Global Secure Access: Ditch VPNs Today

Key insights

• Global Secure Access (GSA) replaces traditional VPNs by routing device traffic through Microsoft’s cloud for identity-driven secure access to Microsoft 365, the internet, and on-prem resources.
  The video explains how GSA combines cloud-based security and networking to simplify remote connectivity and reduce reliance on tunnels.
• Zero Trust + SSE is the core model: verify every request, grant least privilege, and assume breach.
  The presenter shows how Zero Trust and SSE enforce continuous checks instead of trusting network location.
• GSA client and Private Access are the main components you deploy: install the client, enable traffic forwarding, and use connectors to reach on-prem apps and file shares from non-domain devices.
  The demo maps an on-prem file share to a laptop without a VPN to show real-world access flow.
• Conditional Access & Adaptive Access stop token-theft attacks by requiring the GSA client and phishing-resistant controls.
  The video walks through policies that block tools like Evilginx and show a blocked malicious link in action.
• Web Content Filtering controls web traffic and blocks risky services such as unapproved SaaS or generative AI services (referred to as Shadow AI), improving compliance and reducing data exposure.
  The presenter configures filtering rules to block unwanted cloud apps and internet risks.
• Operational and licensing notes: GSA works with Entra Conditional Access, Intune, and monitoring dashboards for logs and visibility.
  The video outlines licensing basics (Entra P1/P2, Entra Suite, GSA add-on) and next steps for phased deployment and connector grouping.

Video Overview and Context

This article summarizes a recent YouTube video and companion blog post by Nick Ross [MVP] (T-Minus365) that presents Microsoft’s approach to replacing traditional VPN solutions. The video argues that 2025 has been difficult for VPNs because of breaches, clunky user experience, and heavy support overhead, and it introduces Global Secure Access as a modern alternative. Nick demonstrates how this identity-first model unifies SSE and ZTNA with Microsoft Entra to provide secure access to Microsoft 365, the internet, and on-prem resources without a VPN tunnel. As a result, the coverage highlights practical demos and policy guidance aimed at IT teams planning a migration away from legacy VPN stacks.

Core Technologies Explained

First, the presenter explains the components of Global Secure Access, noting it merges cloud security and Zero Trust networking to control access by identity and device state rather than by network location. He then outlines key elements such as the endpoint client, traffic forwarding profiles, and the split between Entra Internet Access and Entra Private Access, while emphasizing continuous verification and least-privilege access. Moreover, the video clarifies how Conditional Access integrates with these components to enforce policies dynamically across sessions and applications. Consequently, viewers get a clear view of how the pieces fit together for both internet filtering and private resource access.

Demos and Practical Steps

Next, Nick walks through hands-on demos that show the administrator workflow and end-user experience, starting with client deployment and enabling Adaptive Access in the admin center. He uses a Conditional Access policy to require the Global Secure Access client as a defense against token-theft techniques like Evilginx, and then demonstrates an attack link being blocked in real time. In addition, the video covers web content filtering to block risky services such as unapproved AI tools and shadow cloud storage, illustrating how these controls can reduce data exposure. Finally, the presenter shows a compelling example of Private Access where a non-domain-joined device maps an on-prem file share through a connector, proving that legacy resources can remain accessible without opening traditional network tunnels.

Security Benefits and Tradeoffs

On the positive side, the identity-first approach reduces the attack surface that traditional VPN tokens introduce and allows real-time token-theft prevention through targeted policy enforcement. Moreover, integrating phishing-resistant authentication and device posture checks can significantly lower the risk of account compromise and lateral movement. However, there are tradeoffs: relying on a cloud provider’s global network increases dependency on that vendor’s infrastructure, and some organizations will face complications with legacy protocols, single points of failure, or intermittent internet conditions that affect remote access. Therefore, teams must weigh the security gains against operational concerns such as resilience, vendor lock-in, and the need to support unusual or custom on-prem applications.

Deployment Challenges and Licensing

Nick addresses practical challenges including connector placement, traffic routing decisions, and coordination with endpoint management systems like Intune to ensure devices meet compliance checks. He also explains licensing basics, noting that plans such as Entra P1/P2, the Entra Suite, or a GSA add-on affect which features are available, thereby influencing budget and rollout scope. Furthermore, implementing Conditional Access broadly requires careful policy design to avoid disrupting legitimate work while blocking threats, and this balance often needs iterative tuning. Consequently, pilot programs and phased rollouts are recommended to reduce business impact and to gather telemetry for policy refinement.

Recommendations and Next Steps

Ultimately, the video encourages organizations already invested in Microsoft 365 to evaluate Global Secure Access as a modern alternative to VPNs, since many required components may already be in place. For pragmatic deployment, Nick suggests starting with a limited pilot that includes critical use cases such as remote users, contractors, and access to sensitive on-prem systems, and then expanding policies based on observed behavior and operational feedback. Additionally, teams should combine automated monitoring, clear incident playbooks, and user training to smooth the transition and maintain productivity. In summary, the presentation makes a strong case for identity-driven networking while also outlining the technical and organizational tradeoffs IT leaders must manage.

Keywords

global secure access, secure remote access, vpn alternatives, zero trust network access, zero trust access tutorial, remote access tutorial, remote access without VPN, cloud secure access