1 00:00:00,000 --> 00:00:03,400 Imagine you're sitting in a coffee shop with your work laptop needing one thing, 2 00:00:03,400 --> 00:00:07,100 an internal finance app that only works from inside the company network. 3 00:00:07,100 --> 00:00:09,900 So you start the old VPN, wait for it to connect, 4 00:00:09,900 --> 00:00:12,900 and then you're effectively through the front door of the company building. 5 00:00:12,900 --> 00:00:14,500 That probably sounds normal, right? 6 00:00:14,500 --> 00:00:16,000 But think about what just happened. 7 00:00:16,000 --> 00:00:20,500 You needed one room, yet the VPN gives your device a root into a much larger part of the building, 8 00:00:20,500 --> 00:00:23,100 like asking reception for access to one meeting room, 9 00:00:23,100 --> 00:00:25,600 then getting a master key for most of the floor. 10 00:00:25,600 --> 00:00:28,500 That old way made sense when nearly everyone worked in one office, 11 00:00:28,500 --> 00:00:32,500 company apps lived in one data center, and the network itself felt like a safe place. 12 00:00:32,500 --> 00:00:34,500 But work doesn't look like that anymore. 13 00:00:34,500 --> 00:00:37,900 People work from home, airports, customer sites, and coffee shops. 14 00:00:37,900 --> 00:00:40,500 Some company apps still sit in an office or data center, 15 00:00:40,500 --> 00:00:43,100 while other tools live in the cloud, and every browser, 16 00:00:43,100 --> 00:00:47,600 Sass app, file sharing site, and AI tool creates another route where company data could leave. 17 00:00:47,600 --> 00:00:50,700 So what exactly is Microsoft, Entra, global, secure access? 18 00:00:50,700 --> 00:00:52,100 Is it just a new VPN? 19 00:00:52,100 --> 00:00:54,300 No, it's a different way to think about access. 20 00:00:54,300 --> 00:00:56,800 Global secure access, often shortened to GSA, 21 00:00:56,800 --> 00:01:00,200 helps the company give you a checked pass to the exact place you need to reach, 22 00:01:00,200 --> 00:01:04,400 instead of treating a VPN connection like permission to enter a broad part of the network. 23 00:01:04,400 --> 00:01:09,400 By the end of this knowledge nugget, you'll understand why the old VPN models struggles with modern work, 24 00:01:09,400 --> 00:01:12,200 how identity moves to the center of the decision, 25 00:01:12,200 --> 00:01:14,400 and how Microsoft entra private access, 26 00:01:14,400 --> 00:01:17,400 and Microsoft entra internet access fit together. 27 00:01:17,400 --> 00:01:19,000 We'll start with the old model first, 28 00:01:19,000 --> 00:01:23,200 because the new model makes far more sense once you see the problem it tries to fix. 29 00:01:23,200 --> 00:01:26,000 Why traditional VPNs no longer fit? 30 00:01:26,000 --> 00:01:28,200 A traditional VPN has a simple job. 31 00:01:28,200 --> 00:01:33,000 It creates an encrypted tunnel from your remote device back into the company network. 32 00:01:33,000 --> 00:01:36,200 Picture an employee working from home who needs to open a file share, 33 00:01:36,200 --> 00:01:37,600 connect to a remote desktop, 34 00:01:37,600 --> 00:01:41,200 or use an internal finance app that isn't available on the public internet. 35 00:01:41,200 --> 00:01:44,200 The VPN gives that employee a protected route back to the company 36 00:01:44,200 --> 00:01:46,200 for years that solved a real problem. 37 00:01:46,200 --> 00:01:49,200 Your traffic crossed the internet inside an encrypted tunnel 38 00:01:49,200 --> 00:01:52,800 and the company could treat your laptop more like it was sitting in the office. 39 00:01:52,800 --> 00:01:54,400 But here's where the trouble starts. 40 00:01:54,400 --> 00:01:58,000 After the tunnel connects, a VPN usually connects you to a network area, 41 00:01:58,000 --> 00:02:00,000 not necessarily to a single named app. 42 00:02:00,000 --> 00:02:03,000 That different sounds small, but it changes everything. 43 00:02:03,000 --> 00:02:06,200 Imagine you work in a large office building and need to book one meeting room. 44 00:02:06,200 --> 00:02:07,800 You show your badge at the front desk, 45 00:02:07,800 --> 00:02:09,800 and instead of receiving a pass for that room, 46 00:02:09,800 --> 00:02:12,000 you get a master key for an entire office floor. 47 00:02:12,000 --> 00:02:13,600 You may only intend to use one room, 48 00:02:13,600 --> 00:02:17,200 but still more doors are now visible and reachable than your job requires. 49 00:02:17,200 --> 00:02:19,800 A traditional VPN works the same way. 50 00:02:19,800 --> 00:02:21,800 A person who needs one file share, 51 00:02:21,800 --> 00:02:25,000 or one internal web app may receive access to a network segment 52 00:02:25,000 --> 00:02:26,600 where many other systems sit. 53 00:02:26,600 --> 00:02:30,000 Companies can limit that access with network rules, firewall rules, 54 00:02:30,000 --> 00:02:31,600 and separate VPN groups, 55 00:02:31,600 --> 00:02:34,600 but those controls become hard to manage as the number of users, apps, 56 00:02:34,600 --> 00:02:37,200 contractors, locations, and exceptions grows. 57 00:02:37,200 --> 00:02:40,000 And if a sign-in goes wrong or a device becomes compromised, 58 00:02:40,000 --> 00:02:41,800 broad access creates a bigger problem. 59 00:02:41,800 --> 00:02:45,000 An attacker who gains control of a connected device may see more systems 60 00:02:45,000 --> 00:02:48,400 than they should and more visible systems mean more places to try next. 61 00:02:48,400 --> 00:02:50,400 That's what people mean by lateral movement. 62 00:02:50,400 --> 00:02:53,200 Moving from one system to another after getting an initial way in. 63 00:02:53,200 --> 00:02:57,200 Now, the issue isn't that every VPN automatically gives access to everything. 64 00:02:57,200 --> 00:02:59,200 Well-managed VPNs can restrict access. 65 00:02:59,200 --> 00:03:02,200 The real issue is that the VPN model starts with the network, 66 00:03:02,200 --> 00:03:05,200 often asking, "has this person connected to the right network?" 67 00:03:05,200 --> 00:03:08,600 Then it uses network routes and rules to decide what happens next. 68 00:03:08,600 --> 00:03:10,600 Modern work needs a more focused question. 69 00:03:10,600 --> 00:03:12,600 Another problem is the route your traffic takes. 70 00:03:12,600 --> 00:03:15,000 Suppose you're at home and opening a cloud service. 71 00:03:15,000 --> 00:03:17,200 With a traditional full-tunnel VPN setup, 72 00:03:17,200 --> 00:03:19,200 your internet traffic might travel from your home 73 00:03:19,200 --> 00:03:22,000 to the company VPN gateway, then out to the cloud service, 74 00:03:22,000 --> 00:03:25,000 even when that service doesn't sit anywhere near the company office. 75 00:03:25,000 --> 00:03:27,200 It's like driving across town to pick up a package, 76 00:03:27,200 --> 00:03:30,400 then returning to the same area where you started before taking it home, 77 00:03:30,400 --> 00:03:32,000 and that extra trip adds delay 78 00:03:32,000 --> 00:03:35,000 and puts more pressure on the company's central VPN equipment. 79 00:03:35,000 --> 00:03:37,400 This became especially clear when remote work became normal. 80 00:03:37,400 --> 00:03:42,400 VPN systems were often designed for a smaller number of people working away from the office at the same time. 81 00:03:42,400 --> 00:03:45,800 So when large parts of a workforce needed remote access every day, 82 00:03:45,800 --> 00:03:50,600 companies had to deal with more connections, more traffic, and more support issues. 83 00:03:50,600 --> 00:03:52,200 Users felt that too. 84 00:03:52,200 --> 00:03:53,400 They had to remember to connect. 85 00:03:53,400 --> 00:03:55,600 They could lose the connection when moving between networks 86 00:03:55,600 --> 00:03:57,000 and when something didn't work. 87 00:03:57,000 --> 00:03:59,600 It wasn't always clear whether the issue involved the laptop, 88 00:03:59,600 --> 00:04:04,000 the home internet connection, the VPN, the company network, or the app itself. 89 00:04:04,000 --> 00:04:06,200 The old VPN checks you at the front gate, 90 00:04:06,200 --> 00:04:08,200 then may trust the connection too broadly. 91 00:04:08,200 --> 00:04:10,600 Modern access keeps asking more useful questions. 92 00:04:10,600 --> 00:04:11,600 Who are you? 93 00:04:11,600 --> 00:04:13,000 What device are you using? 94 00:04:13,000 --> 00:04:14,000 What are you trying to reach? 95 00:04:14,000 --> 00:04:16,800 And should you still be allowed to reach it right now? 96 00:04:16,800 --> 00:04:19,000 The core idea, identity at the center. 97 00:04:19,000 --> 00:04:22,200 So what takes the place of that old network first way of thinking? 98 00:04:22,200 --> 00:04:25,200 Microsoft Entra Global Secure Access, GSA for short, 99 00:04:25,200 --> 00:04:28,200 is Microsoft's cloud-based service that secures access 100 00:04:28,200 --> 00:04:31,000 to both private company resources and the public internet. 101 00:04:31,000 --> 00:04:33,000 That name sounds heavy, so let's make it plain. 102 00:04:33,000 --> 00:04:36,600 GSA is the security layer that decides whether you can reach a company app, 103 00:04:36,600 --> 00:04:38,200 a website, or a cloud service. 104 00:04:38,200 --> 00:04:41,200 It makes that call based on who you are, the device you use, 105 00:04:41,200 --> 00:04:43,200 and the rules your organization sets. 106 00:04:43,200 --> 00:04:45,200 GSA works with two types of destinations, 107 00:04:45,200 --> 00:04:48,400 private ones like an internal app that still lives in a company data center. 108 00:04:48,400 --> 00:04:52,200 And public ones like SaaS services, websites, and AI tools on the internet. 109 00:04:52,200 --> 00:04:55,200 It handles both, but it doesn't treat them as one big blob. 110 00:04:55,200 --> 00:04:57,400 It looks at the specific route you're asking for. 111 00:04:57,400 --> 00:05:01,000 You might also hear the term security service edge, or SSE. 112 00:05:01,000 --> 00:05:03,200 Sounds complicated, but the idea is simple. 113 00:05:03,200 --> 00:05:06,400 In the old setup, most security checking lived at company headquarters. 114 00:05:06,400 --> 00:05:09,400 Your traffic had to travel all the way back to that central location, 115 00:05:09,400 --> 00:05:11,800 so the company could inspect it and apply its rules. 116 00:05:11,800 --> 00:05:16,400 With SSE, those checks move into a cloud service that sits closer to users and cloud services. 117 00:05:16,400 --> 00:05:19,800 Think of it like moving a security desk from one distant office building 118 00:05:19,800 --> 00:05:23,000 to well-placed stations that can handle access wherever people work. 119 00:05:23,000 --> 00:05:25,000 The security rules still belong to the company, 120 00:05:25,000 --> 00:05:28,800 but where those rules are applied no longer depends only on a central office network. 121 00:05:28,800 --> 00:05:31,600 That matters because work now happens in more places, 122 00:05:31,600 --> 00:05:34,000 and company tools live in more places too. 123 00:05:34,000 --> 00:05:37,200 Underneath GSA is an approach called zero trust. 124 00:05:37,200 --> 00:05:39,200 Zero trust doesn't mean trusting nobody forever. 125 00:05:39,200 --> 00:05:44,000 It means a connection doesn't earn broad permission, just because it comes from a familiar network, 126 00:05:44,000 --> 00:05:46,400 a company location, or an encrypted tunnel. 127 00:05:46,400 --> 00:05:47,800 Every request needs context. 128 00:05:47,800 --> 00:05:51,200 The system checks your identity, your device, where policy requires it, 129 00:05:51,200 --> 00:05:52,800 and the destination you're requesting. 130 00:05:52,800 --> 00:05:54,600 This is where Microsoft Enter ID comes in. 131 00:05:54,600 --> 00:05:58,200 Think of Enter ID as the reception desk for your company's digital building. 132 00:05:58,200 --> 00:06:02,200 When you sign in, it checks your identity and knows which groups or roles that account belongs to. 133 00:06:02,200 --> 00:06:05,400 Then conditional access applies the company's access rules. 134 00:06:05,400 --> 00:06:08,000 Conditional access is the rule book at that reception desk. 135 00:06:08,000 --> 00:06:11,000 It can decide that a certain app needs more proof before you enter. 136 00:06:11,000 --> 00:06:14,600 It can require multi-factor authentication, often called MFA, 137 00:06:14,600 --> 00:06:17,400 or it can require that you use a company-managed device 138 00:06:17,400 --> 00:06:19,400 that meets the organization's security rules. 139 00:06:19,400 --> 00:06:22,600 Imagine someone in finance opening a sensitive internal finance app. 140 00:06:22,600 --> 00:06:25,800 They may already have signed into their laptop earlier that day. 141 00:06:25,800 --> 00:06:29,600 Even so, the finance app can trigger another check because the app is sensitive 142 00:06:29,600 --> 00:06:32,200 and the company wants stronger proof at that moment. 143 00:06:32,200 --> 00:06:34,800 The person receives an MFA prompt, completes it, 144 00:06:34,800 --> 00:06:37,200 and then gets access to that specific app. 145 00:06:37,200 --> 00:06:39,400 The decision follows the app and the situation. 146 00:06:39,400 --> 00:06:42,400 It isn't only tied to where the person happens to be sitting. 147 00:06:42,400 --> 00:06:44,000 That decision can change too. 148 00:06:44,000 --> 00:06:47,200 Suppose a security signal suggests the account may be at risk 149 00:06:47,200 --> 00:06:49,600 or the device no longer meets the company's rules. 150 00:06:49,600 --> 00:06:52,000 Enter can require the person to sign in again, 151 00:06:52,000 --> 00:06:54,400 ask for stronger proof, or stop access. 152 00:06:54,400 --> 00:06:57,200 The company doesn't have to wait for an old-style remote connection 153 00:06:57,200 --> 00:06:59,000 to end before it responds. 154 00:06:59,000 --> 00:07:01,800 This is the practical meaning of least privilege access. 155 00:07:01,800 --> 00:07:04,600 You get access to the app or destination you need for your job. 156 00:07:04,600 --> 00:07:07,400 You don't automatically get access to everything sitting behind it. 157 00:07:07,400 --> 00:07:08,800 For that to happen on a managed device, 158 00:07:08,800 --> 00:07:11,400 GSA uses the Global Secure Access client. 159 00:07:11,400 --> 00:07:14,400 Think of the client as a secure courier on your laptop. 160 00:07:14,400 --> 00:07:16,400 When you open something covered by GSA, 161 00:07:16,400 --> 00:07:19,000 the client sends that selected traffic through the service 162 00:07:19,000 --> 00:07:21,600 so Entra can apply the right checks behind the scenes. 163 00:07:21,600 --> 00:07:25,000 You usually don't need to decide which route to take the rules to that work. 164 00:07:25,000 --> 00:07:27,800 With that foundation in place, let's look at the first building block, 165 00:07:27,800 --> 00:07:30,600 the part that handles access to private company apps. 166 00:07:30,600 --> 00:07:33,400 Entra private access, the modern VPN replacement. 167 00:07:33,400 --> 00:07:36,200 The first building block is Microsoft Entra private access. 168 00:07:36,200 --> 00:07:39,200 This is Microsoft's Zero Trust Network Access Service. 169 00:07:39,200 --> 00:07:40,800 Often shortened to ZTNA. 170 00:07:40,800 --> 00:07:42,600 That name is long, but the job is simple. 171 00:07:42,600 --> 00:07:46,200 Private access gives you secure access to a specific company app or service 172 00:07:46,200 --> 00:07:49,000 without giving you broad access across the company network. 173 00:07:49,000 --> 00:07:52,000 Think about the kinds of tools that still sit behind company walls. 174 00:07:52,000 --> 00:07:54,000 It might be an on-premises file share. 175 00:07:54,000 --> 00:07:56,000 It could be a remote desktop system, 176 00:07:56,000 --> 00:07:58,000 used to reach a work computer or server. 177 00:07:58,000 --> 00:08:02,000 Maybe it's an internal web app for expenses, stock control or customer records. 178 00:08:02,000 --> 00:08:05,600 It could also be a business app connected to a database or a workload 179 00:08:05,600 --> 00:08:08,600 running in another cloud that the public internet can't reach. 180 00:08:08,600 --> 00:08:09,800 These are private resources. 181 00:08:09,800 --> 00:08:12,800 They aren't meant for anyone on the internet to open in a browser. 182 00:08:12,800 --> 00:08:15,800 In the old approach, you would often connect to the VPN first, 183 00:08:15,800 --> 00:08:19,200 then use the network routes available to find the resource you needed. 184 00:08:19,200 --> 00:08:20,800 Private access flips that around. 185 00:08:20,800 --> 00:08:22,800 You define the app or service a person needs. 186 00:08:22,800 --> 00:08:25,200 Then you give that person a controlled path to that app. 187 00:08:25,200 --> 00:08:27,200 Nothing else needs to come along for the ride. 188 00:08:27,200 --> 00:08:29,400 Imagine a service door inside the company building. 189 00:08:29,400 --> 00:08:31,400 It doesn't open the whole building to the street. 190 00:08:31,400 --> 00:08:34,200 Instead, it connects one approved room to a guarded route for people 191 00:08:34,200 --> 00:08:35,600 who have permission to enter. 192 00:08:35,600 --> 00:08:38,400 That service door is similar to a private access connector. 193 00:08:38,400 --> 00:08:41,800 A connector runs inside the company network close to the private apps 194 00:08:41,800 --> 00:08:45,400 and creates an outbound connection to the global secure access service. 195 00:08:45,400 --> 00:08:47,000 The connector reaches out from inside. 196 00:08:47,000 --> 00:08:50,200 That matters because the company doesn't need to put a public front door 197 00:08:50,200 --> 00:08:53,800 directly in front of the private app, just so remote users can reach it. 198 00:08:53,800 --> 00:08:57,200 Instead, the approved traffic follows the controlled route through the connector 199 00:08:57,200 --> 00:08:58,600 to the specific app. 200 00:08:58,600 --> 00:09:00,000 Let's use a contractor as an example. 201 00:09:00,000 --> 00:09:04,400 A contractor joins a project for six months and needs access to one internal project tool. 202 00:09:04,400 --> 00:09:08,000 With a broad VPN setup, somebody might add that contractor to a VPN group 203 00:09:08,000 --> 00:09:09,600 that reaches a section of the network. 204 00:09:09,600 --> 00:09:13,600 That group may work, but it can also carry more access than the contractor actually needs. 205 00:09:13,600 --> 00:09:17,600 With private access, the contractor can receive access to that one project tool. 206 00:09:17,600 --> 00:09:20,400 Not the nearby file server, not another internal website, 207 00:09:20,400 --> 00:09:23,200 not a set of systems that happen to sit on the same network. 208 00:09:23,200 --> 00:09:25,800 Just a project tool under the company's sign-in rules. 209 00:09:25,800 --> 00:09:27,800 Those rules can be different for different apps. 210 00:09:27,800 --> 00:09:29,800 Enter ID checks who the contractor is. 211 00:09:29,800 --> 00:09:33,200 Conditional access can require MFA before access to the project tool. 212 00:09:33,200 --> 00:09:36,400 The company can require a managed device, depending on its policy, 213 00:09:36,400 --> 00:09:40,600 and can also use device condition and risk signals when deciding whether access should continue. 214 00:09:40,600 --> 00:09:44,000 So the access decision is not just, is the contractor connected? 215 00:09:44,000 --> 00:09:47,600 It becomes, is this the right contractor on an accepted device 216 00:09:47,600 --> 00:09:50,600 asking for the approved app under the current conditions? 217 00:09:50,600 --> 00:09:52,600 That is much closer to how people actually work. 218 00:09:52,600 --> 00:09:54,200 You don't need access to a network. 219 00:09:54,200 --> 00:09:56,400 You need access to a tool that helps you do a job. 220 00:09:56,400 --> 00:10:00,600 For the company that can mean fewer large VPN groups and fewer hard-to-explain exceptions, 221 00:10:00,600 --> 00:10:03,000 it also creates a clearer answer when someone asks, 222 00:10:03,000 --> 00:10:05,000 "Who can reach this private resource?" 223 00:10:05,000 --> 00:10:08,000 The answer can be a named group of users and a named app, 224 00:10:08,000 --> 00:10:10,000 rather than a complicated set of network paths. 225 00:10:10,000 --> 00:10:12,800 There's another useful detail for people working inside an office. 226 00:10:12,800 --> 00:10:15,800 Sometimes you sit on the same local network as the private app you need, 227 00:10:15,800 --> 00:10:18,600 sending all of that app traffic out to the cloud and back again 228 00:10:18,600 --> 00:10:20,200 would create an unnecessary trip. 229 00:10:20,200 --> 00:10:24,000 Private access includes intelligent local access for supported situations. 230 00:10:24,000 --> 00:10:26,600 It can keep the local app traffic on the local network, 231 00:10:26,600 --> 00:10:29,200 while the identity check still goes to Microsoft Entra. 232 00:10:29,200 --> 00:10:31,200 You get the local route where it makes sense, 233 00:10:31,200 --> 00:10:33,800 while the access decision still follows the company's rules. 234 00:10:33,800 --> 00:10:37,200 Private access can modernize many VPN scenarios, but it isn't magic. 235 00:10:37,200 --> 00:10:39,200 A company still needs to understand its apps, 236 00:10:39,200 --> 00:10:41,400 the protocols those apps use, who needs access, 237 00:10:41,400 --> 00:10:42,800 which devices are involved, 238 00:10:42,800 --> 00:10:45,200 and what existing network needs must remain. 239 00:10:45,200 --> 00:10:46,200 That planning matters, 240 00:10:46,200 --> 00:10:49,400 because moving from broad network access to specific app access 241 00:10:49,400 --> 00:10:52,400 means being clear about what each person actually needs. 242 00:10:52,400 --> 00:10:56,000 Private access protects the company tools hidden behind the office walls, 243 00:10:56,000 --> 00:10:59,000 but employees also spend much of the day on websites, 244 00:10:59,000 --> 00:11:02,000 SaaS tools, cloud storage, and AI services. 245 00:11:02,000 --> 00:11:03,800 The second building block watches traffic, 246 00:11:03,800 --> 00:11:06,000 leaving the building for the public internet. 247 00:11:06,000 --> 00:11:08,400 Entra internet access, the secure web gateway, 248 00:11:08,400 --> 00:11:12,600 so the other half of global secure access is Microsoft Entra Internet access, 249 00:11:12,600 --> 00:11:14,800 the secure web gateway side of the service. 250 00:11:14,800 --> 00:11:16,400 Most people call it SBIRG. 251 00:11:16,400 --> 00:11:19,600 Private access handles company resources behind private walls, 252 00:11:19,600 --> 00:11:23,200 while internet access handles traffic going out to the public internet. 253 00:11:23,200 --> 00:11:25,000 In plain English, it's a cloud service 254 00:11:25,000 --> 00:11:28,400 that applies company security rules before users reach websites, 255 00:11:28,400 --> 00:11:30,600 SaaS apps, and other public destinations. 256 00:11:30,600 --> 00:11:31,600 Why does that matter? 257 00:11:31,600 --> 00:11:34,600 Because work doesn't happen in just one browser tab anymore. 258 00:11:34,600 --> 00:11:36,200 You might use a web browser for research. 259 00:11:36,200 --> 00:11:38,600 A desktop app could connect to a cloud service. 260 00:11:38,600 --> 00:11:40,400 Someone might open personal web mail, 261 00:11:40,400 --> 00:11:42,400 upload a document to cloud storage, 262 00:11:42,400 --> 00:11:44,800 or ask an AI tool to summarize a file. 263 00:11:44,800 --> 00:11:47,000 Each action creates a route out of the company, 264 00:11:47,000 --> 00:11:49,000 and some routes lead to harmful websites, 265 00:11:49,000 --> 00:11:51,200 while others can cause data to leave by mistake. 266 00:11:51,200 --> 00:11:52,600 Think of internet access, 267 00:11:52,600 --> 00:11:55,600 like a security checkpoint at the exit of an office building. 268 00:11:55,600 --> 00:11:58,000 People can still leave and send packages where they need to go, 269 00:11:58,000 --> 00:11:59,200 but before a package leaves, 270 00:11:59,200 --> 00:12:00,800 the checkpoint checks the destination 271 00:12:00,800 --> 00:12:02,200 and applies the company's rules. 272 00:12:02,200 --> 00:12:04,200 Is this destination known to be harmful? 273 00:12:04,200 --> 00:12:05,800 Is this service allowed for this group? 274 00:12:05,800 --> 00:12:07,400 Is this package allowed to leave at all? 275 00:12:07,400 --> 00:12:10,000 Here's the thing, that check follows the user. 276 00:12:10,000 --> 00:12:12,400 Someone working from home gets the same web rules 277 00:12:12,400 --> 00:12:14,600 as someone in a branch office or at a company desk. 278 00:12:14,600 --> 00:12:17,800 If the organization blocks a harmful website category, 279 00:12:17,800 --> 00:12:21,000 that rule doesn't disappear just because the employee is on home Wi-Fi. 280 00:12:21,000 --> 00:12:23,600 The same idea applies to SAS apps and AI services. 281 00:12:23,600 --> 00:12:26,600 A company might discover that employees use cloud tools 282 00:12:26,600 --> 00:12:28,000 nobody formally approved. 283 00:12:28,000 --> 00:12:30,000 That doesn't always mean they did something wrong. 284 00:12:30,000 --> 00:12:32,600 Often they were just trying to get work done faster. 285 00:12:32,600 --> 00:12:35,000 Still, the company needs to know which tools are in use 286 00:12:35,000 --> 00:12:37,000 before it can make a sensible choice. 287 00:12:37,000 --> 00:12:39,000 Internet access provides that visibility. 288 00:12:39,000 --> 00:12:41,800 The company can see an unapproved cloud app or AI tool 289 00:12:41,800 --> 00:12:42,800 showing up in traffic, 290 00:12:42,800 --> 00:12:44,200 then decide what to do next. 291 00:12:44,200 --> 00:12:45,600 It might allow the service, 292 00:12:45,600 --> 00:12:47,200 limit what users can do there, 293 00:12:47,200 --> 00:12:50,000 or block it because it doesn't meet security or data rules. 294 00:12:50,000 --> 00:12:52,200 That's a much more useful conversation than simply 295 00:12:52,200 --> 00:12:54,200 hoping people only use approved tools. 296 00:12:54,200 --> 00:12:55,400 Let's make this more real. 297 00:12:55,400 --> 00:12:57,400 Imagine an employee has a planning document 298 00:12:57,400 --> 00:12:59,200 and wants an AI tool to summarize it. 299 00:12:59,200 --> 00:13:01,000 They drag the file into an AI app, 300 00:13:01,000 --> 00:13:02,400 the company hasn't approved. 301 00:13:02,400 --> 00:13:04,800 If the organization uses network file filtering 302 00:13:04,800 --> 00:13:06,000 with Microsoft PerView, 303 00:13:06,000 --> 00:13:09,000 it can scan supported file types under the company's policy. 304 00:13:09,000 --> 00:13:10,800 If that planning document matches a rule, 305 00:13:10,800 --> 00:13:13,800 the upload gets blocked before the file reaches the AI service. 306 00:13:13,800 --> 00:13:15,600 The employee sees the upload failed 307 00:13:15,600 --> 00:13:18,400 and behind the scenes the company has stopped a document 308 00:13:18,400 --> 00:13:20,200 from leaving through an unapproved route. 309 00:13:20,200 --> 00:13:22,800 That isn't about blocking every new tool by default. 310 00:13:22,800 --> 00:13:24,800 It's about giving the organization a way to decide 311 00:13:24,800 --> 00:13:26,200 which data can go where. 312 00:13:26,200 --> 00:13:28,200 The rules can also change based on context. 313 00:13:28,200 --> 00:13:29,800 The same website or cloud service 314 00:13:29,800 --> 00:13:32,200 might be allowed for one group and blocked for another. 315 00:13:32,200 --> 00:13:34,600 A company managed device may receive more access 316 00:13:34,600 --> 00:13:36,000 than an unknown device, 317 00:13:36,000 --> 00:13:37,800 and a user account with a risk signal 318 00:13:37,800 --> 00:13:39,600 may face stricter rules than normal. 319 00:13:39,600 --> 00:13:41,800 That's possible because Internet access works with 320 00:13:41,800 --> 00:13:44,600 Android controls instead of treating all web traffic as identical. 321 00:13:44,600 --> 00:13:46,400 There's one technical idea worth knowing here, 322 00:13:46,400 --> 00:13:47,600 TLS inspection. 323 00:13:47,600 --> 00:13:49,200 Most web traffic is encrypted, 324 00:13:49,200 --> 00:13:50,400 and that's normally a good thing 325 00:13:50,400 --> 00:13:51,800 because it protects information 326 00:13:51,800 --> 00:13:53,200 while traveling across the Internet. 327 00:13:53,200 --> 00:13:55,200 But encryption also means a security service 328 00:13:55,200 --> 00:13:56,400 can't read the contents 329 00:13:56,400 --> 00:13:58,200 unless the organization chooses to inspect 330 00:13:58,200 --> 00:13:59,800 that traffic under its policy. 331 00:13:59,800 --> 00:14:01,400 Think of a sealed delivery box. 332 00:14:01,400 --> 00:14:03,000 You can see the address on the outside, 333 00:14:03,000 --> 00:14:05,400 but you can't check what's inside without opening it. 334 00:14:05,400 --> 00:14:06,400 TLS inspection, 335 00:14:06,400 --> 00:14:09,000 lets the organization inspect selected encrypted traffic 336 00:14:09,000 --> 00:14:11,800 so content-based checks like file filtering can happen. 337 00:14:11,800 --> 00:14:13,400 The organization then sends the traffic 338 00:14:13,400 --> 00:14:15,200 on its way if the policy allows it. 339 00:14:15,200 --> 00:14:16,600 This needs careful thought. 340 00:14:16,600 --> 00:14:19,600 The organization chooses which traffic goes through global secure access 341 00:14:19,600 --> 00:14:21,400 and how much inspection it applies, 342 00:14:21,400 --> 00:14:23,600 and those choices should match clear internal policy, 343 00:14:23,600 --> 00:14:26,600 employee expectations, and local legal requirements. 344 00:14:26,600 --> 00:14:29,600 Internet access handles the public website of the picture 345 00:14:29,600 --> 00:14:32,600 and private access handles access to private company apps. 346 00:14:32,600 --> 00:14:34,600 They can sound like two separate products, 347 00:14:34,600 --> 00:14:36,800 but the bigger idea appears when both routes 348 00:14:36,800 --> 00:14:39,200 use the same identity and policy engine. 349 00:14:39,200 --> 00:14:41,600 How the pieces work as one system. 350 00:14:41,600 --> 00:14:43,600 This is where the full picture clicks. 351 00:14:43,600 --> 00:14:45,800 Global secure access isn't one giant tunnel 352 00:14:45,800 --> 00:14:47,600 that takes all your traffic to one place. 353 00:14:47,600 --> 00:14:48,800 It's a set of guarded routes. 354 00:14:48,800 --> 00:14:51,200 Each route has a destination, a set of rules, 355 00:14:51,200 --> 00:14:53,800 and a decision about whether you should be allowed through. 356 00:14:53,800 --> 00:14:56,600 Imagine the same employee starting work on a managed laptop. 357 00:14:56,600 --> 00:14:58,800 They sign in once using their work account. 358 00:14:58,800 --> 00:15:00,800 First, they open an internal finance app 359 00:15:00,800 --> 00:15:02,400 that request goes through private access 360 00:15:02,400 --> 00:15:05,000 because the app lives inside the company's private environment. 361 00:15:05,000 --> 00:15:07,200 Later, they open a SaaS service in a browser 362 00:15:07,200 --> 00:15:08,600 and visit an AI tool. 363 00:15:08,600 --> 00:15:10,400 Those requests go through Internet access 364 00:15:10,400 --> 00:15:12,600 because the destination sit on the public Internet. 365 00:15:12,600 --> 00:15:15,400 From the employee's view, they open the tools they need. 366 00:15:15,400 --> 00:15:17,600 Behind the scenes, the traffic takes different routes 367 00:15:17,600 --> 00:15:19,800 because the destinations need different protection. 368 00:15:19,800 --> 00:15:22,400 One shared reception desk handles the identity side. 369 00:15:22,400 --> 00:15:24,000 Entra ID knows who signed in. 370 00:15:24,000 --> 00:15:26,400 Conditional access applies the company's rules. 371 00:15:26,400 --> 00:15:28,800 Global secure access then sends the traffic 372 00:15:28,800 --> 00:15:30,000 down the right-guarded route, 373 00:15:30,000 --> 00:15:32,800 whether that means a private app or an Internet destination. 374 00:15:32,800 --> 00:15:34,200 The decision doesn't start with, 375 00:15:34,200 --> 00:15:35,600 "Are you on the company network?" 376 00:15:35,600 --> 00:15:37,200 It starts with better information. 377 00:15:37,200 --> 00:15:38,200 Who is the user? 378 00:15:38,200 --> 00:15:40,400 Is the device in an accepted condition? 379 00:15:40,400 --> 00:15:42,000 Which destination are they requesting? 380 00:15:42,000 --> 00:15:44,000 Has anything changed that makes the request more risky? 381 00:15:44,000 --> 00:15:45,800 That matters after access begins too. 382 00:15:45,800 --> 00:15:47,800 Supposed the security system detects a risk 383 00:15:47,800 --> 00:15:48,800 with an employee's account. 384 00:15:48,800 --> 00:15:51,000 Maybe the sign in activity changes in a way 385 00:15:51,000 --> 00:15:52,000 that needs attention. 386 00:15:52,000 --> 00:15:53,600 Or the device reports a problem. 387 00:15:53,600 --> 00:15:55,800 Entra can react while the person is working. 388 00:15:55,800 --> 00:15:57,400 It may ask for another sign in check, 389 00:15:57,400 --> 00:15:58,800 "Require a stronger proof" 390 00:15:58,800 --> 00:16:01,000 or stop the route to the protected destination 391 00:16:01,000 --> 00:16:02,000 near real time. 392 00:16:02,000 --> 00:16:04,800 Other Microsoft tools contribute useful signals here. 393 00:16:04,800 --> 00:16:07,800 Intune reports whether the device meets the company's device rules. 394 00:16:07,800 --> 00:16:10,800 Defender reports, threats found on the device or account. 395 00:16:10,800 --> 00:16:12,800 Pervue helps protect sensitive files 396 00:16:12,800 --> 00:16:15,200 when users try to move them to cloud destinations. 397 00:16:15,200 --> 00:16:18,200 None of these tools work as separate islands in this scenario. 398 00:16:18,200 --> 00:16:20,600 They feed information into the access decision. 399 00:16:20,600 --> 00:16:23,800 The older model builds one trusted tunnel into the network 400 00:16:23,800 --> 00:16:25,600 and tries to control everything from there. 401 00:16:25,600 --> 00:16:27,600 The newer model creates controlled paths 402 00:16:27,600 --> 00:16:30,600 to each approved destination using identity and context 403 00:16:30,600 --> 00:16:32,000 to decide what happens along the way. 404 00:16:32,000 --> 00:16:33,400 With the full system in view, 405 00:16:33,400 --> 00:16:36,000 don't try to replace every connection at once. 406 00:16:36,000 --> 00:16:37,800 Start with just one VPN use case. 407 00:16:37,800 --> 00:16:40,200 Pick one user group, one private app, 408 00:16:40,200 --> 00:16:41,800 and one clear business need. 409 00:16:41,800 --> 00:16:43,400 Then ask three plain English questions 410 00:16:43,400 --> 00:16:46,600 who needs this app, what exact app or service do they need, 411 00:16:46,600 --> 00:16:48,600 and what sign-in or device checks should apply 412 00:16:48,600 --> 00:16:50,000 before they get access. 413 00:16:50,000 --> 00:16:53,400 A focused private access pilot is your practical first step. 414 00:16:53,400 --> 00:16:56,200 After that, look at Internet Access for Web, SAS, and AI traffic. 415 00:16:56,200 --> 00:16:59,200 Bring your identity, network, device, and data protection teams 416 00:16:59,200 --> 00:17:00,400 into the conversation early 417 00:17:00,400 --> 00:17:03,400 because each team owns part of the access decision. 418 00:17:03,400 --> 00:17:05,600 Remember, access should follow the work 419 00:17:05,600 --> 00:17:07,000 not the network. 420 00:17:07,000 --> 00:17:09,200 Global secure access replaces broad tunnels 421 00:17:09,200 --> 00:17:10,400 with controlled routes. 422 00:17:10,400 --> 00:17:13,200 Start with one app, then subscribe to M365, 423 00:17:13,200 --> 00:17:15,800 EdFam, and share this with someone starting their journey. 424 00:17:15,800 --> 00:17:18,800 I'm Mirko Peters, and this has been another knowledge nugget.