entra-global-secure-access

Name: entra-global-secure-access
Author: vinayaklatthe

161stars34forks

How to install entra-global-secure-access?

vinayaklatthe/microsoft-security-skills/entra-global-secure-access

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill entra-global-secure-access

Installs into the current project.

Summary

Guidance for Microsoft Entra Global Secure Access (GSA) — Microsoft's Security Service Edge (SSE) combining Entra Internet Access (SWG/Secure Web Gateway) and Entra Private Access (ZTNA replacement for VPN). Covers client deployment (Windows, macOS, iOS, Android), traffic forward

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Entra Global Secure Access
2
3	Global Secure Access (GSA) is Microsoft's Security Service Edge (SSE) platform delivered
4	through the Entra control plane. It has two products that share one client, one policy
5	surface, and one identity model:
6
7	- Entra Internet Access — secure web gateway (SWG) for internet and Microsoft 365
8	traffic with Conditional Access applied to network flows.
9	- Entra Private Access — ZTNA replacement for traditional VPN, fronting on-prem and
10	IaaS apps through Entra-authenticated connectors (evolution of Entra App Proxy).
11
12	## When to use
13	Replacing VPN with ZTNA, applying Conditional Access to outbound internet traffic,
14	restoring source IP for M365 sign-ins from the GSA client, or providing remote-worker
15	access to TCP/UDP apps that aren't HTTPS.
16
17	Do not use this skill for generic CA policy authoring (`conditional-access-mfa`),
18	hybrid network design (`azure-network-security-design`), or competing SSE products.
19
20	## Traffic forwarding profiles
21
22	\| Profile \| Traffic captured \| Use case \|
23	\|---\|---\|---\|
24	\| Microsoft profile \| Entra ID + M365 traffic \| Source IP restoration, CA on network for M365 \|
25	\| Internet Access profile \| All internet egress \| SWG, web filtering, CA on internet traffic \|
26	\| Private Access profile \| Defined private apps (on-prem, IaaS) \| ZTNA, VPN replacement \|
27
28	Each profile is assigned to users/groups; user can be in all three concurrently.
29
30	## Approach
31
32	1. Start with the Microsoft profile, even if you're not buying full SSE yet. It's
33	included with Entra ID P1/P2 (in preview/GA per region). Benefits:
34	- Source IP restoration → CA policies that "require trusted network" actually work
35	for remote users on the GSA client.
36	- Compliant network check in CA: only requests through GSA satisfy the condition.
37
38	2. Pilot the GSA client on a small group (50–200 users). Validate:
39	- Latency to top apps (M365, internal HR, SAP) ≤ baseline + 30 ms.
40	- Captive portals still work (hotel/airport Wi-Fi).
41	- Conflict check with existing VPN clients, third-party endpoint protection, and
42	personal firewalls.
43
44	3. Roll out Private Access in parallel with VPN, not as a flag-day cutover.
45	- Quick Access = the "easy migration" app: a wildcard FQDN/IP segment per site,
46	pre-authenticated by Entra. Use for legacy back-end services.
47	- Per-app access = define one Entra app per service with explicit FQDN/port/protocol
48	and CA assignment. Use for high-value apps (SAP, file shares, RDP jump hosts).
49	- Deploy Private Access connectors in HA pairs per region/site (same model as
50	App Proxy connectors).
51
52	4. Internet Access — start in monitor-only for 14 days. Build the baseline of
53	destinations before turning on web-category blocks. Apply TLS inspection only to
54	selected categories (don't break banking/healthcare per local law).
55
56	5. Conditional Access on network — author CA policies that include
57	`All Compliant Network locations`. Combine with device compliance + user risk for a
58	real "Zero Trust" posture, not just "VPN with new branding."
59
60	6. Branch / site connectivity — for office locations, terminate IPSec tunnels from the
61	site router/SD-WAN to GSA so guest devices and IoT still get filtered without the
62	client.
63
64	7. Migration off VPN — once 80%+ of users are stable on GSA Private Access for the
65	target app set, decommission VPN concentrators. Keep one for break-glass and
66	third-party-managed devices.
67
68	## Guardrails
69	- GSA client and a third-party SSE/VPN client coexist poorly. Network stack hooks
70	collide. Pick one tunnel per machine; pilot before mass rollout.
71	- Source IP restoration only works for traffic through the Microsoft profile. Direct
72	M365 access (split tunnel disabled) bypasses GSA → CA "trusted network" fails.
73	- **Don't den

People who liked this also viewed

6 picks

Type

entra-global-secure-access

161stars34forks

View on GitHub

How to install entra-global-secure-access?

vinayaklatthe/microsoft-security-skills/entra-global-secure-access

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill entra-global-secure-access

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Entra Global Secure Access
2
3	Global Secure Access (GSA) is Microsoft's Security Service Edge (SSE) platform delivered
4	through the Entra control plane. It has two products that share one client, one policy
5	surface, and one identity model:
6
7	- Entra Internet Access — secure web gateway (SWG) for internet and Microsoft 365
8	traffic with Conditional Access applied to network flows.
9	- Entra Private Access — ZTNA replacement for traditional VPN, fronting on-prem and
10	IaaS apps through Entra-authenticated connectors (evolution of Entra App Proxy).
11
12	## When to use
13	Replacing VPN with ZTNA, applying Conditional Access to outbound internet traffic,
14	restoring source IP for M365 sign-ins from the GSA client, or providing remote-worker
15	access to TCP/UDP apps that aren't HTTPS.
16
17	Do not use this skill for generic CA policy authoring (`conditional-access-mfa`),
18	hybrid network design (`azure-network-security-design`), or competing SSE products.
19
20	## Traffic forwarding profiles
21
22	\| Profile \| Traffic captured \| Use case \|
23	\|---\|---\|---\|
24	\| Microsoft profile \| Entra ID + M365 traffic \| Source IP restoration, CA on network for M365 \|
25	\| Internet Access profile \| All internet egress \| SWG, web filtering, CA on internet traffic \|
26	\| Private Access profile \| Defined private apps (on-prem, IaaS) \| ZTNA, VPN replacement \|
27
28	Each profile is assigned to users/groups; user can be in all three concurrently.
29
30	## Approach
31
32	1. Start with the Microsoft profile, even if you're not buying full SSE yet. It's
33	included with Entra ID P1/P2 (in preview/GA per region). Benefits:
34	- Source IP restoration → CA policies that "require trusted network" actually work
35	for remote users on the GSA client.
36	- Compliant network check in CA: only requests through GSA satisfy the condition.
37
38	2. Pilot the GSA client on a small group (50–200 users). Validate:
39	- Latency to top apps (M365, internal HR, SAP) ≤ baseline + 30 ms.
40	- Captive portals still work (hotel/airport Wi-Fi).
41	- Conflict check with existing VPN clients, third-party endpoint protection, and
42	personal firewalls.
43
44	3. Roll out Private Access in parallel with VPN, not as a flag-day cutover.
45	- Quick Access = the "easy migration" app: a wildcard FQDN/IP segment per site,
46	pre-authenticated by Entra. Use for legacy back-end services.
47	- Per-app access = define one Entra app per service with explicit FQDN/port/protocol
48	and CA assignment. Use for high-value apps (SAP, file shares, RDP jump hosts).
49	- Deploy Private Access connectors in HA pairs per region/site (same model as
50	App Proxy connectors).
51
52	4. Internet Access — start in monitor-only for 14 days. Build the baseline of
53	destinations before turning on web-category blocks. Apply TLS inspection only to
54	selected categories (don't break banking/healthcare per local law).
55
56	5. Conditional Access on network — author CA policies that include
57	`All Compliant Network locations`. Combine with device compliance + user risk for a
58	real "Zero Trust" posture, not just "VPN with new branding."
59
60	6. Branch / site connectivity — for office locations, terminate IPSec tunnels from the
61	site router/SD-WAN to GSA so guest devices and IoT still get filtered without the
62	client.
63
64	7. Migration off VPN — once 80%+ of users are stable on GSA Private Access for the
65	target app set, decommission VPN concentrators. Keep one for break-glass and
66	third-party-managed devices.
67
68	## Guardrails
69	- GSA client and a third-party SSE/VPN client coexist poorly. Network stack hooks
70	collide. Pick one tunnel per machine; pilot before mass rollout.
71	- Source IP restoration only works for traffic through the Microsoft profile. Direct
72	M365 access (split tunnel disabled) bypasses GSA → CA "trusted network" fails.
73	- **Don't den

People who liked this also viewed

6 picks

Type