Microsoft Entra Global Secure Access Bundle: Licensing Requirements and Deployment Caveats

The word "unifies" needs some care, though. The two services were already managed in one place, so the main change here is how you buy them, not how they work. If you run Entra, Intune and Conditional Access, this is mostly a question of which SKU you buy, with no new architecture to plan for. That still matters, because licensing is often where Zero Trust projects stall before anyone deploys a client.

What Microsoft actually announced​

Microsoft describes the new SKU this way: the Microsoft Entra Global Secure Access offering, available starting November 2, 2026, is for organizations that want identity-aware network access for private and internet traffic as a unified offering.

Microsoft's pitch leans on its "access fabric" idea. In the company's words, Entra Global Secure Access is how we bring the access fabric to life: one identity foundation, one policy engine in Conditional Access, and Zero Trust enforcement on every connection, for employees and AI agents alike.

Redmondmag.com placed the offering next to Microsoft Entra Suite and Microsoft 365 E7. Its point for IT teams was that one combined service could make security policy easier to manage across remote workers, private apps and cloud services. The publication also noted that deployment still needs careful planning around traffic routing, app connectivity and access controls.

Section summary: This is a new combined purchase option, available since November 2, 2026. It doesn't add new capabilities to the services themselves.

The new SKUs, for license admins​

Microsoft's announcement didn't list product identifiers. The Microsoft 365 blog Topedia filled that gap: it reports that Microsoft introduced a new Microsoft Entra Global Secure Access license that bundles Private Access and Internet Access for either standard users or Frontline workers. According to Topedia, the license is part of product ID CFQ7TTC0PFZR (Microsoft Entra Global Secure Access Platform).

Topedia also published the SKU identifiers. These help if you script license assignment or audit your tenant's subscriptions:

These identifiers come from Topedia's November 2026 table. The standalone SKUs still appear next to the new combined one, which fits Microsoft's licensing documentation: it still says Internet Access and Private Access capabilities are each included in the Microsoft Entra Suite license and also available standalone. If your scripts or group-based licensing rules look for the old SKU names, check them before you switch anyone to the bundle.

What's in the box​

The two halves do very different jobs. It helps to think of them as two doors: one for traffic going out to the internet, and one for traffic going into your private network.

Entra Internet Access (outbound). Microsoft's documentation says it protects access to internet and SaaS apps with an identity-based Secure Web Gateway (SWG), blocking threats, unsafe content, and malicious traffic. Its documented controls include:

• Filtering web traffic by web-content categories and/or FQDN-domain names
• Applying universal Conditional Access policies for all internet destinations, even if not federated with Microsoft Entra ID
• Features that only come with the Internet Access license: TLS inspection, threat intelligence, prompt injection protection, data loss prevention and Shadow AI discovery, per Microsoft's feature comparison table

Entra Private Access (inbound). Microsoft says it builds on the capabilities of Microsoft Entra application proxy and extends access to any private resource, port, and protocol. Its main features include:

• Quick Access, which Microsoft describes as Zero Trust-based access to a range of IP addresses and/or Fully Qualified Domain Names (FQDNs) without requiring a legacy VPN
• Per-app access for Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) applications
• App Discovery, private DNS and single sign-on across private apps

Both run on Microsoft's own backbone. Microsoft says the Global Secure Access features are delivered from Microsoft's Wide Area Network, spanning 70 regions and 190+ network edge locations.

Section summary: Internet Access is a secure web gateway for internet and SaaS traffic. Private Access is per-app access to internal resources that can stand in for a VPN. The bundle sells both on one SKU.

Read the prerequisites before you buy​

The bundle doesn't remove the need for a base identity license. Microsoft's licensing documentation says to use Microsoft Entra Private Access and Microsoft Entra Internet Access, users need a Microsoft Entra ID P1 or Microsoft Entra ID P2 license. The Microsoft traffic profile is licensed separately: those capabilities are included in a Microsoft Entra ID P1 or Microsoft Entra ID P2 license.

Other licensing details worth knowing:

• Per-user model. Microsoft says most Global Secure Access services operate on a per-user license model unless otherwise stated.
• Remote networks have a 50-license minimum. You must have a combined total of at least 50 licenses from Microsoft Entra ID P1 and Microsoft Entra Internet Access to enable remote network connectivity.
• Agent controls cost extra. Microsoft's table footnote says network controls for agents requires a Microsoft Agent 365 license. The "AI agents" line in the marketing doesn't come free with the bundle.
• Client coverage is broad. Microsoft's feature table shows Windows, macOS, iOS and Android clients supported under each license type.

Branch offices: a common surprise​

Many teams assume they can route branch-office traffic through a remote network tunnel and get both services that way. Microsoft's feature table lists remote network (branch) connectivity for the Microsoft traffic and Internet Access profiles only, not for Private Access. A March 2026 deployment write-up on the NetEye blog said the same thing more bluntly: remote networks cannot currently acquire Private Access traffic. Private Access requires the Global Secure Access Client on the endpoint.

That makes sense: an identity-based access tunnel needs an identity on the device. In practice, buying the bundle won't let you skip the client rollout. If you want private access everywhere, you need the client on every endpoint that reaches private apps.

Does it really replace the VPN?​

That's the big question for Windows shops still running Always On VPN or a third-party VPN appliance. Remote access specialist Richard Hicks, who has written for years about Microsoft's VPN technologies, is enthusiastic. He writes that Entra Private Access is much simpler to implement than Always On VPN and requires no on-premises infrastructure other than the Entra Private Network connector. He adds that no inbound access from the Internet is required, making the solution inherently more secure and reducing the public attack surface.

That said, "simpler than Always On VPN" isn't the same as "simple." In my experience, the work in these migrations is mapping apps, not installing the client. Someone has to find every legacy app with hard-coded IPs, odd UDP ports or awkward DNS dependencies. App Discovery helps, but it doesn't remove that inventory job. Microsoft also documents that Private Access can be deployed side-by-side with your existing non-Microsoft SSE solutions. That makes a phased migration possible, so you don't have to cut everything over in one weekend.

Analysis: who should care?​

Here's how I read the business case, based on general industry knowledge rather than anything Microsoft has said:

• The bundle is a better fit for: organizations that wanted both pieces but didn't need Entra Suite's governance, ID Protection and Verified ID extras. Before this, they had to buy two standalone SKUs or move up to the Suite.
• It's probably not for: shops already on Entra Suite or a higher plan that includes it. Redmondmag.com tied the offering to Entra Suite and Microsoft 365 E7, which suggests those customers already have the capabilities.
• The bigger strategic story: this is the usual Microsoft move. Fold more security categories into the identity stack and make Conditional Access the control point for everything. That puts it in direct competition with standalone SSE vendors. It also concentrates more risk in one place: if your Entra tenant or Conditional Access setup is misconfigured, network enforcement inherits that mistake.

The second half is the catch. One policy engine is appealing, but it's also one place where things can fail. Teams adopting the bundle should review Conditional Access the way they'd review firewall rules: change control, staged rollout and real testing.

Practical checklist before you switch​

1. Inventory your licenses. Confirm your Entra ID P1/P2 coverage, then compare the combined SKU against the standalone Private Access and Internet Access SKUs and against Entra Suite.
2. Update your automation. Add the new skuPartNumber to any group-based licensing or provisioning scripts.
3. Map your traffic. Decide which flows go through the Microsoft, Internet Access and Private Access profiles. Plan on the client for all Private Access users.
4. Check the branch math. If you need remote networks, confirm you meet the 50-license combined minimum.
5. Pilot Conditional Access. Test policies against a representative set of private and SaaS apps before a broad rollout.
6. Budget for add-ons. Agent network controls require Agent 365 licensing on top of the bundle.

Bottom line: Microsoft has made it easier to buy Entra Private Access and Internet Access together. It hasn't made them easier to deploy. You still need the client rollout, the Conditional Access work and the app inventory, but procurement is now one step simpler.