In short: Microsoft Entra Internet Access is Microsoft's identity-centric secure web gateway, part of Global Secure Access alongside Entra Private Access. Traffic from the Global Secure Access client is filtered by web category and domain, with conditional access, threat intelligence and TLS inspection. A Microsoft-traffic-only profile is included with Entra ID P1 and P2.
What Microsoft Entra Internet Access is
Microsoft Entra Internet Access is the internet-facing half of Global Secure Access, which Microsoft describes as its security service edge (SSE). The other half is Microsoft Entra Private Access, which replaces the VPN for private applications. Both are managed from the Global Secure Access area of the Microsoft Entra admin centre and delivered from Microsoft's global wide area network, with points of presence around the world. Microsoft positions them alongside Microsoft Defender for Cloud Apps, its CASB, as one SSE solution.
What makes it different from a traditional secure web gateway is that policy is built on Microsoft Entra ID. The same signals that drive conditional access for Microsoft 365, such as user, group, device compliance, location and sign-in risk, decide what each person can reach on the web.
How it works: the client and traffic profiles
Traffic reaches the service in one of two ways: the Global Secure Access client, available for Windows, macOS, iOS and Android, or a remote network connection, where a branch office router or firewall builds an IPsec tunnel to Microsoft. Which traffic is sent depends on the traffic forwarding profiles you enable, which can be assigned to particular users, groups, devices and device platforms:
| Traffic profile | What it carries | Licence |
|---|---|---|
| Microsoft traffic profile | Traffic to supported Microsoft services such as Microsoft Teams, Exchange Online and SharePoint Online, from the client or a remote network | Included with Microsoft Entra ID P1 or P2 (Microsoft Entra Internet Access for Microsoft services) |
| Internet access traffic profile | General internet and SaaS traffic, forwarded by the client | Microsoft Entra Internet Access, standalone or in the Microsoft Entra Suite |
| Private access traffic profile | Traffic to private apps and networks, forwarded by the client | Microsoft Entra Private Access, standalone or in the Microsoft Entra Suite |
The internet access profile does not cover destinations already in the Microsoft traffic profile, so Microsoft advises enabling both for complete coverage. Remote network (branch) connectivity currently carries Microsoft traffic, with internet traffic over remote networks listed by Microsoft as coming soon, and it needs a combined total of at least 50 Entra ID P1 and Internet Access licences, so very small estates usually rely on the client alone.
What you get with the Microsoft traffic profile (Entra ID P1)
This is the part many organisations already own without realising. Any tenant with Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium and E3, can use the Microsoft traffic profile to:
- Require a compliant network in conditional access, so Microsoft 365 can only be reached through the Global Secure Access client or your branch tunnel, which makes stolen tokens harder to replay from elsewhere
- Apply universal tenant restrictions, blocking sign-in to other organisations' tenants and personal accounts to reduce data leaking out
- Restore the user's original source IP address in Entra sign-in logs, which improves risk detection and named-location policies
- View enriched traffic logs for Microsoft 365 activity
It is a sensible first step in a Microsoft-centred zero trust plan even if you never buy the full product.
Full Internet Access: the secure web gateway features
With a Microsoft Entra Internet Access licence, the internet traffic profile adds the secure web gateway capabilities. Microsoft's current feature list includes:
- Web content filtering by category and by fully qualified domain name, with allow and block rules applied to groups through security profiles
- Universal conditional access for all internet destinations, including apps that are not federated with Entra ID
- Threat intelligence filtering to block known malicious destinations
- TLS inspection, so encrypted traffic can be inspected, with a certificate deployed to devices
- Data loss prevention for network traffic, and shadow AI discovery to see which generative AI apps are in use
- Traffic logs and dashboards, showing which users and devices reach which destinations and how policy was applied
- Prompt injection protection for AI traffic
- Universal continuous access evaluation, so revoking a session or a risky sign-in takes effect quickly
- Network controls for AI agents, which Microsoft lists as needing a separate Microsoft Agent 365 licence
Some of these capabilities are newer than others, so we check what is generally available in your tenant before designing policy. For AI-specific controls, see securing staff use of generative AI.
Licensing in general terms
Microsoft Entra Internet Access is licensed per user, like most Global Secure Access services. It is available standalone or as part of the Microsoft Entra Suite, which also contains Entra Private Access, ID Protection, ID Governance and Verified ID. Users need Microsoft Entra ID P1 or P2 as a prerequisite; see Microsoft Entra ID P1 and P2 compared.
For commercial advice on Microsoft agreements and bundles, Forever Group's Microsoft licensing team can help. Pricing depends on your agreement, so ask us for a quote.
When it is enough, and when a third-party SWG fits better
| Entra Internet Access is a good fit when | A third-party SWG may fit better when |
|---|---|
| You are standardised on Microsoft 365 and Entra ID | You use another identity provider or several |
| You want web policy driven by conditional access and device compliance | You need very granular app controls or full-featured sandboxing |
| Your devices are managed with Intune | Many users are on unmanaged or shared devices |
| You already plan to buy the Microsoft Entra Suite | You need school safeguarding reporting aligned to DfE standards |
| You want one admin centre for identity and network access | You need a full SASE with SD-WAN from one vendor |
Microsoft designed Global Secure Access to run side by side with other SSE products, so a mixed approach is possible: for example, the Microsoft traffic profile for Microsoft 365 and a third-party SWG for general web traffic. Compare the alternatives on our secure web gateway and DNS filtering pages, or contact us to plan a pilot.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Microsoft Entra Internet Access included in Business Premium?
Partly. Business Premium includes Entra ID P1, which covers the Microsoft traffic profile: compliant network checks, universal tenant restrictions and source IP restoration for Microsoft services. The full secure web gateway for general internet traffic needs a Microsoft Entra Internet Access or Microsoft Entra Suite licence.
What is Global Secure Access?
Global Secure Access is Microsoft's umbrella name for Microsoft Entra Internet Access and Microsoft Entra Private Access, which together form Microsoft's security service edge. It is also the area of the Microsoft Entra admin centre where both are configured.
Does Entra Internet Access need an agent?
Users connect through the Global Secure Access client on Windows, macOS, iOS and Android. Branch offices can send Microsoft traffic over an IPsec tunnel from a router or firewall using the remote network feature; Microsoft lists internet traffic over remote networks as coming soon, so general web filtering currently relies on the client.
Does Entra Internet Access support TLS inspection?
Yes. Microsoft lists TLS inspection among the Internet Access features. It requires a certificate trusted by your devices, usually deployed with Intune, and sensible exclusions for sensitive categories.
Can I use Entra Internet Access alongside another web gateway?
Yes. Microsoft supports running Global Secure Access side by side with other SSE products, so you can, for example, use the Microsoft traffic profile for Microsoft 365 while another provider filters general web traffic.