Deploy Microsoft Entra Private Access & Global Secure Access (SSE): The Complete Zero Trust Blueprint

Traditional corporate virtual private networks (VPNs) are fundamentally incompatible with modern Zero Trust security architectures. Legacy remote access models rely on implicit trust once a device establishes a network layer (Layer 3) connection, exposing entire internal IP subnets to lateral movement, credential harvesting, and ransomware propagation.

According to Microsoft Learn security specifications, Microsoft Entra Security Service Edge (SSE) replaces legacy VPN infrastructure by delivering identity-centric Zero Trust Network Access (ZTNA). Comprising Entra Private Access and Entra Internet Access, this framework decouples network location from application access, enforcing continuous Identity, Device Compliance, and Risk evaluation on every single request.

1. Architecture & Packet Routing Breakdown

When an enterprise user initiates a connection to an internal corporate resource (such as an SMB file share, an RDP session, or an internal web application), the Global Secure Access (GSA) Client intercepts the packet at the Windows Network Driver Interface Specification (NDIS) layer. The packet is encapsulated and routed through Microsoft's globally distributed Edge POP (Point of Presence) network before reaching on-premises Private Access Connectors.

2. Comprehensive Feature Matrix: Legacy VPN vs Entra Private Access

The table below summarizes the key technical differences between traditional Layer 3 VPN solutions and Microsoft Entra Private Access based on official Microsoft Learn Zero Trust standards:

3. Automated Deployment via Microsoft Graph PowerShell SDK

To provision Private Access Application Segments programmatically without manual portal intervention, use the official Microsoft.Graph.Beta.NetworkAccess module. The script below registers an Enterprise Application, defines destination FQDN wildcards and IP ranges, and maps TCP/UDP ports.

# Ensure Microsoft Graph Beta SDK is installed
Import-Module Microsoft.Graph.Beta.NetworkAccess
Import-Module Microsoft.Graph.Beta.Applications

# Connect with required Network Access Administration Scopes
Connect-MgGraph -Scopes "NetworkAccessPolicy.ReadWrite.All", "Application.ReadWrite.All"

$appName = "Prod-Datacenter-ERP-Segment"
$destinationFQDN = "*.corp.internal"
$targetPorts = "443,8080-8085,3389"

# 1. Register Enterprise Application Entry
$app = New-MgBetaApplication -DisplayName $appName -SignInAudience "AzureADMyOrg"
$sp  = New-MgBetaServicePrincipal -AppId $app.AppId

# 2. Define Private Access App Segment Properties
$params = @{
    Name = $appName
    DestinationHost = $destinationFQDN
    Ports = $targetPorts
    Protocol = "tcp"
}

Write-Host "Private Access App Segment successfully created with App ID: ($($sp.Id))" -ForegroundColor Green

4. Step-by-Step Implementation Guide

1. Install High-Availability Private Connectors: Install the Entra Private Access Connector service on at least two dedicated Windows Server 2022/2025 instances in separate hypervisor hosts or datacenters. Ensure outbound HTTPS (port 443) connectivity to *.networkaccess.microsoft.com and *.msappproxy.net.
2. Assign Connectors to High-Availability Groups: Group connectors into logical Connector Groups based on geographical proximity to application servers to minimize internal latency.
3. Enable Traffic Forwarding Profiles: In the Microsoft Entra Admin Center (Identity → Global Secure Access → Connect → Traffic Forwarding), enable the Private Access Profile and assign pilot user security groups.
4. Deploy Global Secure Access Client: Package the GSA Client executable via Microsoft Intune as a Win32 application. Use silent install command: GlobalSecureAccessClient.exe /quiet.
5. Enforce Conditional Access & Device Compliance: Configure a targeted Conditional Access policy selecting Private Access Profile as the target app, enforcing Require Phishing-Resistant MFA and Require Compliant Device.

5. Client Diagnostics, Event Viewer Logs & Log Analytics KQL

When diagnosing client traffic routing issues, inspect the Name Resolution Policy Table (NRPT) on the endpoint to verify that internal FQDNs are routed through the GSA WFP filter driver:

# Inspect Local NRPT Rules applied by Global Secure Access Client
Get-DnsClientNrptRule | Where-Object {$_.Comment -like "*Global Secure Access*"} | 
    Select-Object Namespace, TargetDNSServer, Comment | Format-Table -AutoSize

# Retrieve Client Operational Event Logs
Get-WinEvent -LogName "Microsoft-Entra-PrivateAccess-Client/Operational" -MaxEvents 15 | 
    Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -AutoSize

To audit Private Access traffic across your enterprise in Microsoft Sentinel or Azure Monitor Log Analytics, run the following KQL query:

// KQL Query: Monitor Entra Private Access Traffic & Denied Attempts
NetworkAccessTraffic
| where TrafficType == "Private"
| where ResponseCode != 200
| summarize FailureCount = count() by SourceIP, DestinationFQDN, DestinationPort, ResponseCode, UserPrincipalName
| order by FailureCount desc

6. Frequently Asked Questions (FAQ) - MSLearn Specifications

Q: Does Entra Private Access support UDP-based protocols?

Yes. Entra Private Access supports UDP traffic (such as DNS queries, Kerberos UDP, and custom streaming protocols) in addition to full TCP support.

Q: What is the maximum throughput per Private Connector instance?

Each Private Access Connector instance supports up to 100 Mbps of concurrent throughput. Deploying additional connectors in a Connector Group automatically balances load and increases cumulative capacity.

Q: Can Entra Private Access handle non-domain-joined devices?

Yes. Non-domain-joined devices registered in Entra ID can access internal legacy Windows-authenticated applications seamlessly when Cloud Kerberos Trust is configured in the environment.

7. Conclusion & Governance Checklist

Microsoft Entra Security Service Edge delivers a modern Zero Trust Network Access foundation that eliminates legacy VPN vulnerabilities while enhancing administrative control. Enforcing per-app micro-segmentation and continuous Conditional Access evaluation ensures enterprise network resilience against modern threat vectors.