GSA integration guide

Global Secure Access + Windows 365 / Azure Virtual Desktop

Cloud PCs don't need a VPN to reach on-prem apps. GSA Private Access gives Windows 365 and Azure Virtual Desktop an outbound-only path to internal resources. The platforms differ: Windows 365 Enterprise chooses between a Microsoft-hosted network and an Azure Network Connection (ANC), while Azure Virtual Desktop session hosts live in your own VNet and already use outbound reverse connectivity by default.

Windows 365 · Azure Virtual Desktop · Microsoft

GSA owns

Private access to on-prem apps via Entra Private Access connectors
Cloud PC internet egress through GSA Internet Access (SWG)
Identity + Conditional Access enforcement (MFA, device compliance, sign-in risk)

The legacy approach owns

Azure Network Connection (ANC) + VPN Gateway / ExpressRoute
A VPN or ANC path to on-prem (which can mean inbound VPN endpoints)
Hybrid Azure AD Join line-of-sight to domain controllers

Before — legacy path

After — GSA Private Access

01Inventory dependencies

List the file servers, LOB apps and systems your Cloud PC users touch, then map each dependency: Kerberos SSO to domain controllers is supported through Private Access, while hybrid Azure AD join, Intune enrolment and other domain operations have their own connectivity requirements. The dependency list decides what moves to Private Access and what still needs a network path.

02Deploy Entra Private Access connectors

Install the connector group on-prem. Connectors dial out to the GSA service — no inbound firewall rules, nothing exposed to the internet.

03Install the GSA client on Cloud PCs

Install and configure the Global Secure Access client, then assign the forwarding profiles to your Cloud PC groups. On Azure Virtual Desktop, the client is supported on single-session hosts, not multi-session. Verify traffic is acquired (connector logs and the client's diagnostic view) before cutting anything over.

04Publish on-prem apps to Cloud PC users

Create Private Access apps and segments for each on-prem resource and assign them to your Cloud PC user groups. Access follows identity + device posture, not network location.

05Phase out the ANC and VPN

Shrink the Azure Network Connection and VPN to only what still needs raw network line-of-sight, then retire it as each dependency migrates.

Scope note: Entra Private Access provides private access to on-prem and private resources — it is not an internet security service. Internet-bound protection (web filtering, threat protection) comes from Entra Internet Access, a separate profile and licence.

When to use: you're provisioning Windows 365 Enterprise or Azure Virtual Desktop and want Cloud PCs to reach on-prem apps without standing up an Azure Network Connection, VPN Gateway or ExpressRoute — or you're replacing an existing VDI VPN with GSA.

Reference: Microsoft Learn — Global Secure Access Private Access

By Passbeck architecture team · Last reviewed 7 Sep 2026