Secure access service edge combines networking and cloud-delivered security. Security service edge is the security portion of that architecture. Global Secure Access brings together Entra Private Access and Entra Internet Access; it does not replace every networking component.
Separate entitlement from connectivity.
Identity governance determines who should receive access and when it should be reviewed or removed. Connection policies evaluate the user, device, and other supported signals when accessing a resource. The application still decides what an authorized connection can do inside the service.
Entra ID Governance, Conditional Access, and Global Secure Access therefore address related but different parts of the access path. A complete design makes their responsibilities explicit instead of expecting one control to replace all the others.
Compare private and internet access.
Entra Private Access supports resource-specific connectivity to approved private applications. It can reduce broad network exposure for supported use cases. Entra Internet Access provides secure web gateway capabilities for supported internet and cloud-service traffic, with policy and routing requirements of its own.
Client support, connector placement, traffic forwarding, authentication, and application protocols all affect the design. Security service edge capabilities contribute to a wider architecture but do not supply every routing, connectivity, or availability function an organization may need.
Example: an external project worker.
A contractor may need one private application for a limited engagement. Identity governance can support sponsored, time-bound entitlement. Private Access can provide the supported connection path, while application permissions limit the records and operations available after sign-in.
Internet-access policy may separately govern the worker's supported web traffic. Ending the engagement must remove effective access, not just update an inventory. Test entitlement removal, existing sessions, application authorization, and any remaining alternate connection paths.
Prove replacement before retiring access.
Inventory existing virtual private network use, including service traffic and site-to-site dependencies. Validate normal operation, denied access, connector failure, client issues, and emergency recovery. Migrate eligible applications in stages and keep explicit treatment for unsupported scenarios. Licensing, network design, and operational support determine which legacy routes can safely be removed.
Further reading
For the relationship between identity governance, private access, web protection, and staged virtual private network replacement, read Global Secure Access.