Entra Private Access vs Global Secure Access
One is a capability; the other is the platform. People use "Global Secure Access" and "Private Access" interchangeably all the time — here's the actual relationship.
Global Secure Access (the platform)
- The umbrella name for Microsoft's SSE offering
- Contains Internet Access, Private Access and the Microsoft traffic profile
- The GSA client and traffic-forwarding profiles belong here
Private Access (one capability)
- Per-app, identity-based access to private/on-prem apps
- The "VPN replacement" piece of the platform
- Licensed separately from Internet Access
01The taxonomy
Global Secure Access is the platform. Under it sit three traffic-forwarding profiles: the Microsoft traffic profile (M365 steering), Private Access (private apps) and Internet Access (internet/SaaS security). When Microsoft says "Global Secure Access," they mean the whole thing — not just private access.
02Why the names get conflated
Because Private Access was the first headline use case (replace your VPN), and because the client is branded "Global Secure Access client," most people mean Private Access when they say "we're looking at GSA." That's fine conversationally — it just matters when you're scoping licences, because Internet Access and Private Access are separate add-ons.
03Which one do you need?
If the goal is secure access to internal/on-prem apps without a VPN, you need Private Access. If the goal is securing internet and SaaS traffic, you need Internet Access. Both sit under the GSA umbrella, and both are licensed separately on top of Entra ID P1/P2. See the licensing guide for the detail.
04In the Entra admin center
Everything lives under Global Secure Access → Connect → Traffic forwarding. The three profiles listed there are the concrete, deployable pieces — which is why we mirror that exact naming in our assessment tool.