In short: Microsoft Entra Private Access is Microsoft's zero trust network access (ZTNA) service. Remote users reach private apps and servers through the Global Secure Access client and a private network connector inside your network, with no VPN and no inbound ports. Access is controlled by Entra conditional access, so MFA and device compliance apply even to legacy apps.
What Microsoft Entra Private Access is
Microsoft Entra Private Access is the private-app half of Global Secure Access, Microsoft's security service edge; the internet half is Microsoft Entra Internet Access. It builds on Microsoft Entra application proxy, which has published on-premises web apps for years, and extends it to any TCP or UDP application, port and protocol.
That means the things people actually use the VPN for, such as mapped drives, RDP to servers, SSH, and thick-client finance or practice management systems, can be reached through a zero trust model instead. It is Microsoft's answer to the ZTNA category.
How it works: connectors and the client
There are three moving parts:
- The Global Secure Access client on Windows, macOS, iOS or Android, which captures traffic destined for the private resources you define and sends it to Microsoft's network
- The Microsoft Entra private network connector, a lightweight agent installed on a Windows Server (2016 or later) inside your network or cloud virtual network, which connects outbound to Microsoft and brokers sessions to the internal resource. Connectors are organised into connector groups, each serving particular applications
- Microsoft Entra ID, which authenticates the user and evaluates conditional access before any connection is made
Because the connector only makes outbound connections, over ports 80 and 443, you do not open inbound firewall ports, and the internal application is never exposed directly to the internet. Microsoft suggests more than one connector server for high availability; if a connector is unavailable, new requests go to the other healthy connectors in its group, which also makes patching easier. For workloads in Azure, Microsoft also offers a marketplace image with the connector pre-installed, currently in preview.
Intelligent Local Access lets the client detect, using DNS probes, when a user is on the corporate network and reach chosen Quick Access or per-app resources directly, avoiding the round trip through the cloud while keeping a consistent security posture. Private DNS resolves internal names, and Kerberos single sign-on across private apps keeps the experience seamless for Active Directory resources.
Quick Access vs per-app access
Private Access offers two ways to define what is reachable, and most deployments use both in sequence.
| Quick Access | Per-app access (Global Secure Access apps) | |
|---|---|---|
| What you define | The main set of internal FQDNs, IP addresses and ranges you always want to tunnel | Specific apps or subsets of resources, each as its own enterprise application |
| Policy granularity | One set of conditional access policies for everything in Quick Access | Different conditional access policies, users and groups per app |
| Best for | Fast VPN replacement during a pilot or first phase | Least-privilege access once you know what is used |
| Typical example | An internal address range and the internal domain name | The finance server only for the finance group, with MFA and a compliant device |
App Discovery shows which private resources users actually reach through Quick Access, which makes it much easier to carve out per-app rules later.
Conditional access and MFA for legacy apps
The most valuable feature is often the simplest: an old on-premises application that only understands a username and password can now sit behind Entra conditional access. You can require:
- Phishing-resistant MFA or a specific authentication strength for sensitive apps
- A compliant or hybrid-joined device, managed through Microsoft Intune
- Low sign-in risk, using Entra ID Protection where licensed
- Specific users and groups per app, with access reviews if you have Entra ID Governance
Universal continuous access evaluation means that if a user is disabled or their risk changes, access is cut quickly rather than at the next token refresh. For identity design, see identity security and Microsoft Entra ID P1 and P2 compared.
Migrating from a VPN to Entra Private Access
- Prepare identity: confirm users are in Entra ID with MFA registered, and that devices are managed and compliant.
- Install connectors on at least two Windows servers per site, in a connector group that can reach the internal resources, and allow their outbound HTTPS traffic without TLS inspection, as Microsoft advises.
- Configure Quick Access with the internal ranges and domains the VPN serves today, assigned to a pilot group.
- Deploy the client to pilot devices through Intune, and enable the private access traffic profile.
- Watch and refine: use App Discovery and traffic logs to identify each real application, then create per-app access apps with tighter policies.
- Expand in waves by department, keep the VPN available as a fallback, then remove VPN access group by group and decommission the gateway.
Private Access can run alongside third-party SSE products during the transition, which helps if you are moving away from another vendor.
Licensing and how it compares
Microsoft Entra Private Access is licensed per user, standalone or within the Microsoft Entra Suite, and users need Entra ID P1 or P2. For commercial advice see Forever Group's Microsoft licensing team; pricing depends on your agreement, so ask us for a quote.
| Consider Entra Private Access if | Consider another ZTNA if |
|---|---|
| Entra ID is your identity provider and devices are in Intune | You use another identity provider or have many unmanaged devices |
| You want access policy in the same place as Microsoft 365 policy | You need agentless browser access for many contractors |
| You are buying the Microsoft Entra Suite anyway | You want ZTNA bundled with SD-WAN, endpoint or SIEM from one vendor |
| Your private apps are mainly on Windows networks and Azure | You also need microsegmentation inside the network |
Alternatives include Zero Networks, NordLayer, Sophos ZTNA and Cisco Secure Access. We help you compare them, run a pilot and migrate. Contact us to plan your VPN replacement.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Can Microsoft Entra Private Access replace our VPN?
For most organisations, yes. It supports TCP and UDP applications, including file shares, RDP, SSH and client-server apps, through Quick Access and per-app access. We usually migrate in phases, keeping the VPN as a fallback until usage reaches zero.
What is the difference between Quick Access and per-app access?
Quick Access is one broad set of internal addresses and domains with a single set of conditional access policies, ideal for a fast first phase. Per-app access defines individual applications, each with its own users and conditional access policies, for least-privilege access.
Do I need to open firewall ports for Entra Private Access?
No inbound ports are needed. The private network connector installed inside your network makes outbound connections to Microsoft and brokers sessions to internal resources, so the applications are not exposed to the internet.
Is Entra Private Access included in Microsoft 365 Business Premium?
No. Business Premium includes Entra ID P1, which is the prerequisite, but Private Access is licensed separately, either standalone or as part of the Microsoft Entra Suite.
How is Entra Private Access different from Entra application proxy?
Application proxy publishes on-premises web applications. Private Access builds on the same connector technology but extends access to any TCP or UDP application, port and protocol, with the Global Secure Access client and conditional access.