For a 50-seat business that's a fraction of a VPN appliance plus its maintenance. See the licensing explainer for the full picture; always verify current Microsoft pricing.
04Where it's genuinely worth it
GSA pays off for an SMB when: you're already on Microsoft 365/Entra ID, you have remote or hybrid workers, and you're running (or about to refresh) a VPN or open remote-access setup. It's less compelling if you're fully on-premises with no Entra ID, or if your remote-access needs are already met cheaply.
05For MSPs: a standardisation play
If you manage access for multiple small clients, GSA gives you a single Entra-native pattern you can replicate across tenants — one policy model, one client, consistent Zero Trust posture — instead of a different VPN box per customer.