Microsoft Entra Global Secure Access Now Unified

Introduction

Microsoft is simplifying how organizations adopt Secure Access Service Edge (SASE) with a new purchasing option for Microsoft Entra Global Secure Access. Starting November 2, 2026, customers can buy Entra Private Access and Entra Internet Access together under one offering, making it easier to deploy identity-aware access controls across private, internet, SaaS, and AI-driven traffic.

This is not a new product. Instead, it is a packaging and licensing update that matters for IT teams looking to streamline Zero Trust access and reduce policy fragmentation.

What’s new

• Single offering for Private Access and Internet Access

  • Organizations can now purchase both capabilities together as Microsoft Entra Global Secure Access.
  • Both products remain available individually.

• Unified identity-aware access fabric

  • Uses existing Microsoft Entra users, groups, apps, and Conditional Access policies.
  • Eliminates the need to sync identities and maintain separate policy sets across networking and identity tools.

• Continuous enforcement beyond sign-in

  • Universal Continuous Access Evaluation (CAE) reevaluates access in near real time when device compliance or user risk changes.
  • Applies to destinations even if the app itself does not support CAE.

• Coverage for AI agents

  • The same identity-aware controls now extend to AI agents acting on behalf of users, not just human traffic.

Recent capabilities highlighted by Microsoft

Microsoft also outlined several newly shipped or previewed features:

• Cloud Firewall for client for broader TCP/UDP traffic control
• Continue default action for more flexible web filtering policy layering
• Home Network Support for Private Access
• Entra Health and Alerts for monitoring and troubleshooting
• Multiple Traffic Forwarding Profiles for phased deployments
• TLS inspection with Microsoft-managed certificates
• Custom headers for Internet Access
• Microsoft Purview integration for network-layer data protection, including risky AI destinations
• Smart Load Balancing with Session Affinity for Private Network Connector
• New device and risk signals for Universal CAE

Impact on IT administrators

For Entra and security admins, the biggest benefit is operational simplicity. Teams can apply the same Conditional Access framework across private apps, internet traffic, SaaS, and AI usage without managing disconnected policy engines.

This should also help organizations strengthen Zero Trust posture by enforcing access decisions continuously based on identity, device state, and risk. For businesses evaluating Microsoft 365 E7 or the Microsoft Entra Suite, this bundled approach may also simplify licensing decisions.

Next steps

• Review whether your organization currently licenses Entra Private Access and Entra Internet Access separately.
• Evaluate whether the new bundled offering better fits your Zero Trust and SASE roadmap.
• Assess new preview features such as Cloud Firewall for client and TLS inspection for pilot use.
• Confirm Conditional Access, device compliance, and risk policies are ready to support continuous access enforcement.

For organizations standardizing on Microsoft security and identity, this update makes Entra Global Secure Access easier to adopt as a unified access layer.