Global Secure Access - Simply Explained

1
00:00:00,000 --> 00:00:03,400
Imagine you're sitting in a coffee shop with your work laptop needing one thing,

2
00:00:03,400 --> 00:00:07,100
an internal finance app that only works from inside the company network.

3
00:00:07,100 --> 00:00:09,900
So you start the old VPN, wait for it to connect,

4
00:00:09,900 --> 00:00:12,900
and then you're effectively through the front door of the company building.

5
00:00:12,900 --> 00:00:14,500
That probably sounds normal, right?

6
00:00:14,500 --> 00:00:16,000
But think about what just happened.

7
00:00:16,000 --> 00:00:20,500
You needed one room, yet the VPN gives your device a root into a much larger part of the building,

8
00:00:20,500 --> 00:00:23,100
like asking reception for access to one meeting room,

9
00:00:23,100 --> 00:00:25,600
then getting a master key for most of the floor.

10
00:00:25,600 --> 00:00:28,500
That old way made sense when nearly everyone worked in one office,

11
00:00:28,500 --> 00:00:32,500
company apps lived in one data center, and the network itself felt like a safe place.

12
00:00:32,500 --> 00:00:34,500
But work doesn't look like that anymore.

13
00:00:34,500 --> 00:00:37,900
People work from home, airports, customer sites, and coffee shops.

14
00:00:37,900 --> 00:00:40,500
Some company apps still sit in an office or data center,

15
00:00:40,500 --> 00:00:43,100
while other tools live in the cloud, and every browser,

16
00:00:43,100 --> 00:00:47,600
Sass app, file sharing site, and AI tool creates another route where company data could leave.

17
00:00:47,600 --> 00:00:50,700
So what exactly is Microsoft, Entra, global, secure access?

18
00:00:50,700 --> 00:00:52,100
Is it just a new VPN?

19
00:00:52,100 --> 00:00:54,300
No, it's a different way to think about access.

20
00:00:54,300 --> 00:00:56,800
Global secure access, often shortened to GSA,

21
00:00:56,800 --> 00:01:00,200
helps the company give you a checked pass to the exact place you need to reach,

22
00:01:00,200 --> 00:01:04,400
instead of treating a VPN connection like permission to enter a broad part of the network.

23
00:01:04,400 --> 00:01:09,400
By the end of this knowledge nugget, you'll understand why the old VPN models struggles with modern work,

24
00:01:09,400 --> 00:01:12,200
how identity moves to the center of the decision,

25
00:01:12,200 --> 00:01:14,400
and how Microsoft entra private access,

26
00:01:14,400 --> 00:01:17,400
and Microsoft entra internet access fit together.

27
00:01:17,400 --> 00:01:19,000
We'll start with the old model first,

28
00:01:19,000 --> 00:01:23,200
because the new model makes far more sense once you see the problem it tries to fix.

29
00:01:23,200 --> 00:01:26,000
Why traditional VPNs no longer fit?

30
00:01:26,000 --> 00:01:28,200
A traditional VPN has a simple job.

31
00:01:28,200 --> 00:01:33,000
It creates an encrypted tunnel from your remote device back into the company network.

32
00:01:33,000 --> 00:01:36,200
Picture an employee working from home who needs to open a file share,

33
00:01:36,200 --> 00:01:37,600
connect to a remote desktop,

34
00:01:37,600 --> 00:01:41,200
or use an internal finance app that isn't available on the public internet.

35
00:01:41,200 --> 00:01:44,200
The VPN gives that employee a protected route back to the company

36
00:01:44,200 --> 00:01:46,200
for years that solved a real problem.

37
00:01:46,200 --> 00:01:49,200
Your traffic crossed the internet inside an encrypted tunnel

38
00:01:49,200 --> 00:01:52,800
and the company could treat your laptop more like it was sitting in the office.

39
00:01:52,800 --> 00:01:54,400
But here's where the trouble starts.

40
00:01:54,400 --> 00:01:58,000
After the tunnel connects, a VPN usually connects you to a network area,

41
00:01:58,000 --> 00:02:00,000
not necessarily to a single named app.

42
00:02:00,000 --> 00:02:03,000
That different sounds small, but it changes everything.

43
00:02:03,000 --> 00:02:06,200
Imagine you work in a large office building and need to book one meeting room.

44
00:02:06,200 --> 00:02:07,800
You show your badge at the front desk,

45
00:02:07,800 --> 00:02:09,800
and instead of receiving a pass for that room,

46
00:02:09,800 --> 00:02:12,000
you get a master key for an entire office floor.

47
00:02:12,000 --> 00:02:13,600
You may only intend to use one room,

48
00:02:13,600 --> 00:02:17,200
but still more doors are now visible and reachable than your job requires.

49
00:02:17,200 --> 00:02:19,800
A traditional VPN works the same way.

50
00:02:19,800 --> 00:02:21,800
A person who needs one file share,

51
00:02:21,800 --> 00:02:25,000
or one internal web app may receive access to a network segment

52
00:02:25,000 --> 00:02:26,600
where many other systems sit.

53
00:02:26,600 --> 00:02:30,000
Companies can limit that access with network rules, firewall rules,

54
00:02:30,000 --> 00:02:31,600
and separate VPN groups,

55
00:02:31,600 --> 00:02:34,600
but those controls become hard to manage as the number of users, apps,

56
00:02:34,600 --> 00:02:37,200
contractors, locations, and exceptions grows.

57
00:02:37,200 --> 00:02:40,000
And if a sign-in goes wrong or a device becomes compromised,

58
00:02:40,000 --> 00:02:41,800
broad access creates a bigger problem.

59
00:02:41,800 --> 00:02:45,000
An attacker who gains control of a connected device may see more systems

60
00:02:45,000 --> 00:02:48,400
than they should and more visible systems mean more places to try next.

61
00:02:48,400 --> 00:02:50,400
That's what people mean by lateral movement.

62
00:02:50,400 --> 00:02:53,200
Moving from one system to another after getting an initial way in.

63
00:02:53,200 --> 00:02:57,200
Now, the issue isn't that every VPN automatically gives access to everything.

64
00:02:57,200 --> 00:02:59,200
Well-managed VPNs can restrict access.

65
00:02:59,200 --> 00:03:02,200
The real issue is that the VPN model starts with the network,

66
00:03:02,200 --> 00:03:05,200
often asking, "has this person connected to the right network?"

67
00:03:05,200 --> 00:03:08,600
Then it uses network routes and rules to decide what happens next.

68
00:03:08,600 --> 00:03:10,600
Modern work needs a more focused question.

69
00:03:10,600 --> 00:03:12,600
Another problem is the route your traffic takes.

70
00:03:12,600 --> 00:03:15,000
Suppose you're at home and opening a cloud service.

71
00:03:15,000 --> 00:03:17,200
With a traditional full-tunnel VPN setup,

72
00:03:17,200 --> 00:03:19,200
your internet traffic might travel from your home

73
00:03:19,200 --> 00:03:22,000
to the company VPN gateway, then out to the cloud service,

74
00:03:22,000 --> 00:03:25,000
even when that service doesn't sit anywhere near the company office.

75
00:03:25,000 --> 00:03:27,200
It's like driving across town to pick up a package,

76
00:03:27,200 --> 00:03:30,400
then returning to the same area where you started before taking it home,

77
00:03:30,400 --> 00:03:32,000
and that extra trip adds delay

78
00:03:32,000 --> 00:03:35,000
and puts more pressure on the company's central VPN equipment.

79
00:03:35,000 --> 00:03:37,400
This became especially clear when remote work became normal.

80
00:03:37,400 --> 00:03:42,400
VPN systems were often designed for a smaller number of people working away from the office at the same time.

81
00:03:42,400 --> 00:03:45,800
So when large parts of a workforce needed remote access every day,

82
00:03:45,800 --> 00:03:50,600
companies had to deal with more connections, more traffic, and more support issues.

83
00:03:50,600 --> 00:03:52,200
Users felt that too.

84
00:03:52,200 --> 00:03:53,400
They had to remember to connect.

85
00:03:53,400 --> 00:03:55,600
They could lose the connection when moving between networks

86
00:03:55,600 --> 00:03:57,000
and when something didn't work.

87
00:03:57,000 --> 00:03:59,600
It wasn't always clear whether the issue involved the laptop,

88
00:03:59,600 --> 00:04:04,000
the home internet connection, the VPN, the company network, or the app itself.

89
00:04:04,000 --> 00:04:06,200
The old VPN checks you at the front gate,

90
00:04:06,200 --> 00:04:08,200
then may trust the connection too broadly.

91
00:04:08,200 --> 00:04:10,600
Modern access keeps asking more useful questions.

92
00:04:10,600 --> 00:04:11,600
Who are you?

93
00:04:11,600 --> 00:04:13,000
What device are you using?

94
00:04:13,000 --> 00:04:14,000
What are you trying to reach?

95
00:04:14,000 --> 00:04:16,800
And should you still be allowed to reach it right now?

96
00:04:16,800 --> 00:04:19,000
The core idea, identity at the center.

97
00:04:19,000 --> 00:04:22,200
So what takes the place of that old network first way of thinking?

98
00:04:22,200 --> 00:04:25,200
Microsoft Entra Global Secure Access, GSA for short,

99
00:04:25,200 --> 00:04:28,200
is Microsoft's cloud-based service that secures access

100
00:04:28,200 --> 00:04:31,000
to both private company resources and the public internet.

101
00:04:31,000 --> 00:04:33,000
That name sounds heavy, so let's make it plain.

102
00:04:33,000 --> 00:04:36,600
GSA is the security layer that decides whether you can reach a company app,

103
00:04:36,600 --> 00:04:38,200
a website, or a cloud service.

104
00:04:38,200 --> 00:04:41,200
It makes that call based on who you are, the device you use,

105
00:04:41,200 --> 00:04:43,200
and the rules your organization sets.

106
00:04:43,200 --> 00:04:45,200
GSA works with two types of destinations,

107
00:04:45,200 --> 00:04:48,400
private ones like an internal app that still lives in a company data center.

108
00:04:48,400 --> 00:04:52,200
And public ones like SaaS services, websites, and AI tools on the internet.

109
00:04:52,200 --> 00:04:55,200
It handles both, but it doesn't treat them as one big blob.

110
00:04:55,200 --> 00:04:57,400
It looks at the specific route you're asking for.

111
00:04:57,400 --> 00:05:01,000
You might also hear the term security service edge, or SSE.

112
00:05:01,000 --> 00:05:03,200
Sounds complicated, but the idea is simple.

113
00:05:03,200 --> 00:05:06,400
In the old setup, most security checking lived at company headquarters.

114
00:05:06,400 --> 00:05:09,400
Your traffic had to travel all the way back to that central location,

115
00:05:09,400 --> 00:05:11,800
so the company could inspect it and apply its rules.

116
00:05:11,800 --> 00:05:16,400
With SSE, those checks move into a cloud service that sits closer to users and cloud services.

117
00:05:16,400 --> 00:05:19,800
Think of it like moving a security desk from one distant office building

118
00:05:19,800 --> 00:05:23,000
to well-placed stations that can handle access wherever people work.

119
00:05:23,000 --> 00:05:25,000
The security rules still belong to the company,

120
00:05:25,000 --> 00:05:28,800
but where those rules are applied no longer depends only on a central office network.

121
00:05:28,800 --> 00:05:31,600
That matters because work now happens in more places,

122
00:05:31,600 --> 00:05:34,000
and company tools live in more places too.

123
00:05:34,000 --> 00:05:37,200
Underneath GSA is an approach called zero trust.

124
00:05:37,200 --> 00:05:39,200
Zero trust doesn't mean trusting nobody forever.

125
00:05:39,200 --> 00:05:44,000
It means a connection doesn't earn broad permission, just because it comes from a familiar network,

126
00:05:44,000 --> 00:05:46,400
a company location, or an encrypted tunnel.

127
00:05:46,400 --> 00:05:47,800
Every request needs context.

128
00:05:47,800 --> 00:05:51,200
The system checks your identity, your device, where policy requires it,

129
00:05:51,200 --> 00:05:52,800
and the destination you're requesting.

130
00:05:52,800 --> 00:05:54,600
This is where Microsoft Enter ID comes in.

131
00:05:54,600 --> 00:05:58,200
Think of Enter ID as the reception desk for your company's digital building.

132
00:05:58,200 --> 00:06:02,200
When you sign in, it checks your identity and knows which groups or roles that account belongs to.

133
00:06:02,200 --> 00:06:05,400
Then conditional access applies the company's access rules.

134
00:06:05,400 --> 00:06:08,000
Conditional access is the rule book at that reception desk.

135
00:06:08,000 --> 00:06:11,000
It can decide that a certain app needs more proof before you enter.

136
00:06:11,000 --> 00:06:14,600
It can require multi-factor authentication, often called MFA,

137
00:06:14,600 --> 00:06:17,400
or it can require that you use a company-managed device

138
00:06:17,400 --> 00:06:19,400
that meets the organization's security rules.

139
00:06:19,400 --> 00:06:22,600
Imagine someone in finance opening a sensitive internal finance app.

140
00:06:22,600 --> 00:06:25,800
They may already have signed into their laptop earlier that day.

141
00:06:25,800 --> 00:06:29,600
Even so, the finance app can trigger another check because the app is sensitive

142
00:06:29,600 --> 00:06:32,200
and the company wants stronger proof at that moment.

143
00:06:32,200 --> 00:06:34,800
The person receives an MFA prompt, completes it,

144
00:06:34,800 --> 00:06:37,200
and then gets access to that specific app.

145
00:06:37,200 --> 00:06:39,400
The decision follows the app and the situation.

146
00:06:39,400 --> 00:06:42,400
It isn't only tied to where the person happens to be sitting.

147
00:06:42,400 --> 00:06:44,000
That decision can change too.

148
00:06:44,000 --> 00:06:47,200
Suppose a security signal suggests the account may be at risk

149
00:06:47,200 --> 00:06:49,600
or the device no longer meets the company's rules.

150
00:06:49,600 --> 00:06:52,000
Enter can require the person to sign in again,

151
00:06:52,000 --> 00:06:54,400
ask for stronger proof, or stop access.

152
00:06:54,400 --> 00:06:57,200
The company doesn't have to wait for an old-style remote connection

153
00:06:57,200 --> 00:06:59,000
to end before it responds.

154
00:06:59,000 --> 00:07:01,800
This is the practical meaning of least privilege access.

155
00:07:01,800 --> 00:07:04,600
You get access to the app or destination you need for your job.

156
00:07:04,600 --> 00:07:07,400
You don't automatically get access to everything sitting behind it.

157
00:07:07,400 --> 00:07:08,800
For that to happen on a managed device,

158
00:07:08,800 --> 00:07:11,400
GSA uses the Global Secure Access client.

159
00:07:11,400 --> 00:07:14,400
Think of the client as a secure courier on your laptop.

160
00:07:14,400 --> 00:07:16,400
When you open something covered by GSA,

161
00:07:16,400 --> 00:07:19,000
the client sends that selected traffic through the service

162
00:07:19,000 --> 00:07:21,600
so Entra can apply the right checks behind the scenes.

163
00:07:21,600 --> 00:07:25,000
You usually don't need to decide which route to take the rules to that work.

164
00:07:25,000 --> 00:07:27,800
With that foundation in place, let's look at the first building block,

165
00:07:27,800 --> 00:07:30,600
the part that handles access to private company apps.

166
00:07:30,600 --> 00:07:33,400
Entra private access, the modern VPN replacement.

167
00:07:33,400 --> 00:07:36,200
The first building block is Microsoft Entra private access.

168
00:07:36,200 --> 00:07:39,200
This is Microsoft's Zero Trust Network Access Service.

169
00:07:39,200 --> 00:07:40,800
Often shortened to ZTNA.

170
00:07:40,800 --> 00:07:42,600
That name is long, but the job is simple.

171
00:07:42,600 --> 00:07:46,200
Private access gives you secure access to a specific company app or service

172
00:07:46,200 --> 00:07:49,000
without giving you broad access across the company network.

173
00:07:49,000 --> 00:07:52,000
Think about the kinds of tools that still sit behind company walls.

174
00:07:52,000 --> 00:07:54,000
It might be an on-premises file share.

175
00:07:54,000 --> 00:07:56,000
It could be a remote desktop system,

176
00:07:56,000 --> 00:07:58,000
used to reach a work computer or server.

177
00:07:58,000 --> 00:08:02,000
Maybe it's an internal web app for expenses, stock control or customer records.

178
00:08:02,000 --> 00:08:05,600
It could also be a business app connected to a database or a workload

179
00:08:05,600 --> 00:08:08,600
running in another cloud that the public internet can't reach.

180
00:08:08,600 --> 00:08:09,800
These are private resources.

181
00:08:09,800 --> 00:08:12,800
They aren't meant for anyone on the internet to open in a browser.

182
00:08:12,800 --> 00:08:15,800
In the old approach, you would often connect to the VPN first,

183
00:08:15,800 --> 00:08:19,200
then use the network routes available to find the resource you needed.

184
00:08:19,200 --> 00:08:20,800
Private access flips that around.

185
00:08:20,800 --> 00:08:22,800
You define the app or service a person needs.

186
00:08:22,800 --> 00:08:25,200
Then you give that person a controlled path to that app.

187
00:08:25,200 --> 00:08:27,200
Nothing else needs to come along for the ride.

188
00:08:27,200 --> 00:08:29,400
Imagine a service door inside the company building.

189
00:08:29,400 --> 00:08:31,400
It doesn't open the whole building to the street.

190
00:08:31,400 --> 00:08:34,200
Instead, it connects one approved room to a guarded route for people

191
00:08:34,200 --> 00:08:35,600
who have permission to enter.

192
00:08:35,600 --> 00:08:38,400
That service door is similar to a private access connector.

193
00:08:38,400 --> 00:08:41,800
A connector runs inside the company network close to the private apps

194
00:08:41,800 --> 00:08:45,400
and creates an outbound connection to the global secure access service.

195
00:08:45,400 --> 00:08:47,000
The connector reaches out from inside.

196
00:08:47,000 --> 00:08:50,200
That matters because the company doesn't need to put a public front door

197
00:08:50,200 --> 00:08:53,800
directly in front of the private app, just so remote users can reach it.

198
00:08:53,800 --> 00:08:57,200
Instead, the approved traffic follows the controlled route through the connector

199
00:08:57,200 --> 00:08:58,600
to the specific app.

200
00:08:58,600 --> 00:09:00,000
Let's use a contractor as an example.

201
00:09:00,000 --> 00:09:04,400
A contractor joins a project for six months and needs access to one internal project tool.

202
00:09:04,400 --> 00:09:08,000
With a broad VPN setup, somebody might add that contractor to a VPN group

203
00:09:08,000 --> 00:09:09,600
that reaches a section of the network.

204
00:09:09,600 --> 00:09:13,600
That group may work, but it can also carry more access than the contractor actually needs.

205
00:09:13,600 --> 00:09:17,600
With private access, the contractor can receive access to that one project tool.

206
00:09:17,600 --> 00:09:20,400
Not the nearby file server, not another internal website,

207
00:09:20,400 --> 00:09:23,200
not a set of systems that happen to sit on the same network.

208
00:09:23,200 --> 00:09:25,800
Just a project tool under the company's sign-in rules.

209
00:09:25,800 --> 00:09:27,800
Those rules can be different for different apps.

210
00:09:27,800 --> 00:09:29,800
Enter ID checks who the contractor is.

211
00:09:29,800 --> 00:09:33,200
Conditional access can require MFA before access to the project tool.

212
00:09:33,200 --> 00:09:36,400
The company can require a managed device, depending on its policy,

213
00:09:36,400 --> 00:09:40,600
and can also use device condition and risk signals when deciding whether access should continue.

214
00:09:40,600 --> 00:09:44,000
So the access decision is not just, is the contractor connected?

215
00:09:44,000 --> 00:09:47,600
It becomes, is this the right contractor on an accepted device

216
00:09:47,600 --> 00:09:50,600
asking for the approved app under the current conditions?

217
00:09:50,600 --> 00:09:52,600
That is much closer to how people actually work.

218
00:09:52,600 --> 00:09:54,200
You don't need access to a network.

219
00:09:54,200 --> 00:09:56,400
You need access to a tool that helps you do a job.

220
00:09:56,400 --> 00:10:00,600
For the company that can mean fewer large VPN groups and fewer hard-to-explain exceptions,

221
00:10:00,600 --> 00:10:03,000
it also creates a clearer answer when someone asks,

222
00:10:03,000 --> 00:10:05,000
"Who can reach this private resource?"

223
00:10:05,000 --> 00:10:08,000
The answer can be a named group of users and a named app,

224
00:10:08,000 --> 00:10:10,000
rather than a complicated set of network paths.

225
00:10:10,000 --> 00:10:12,800
There's another useful detail for people working inside an office.

226
00:10:12,800 --> 00:10:15,800
Sometimes you sit on the same local network as the private app you need,

227
00:10:15,800 --> 00:10:18,600
sending all of that app traffic out to the cloud and back again

228
00:10:18,600 --> 00:10:20,200
would create an unnecessary trip.

229
00:10:20,200 --> 00:10:24,000
Private access includes intelligent local access for supported situations.

230
00:10:24,000 --> 00:10:26,600
It can keep the local app traffic on the local network,

231
00:10:26,600 --> 00:10:29,200
while the identity check still goes to Microsoft Entra.

232
00:10:29,200 --> 00:10:31,200
You get the local route where it makes sense,

233
00:10:31,200 --> 00:10:33,800
while the access decision still follows the company's rules.

234
00:10:33,800 --> 00:10:37,200
Private access can modernize many VPN scenarios, but it isn't magic.

235
00:10:37,200 --> 00:10:39,200
A company still needs to understand its apps,

236
00:10:39,200 --> 00:10:41,400
the protocols those apps use, who needs access,

237
00:10:41,400 --> 00:10:42,800
which devices are involved,

238
00:10:42,800 --> 00:10:45,200
and what existing network needs must remain.

239
00:10:45,200 --> 00:10:46,200
That planning matters,

240
00:10:46,200 --> 00:10:49,400
because moving from broad network access to specific app access

241
00:10:49,400 --> 00:10:52,400
means being clear about what each person actually needs.

242
00:10:52,400 --> 00:10:56,000
Private access protects the company tools hidden behind the office walls,

243
00:10:56,000 --> 00:10:59,000
but employees also spend much of the day on websites,

244
00:10:59,000 --> 00:11:02,000
SaaS tools, cloud storage, and AI services.

245
00:11:02,000 --> 00:11:03,800
The second building block watches traffic,

246
00:11:03,800 --> 00:11:06,000
leaving the building for the public internet.

247
00:11:06,000 --> 00:11:08,400
Entra internet access, the secure web gateway,

248
00:11:08,400 --> 00:11:12,600
so the other half of global secure access is Microsoft Entra Internet access,

249
00:11:12,600 --> 00:11:14,800
the secure web gateway side of the service.

250
00:11:14,800 --> 00:11:16,400
Most people call it SBIRG.

251
00:11:16,400 --> 00:11:19,600
Private access handles company resources behind private walls,

252
00:11:19,600 --> 00:11:23,200
while internet access handles traffic going out to the public internet.

253
00:11:23,200 --> 00:11:25,000
In plain English, it's a cloud service

254
00:11:25,000 --> 00:11:28,400
that applies company security rules before users reach websites,

255
00:11:28,400 --> 00:11:30,600
SaaS apps, and other public destinations.

256
00:11:30,600 --> 00:11:31,600
Why does that matter?

257
00:11:31,600 --> 00:11:34,600
Because work doesn't happen in just one browser tab anymore.

258
00:11:34,600 --> 00:11:36,200
You might use a web browser for research.

259
00:11:36,200 --> 00:11:38,600
A desktop app could connect to a cloud service.

260
00:11:38,600 --> 00:11:40,400
Someone might open personal web mail,

261
00:11:40,400 --> 00:11:42,400
upload a document to cloud storage,

262
00:11:42,400 --> 00:11:44,800
or ask an AI tool to summarize a file.

263
00:11:44,800 --> 00:11:47,000
Each action creates a route out of the company,

264
00:11:47,000 --> 00:11:49,000
and some routes lead to harmful websites,

265
00:11:49,000 --> 00:11:51,200
while others can cause data to leave by mistake.

266
00:11:51,200 --> 00:11:52,600
Think of internet access,

267
00:11:52,600 --> 00:11:55,600
like a security checkpoint at the exit of an office building.

268
00:11:55,600 --> 00:11:58,000
People can still leave and send packages where they need to go,

269
00:11:58,000 --> 00:11:59,200
but before a package leaves,

270
00:11:59,200 --> 00:12:00,800
the checkpoint checks the destination

271
00:12:00,800 --> 00:12:02,200
and applies the company's rules.

272
00:12:02,200 --> 00:12:04,200
Is this destination known to be harmful?

273
00:12:04,200 --> 00:12:05,800
Is this service allowed for this group?

274
00:12:05,800 --> 00:12:07,400
Is this package allowed to leave at all?

275
00:12:07,400 --> 00:12:10,000
Here's the thing, that check follows the user.

276
00:12:10,000 --> 00:12:12,400
Someone working from home gets the same web rules

277
00:12:12,400 --> 00:12:14,600
as someone in a branch office or at a company desk.

278
00:12:14,600 --> 00:12:17,800
If the organization blocks a harmful website category,

279
00:12:17,800 --> 00:12:21,000
that rule doesn't disappear just because the employee is on home Wi-Fi.

280
00:12:21,000 --> 00:12:23,600
The same idea applies to SAS apps and AI services.

281
00:12:23,600 --> 00:12:26,600
A company might discover that employees use cloud tools

282
00:12:26,600 --> 00:12:28,000
nobody formally approved.

283
00:12:28,000 --> 00:12:30,000
That doesn't always mean they did something wrong.

284
00:12:30,000 --> 00:12:32,600
Often they were just trying to get work done faster.

285
00:12:32,600 --> 00:12:35,000
Still, the company needs to know which tools are in use

286
00:12:35,000 --> 00:12:37,000
before it can make a sensible choice.

287
00:12:37,000 --> 00:12:39,000
Internet access provides that visibility.

288
00:12:39,000 --> 00:12:41,800
The company can see an unapproved cloud app or AI tool

289
00:12:41,800 --> 00:12:42,800
showing up in traffic,

290
00:12:42,800 --> 00:12:44,200
then decide what to do next.

291
00:12:44,200 --> 00:12:45,600
It might allow the service,

292
00:12:45,600 --> 00:12:47,200
limit what users can do there,

293
00:12:47,200 --> 00:12:50,000
or block it because it doesn't meet security or data rules.

294
00:12:50,000 --> 00:12:52,200
That's a much more useful conversation than simply

295
00:12:52,200 --> 00:12:54,200
hoping people only use approved tools.

296
00:12:54,200 --> 00:12:55,400
Let's make this more real.

297
00:12:55,400 --> 00:12:57,400
Imagine an employee has a planning document

298
00:12:57,400 --> 00:12:59,200
and wants an AI tool to summarize it.

299
00:12:59,200 --> 00:13:01,000
They drag the file into an AI app,

300
00:13:01,000 --> 00:13:02,400
the company hasn't approved.

301
00:13:02,400 --> 00:13:04,800
If the organization uses network file filtering

302
00:13:04,800 --> 00:13:06,000
with Microsoft PerView,

303
00:13:06,000 --> 00:13:09,000
it can scan supported file types under the company's policy.

304
00:13:09,000 --> 00:13:10,800
If that planning document matches a rule,

305
00:13:10,800 --> 00:13:13,800
the upload gets blocked before the file reaches the AI service.

306
00:13:13,800 --> 00:13:15,600
The employee sees the upload failed

307
00:13:15,600 --> 00:13:18,400
and behind the scenes the company has stopped a document

308
00:13:18,400 --> 00:13:20,200
from leaving through an unapproved route.

309
00:13:20,200 --> 00:13:22,800
That isn't about blocking every new tool by default.

310
00:13:22,800 --> 00:13:24,800
It's about giving the organization a way to decide

311
00:13:24,800 --> 00:13:26,200
which data can go where.

312
00:13:26,200 --> 00:13:28,200
The rules can also change based on context.

313
00:13:28,200 --> 00:13:29,800
The same website or cloud service

314
00:13:29,800 --> 00:13:32,200
might be allowed for one group and blocked for another.

315
00:13:32,200 --> 00:13:34,600
A company managed device may receive more access

316
00:13:34,600 --> 00:13:36,000
than an unknown device,

317
00:13:36,000 --> 00:13:37,800
and a user account with a risk signal

318
00:13:37,800 --> 00:13:39,600
may face stricter rules than normal.

319
00:13:39,600 --> 00:13:41,800
That's possible because Internet access works with

320
00:13:41,800 --> 00:13:44,600
Android controls instead of treating all web traffic as identical.

321
00:13:44,600 --> 00:13:46,400
There's one technical idea worth knowing here,

322
00:13:46,400 --> 00:13:47,600
TLS inspection.

323
00:13:47,600 --> 00:13:49,200
Most web traffic is encrypted,

324
00:13:49,200 --> 00:13:50,400
and that's normally a good thing

325
00:13:50,400 --> 00:13:51,800
because it protects information

326
00:13:51,800 --> 00:13:53,200
while traveling across the Internet.

327
00:13:53,200 --> 00:13:55,200
But encryption also means a security service

328
00:13:55,200 --> 00:13:56,400
can't read the contents

329
00:13:56,400 --> 00:13:58,200
unless the organization chooses to inspect

330
00:13:58,200 --> 00:13:59,800
that traffic under its policy.

331
00:13:59,800 --> 00:14:01,400
Think of a sealed delivery box.

332
00:14:01,400 --> 00:14:03,000
You can see the address on the outside,

333
00:14:03,000 --> 00:14:05,400
but you can't check what's inside without opening it.

334
00:14:05,400 --> 00:14:06,400
TLS inspection,

335
00:14:06,400 --> 00:14:09,000
lets the organization inspect selected encrypted traffic

336
00:14:09,000 --> 00:14:11,800
so content-based checks like file filtering can happen.

337
00:14:11,800 --> 00:14:13,400
The organization then sends the traffic

338
00:14:13,400 --> 00:14:15,200
on its way if the policy allows it.

339
00:14:15,200 --> 00:14:16,600
This needs careful thought.

340
00:14:16,600 --> 00:14:19,600
The organization chooses which traffic goes through global secure access

341
00:14:19,600 --> 00:14:21,400
and how much inspection it applies,

342
00:14:21,400 --> 00:14:23,600
and those choices should match clear internal policy,

343
00:14:23,600 --> 00:14:26,600
employee expectations, and local legal requirements.

344
00:14:26,600 --> 00:14:29,600
Internet access handles the public website of the picture

345
00:14:29,600 --> 00:14:32,600
and private access handles access to private company apps.

346
00:14:32,600 --> 00:14:34,600
They can sound like two separate products,

347
00:14:34,600 --> 00:14:36,800
but the bigger idea appears when both routes

348
00:14:36,800 --> 00:14:39,200
use the same identity and policy engine.

349
00:14:39,200 --> 00:14:41,600
How the pieces work as one system.

350
00:14:41,600 --> 00:14:43,600
This is where the full picture clicks.

351
00:14:43,600 --> 00:14:45,800
Global secure access isn't one giant tunnel

352
00:14:45,800 --> 00:14:47,600
that takes all your traffic to one place.

353
00:14:47,600 --> 00:14:48,800
It's a set of guarded routes.

354
00:14:48,800 --> 00:14:51,200
Each route has a destination, a set of rules,

355
00:14:51,200 --> 00:14:53,800
and a decision about whether you should be allowed through.

356
00:14:53,800 --> 00:14:56,600
Imagine the same employee starting work on a managed laptop.

357
00:14:56,600 --> 00:14:58,800
They sign in once using their work account.

358
00:14:58,800 --> 00:15:00,800
First, they open an internal finance app

359
00:15:00,800 --> 00:15:02,400
that request goes through private access

360
00:15:02,400 --> 00:15:05,000
because the app lives inside the company's private environment.

361
00:15:05,000 --> 00:15:07,200
Later, they open a SaaS service in a browser

362
00:15:07,200 --> 00:15:08,600
and visit an AI tool.

363
00:15:08,600 --> 00:15:10,400
Those requests go through Internet access

364
00:15:10,400 --> 00:15:12,600
because the destination sit on the public Internet.

365
00:15:12,600 --> 00:15:15,400
From the employee's view, they open the tools they need.

366
00:15:15,400 --> 00:15:17,600
Behind the scenes, the traffic takes different routes

367
00:15:17,600 --> 00:15:19,800
because the destinations need different protection.

368
00:15:19,800 --> 00:15:22,400
One shared reception desk handles the identity side.

369
00:15:22,400 --> 00:15:24,000
Entra ID knows who signed in.

370
00:15:24,000 --> 00:15:26,400
Conditional access applies the company's rules.

371
00:15:26,400 --> 00:15:28,800
Global secure access then sends the traffic

372
00:15:28,800 --> 00:15:30,000
down the right-guarded route,

373
00:15:30,000 --> 00:15:32,800
whether that means a private app or an Internet destination.

374
00:15:32,800 --> 00:15:34,200
The decision doesn't start with,

375
00:15:34,200 --> 00:15:35,600
"Are you on the company network?"

376
00:15:35,600 --> 00:15:37,200
It starts with better information.

377
00:15:37,200 --> 00:15:38,200
Who is the user?

378
00:15:38,200 --> 00:15:40,400
Is the device in an accepted condition?

379
00:15:40,400 --> 00:15:42,000
Which destination are they requesting?

380
00:15:42,000 --> 00:15:44,000
Has anything changed that makes the request more risky?

381
00:15:44,000 --> 00:15:45,800
That matters after access begins too.

382
00:15:45,800 --> 00:15:47,800
Supposed the security system detects a risk

383
00:15:47,800 --> 00:15:48,800
with an employee's account.

384
00:15:48,800 --> 00:15:51,000
Maybe the sign in activity changes in a way

385
00:15:51,000 --> 00:15:52,000
that needs attention.

386
00:15:52,000 --> 00:15:53,600
Or the device reports a problem.

387
00:15:53,600 --> 00:15:55,800
Entra can react while the person is working.

388
00:15:55,800 --> 00:15:57,400
It may ask for another sign in check,

389
00:15:57,400 --> 00:15:58,800
"Require a stronger proof"

390
00:15:58,800 --> 00:16:01,000
or stop the route to the protected destination

391
00:16:01,000 --> 00:16:02,000
near real time.

392
00:16:02,000 --> 00:16:04,800
Other Microsoft tools contribute useful signals here.

393
00:16:04,800 --> 00:16:07,800
Intune reports whether the device meets the company's device rules.

394
00:16:07,800 --> 00:16:10,800
Defender reports, threats found on the device or account.

395
00:16:10,800 --> 00:16:12,800
Pervue helps protect sensitive files

396
00:16:12,800 --> 00:16:15,200
when users try to move them to cloud destinations.

397
00:16:15,200 --> 00:16:18,200
None of these tools work as separate islands in this scenario.

398
00:16:18,200 --> 00:16:20,600
They feed information into the access decision.

399
00:16:20,600 --> 00:16:23,800
The older model builds one trusted tunnel into the network

400
00:16:23,800 --> 00:16:25,600
and tries to control everything from there.

401
00:16:25,600 --> 00:16:27,600
The newer model creates controlled paths

402
00:16:27,600 --> 00:16:30,600
to each approved destination using identity and context

403
00:16:30,600 --> 00:16:32,000
to decide what happens along the way.

404
00:16:32,000 --> 00:16:33,400
With the full system in view,

405
00:16:33,400 --> 00:16:36,000
don't try to replace every connection at once.

406
00:16:36,000 --> 00:16:37,800
Start with just one VPN use case.

407
00:16:37,800 --> 00:16:40,200
Pick one user group, one private app,

408
00:16:40,200 --> 00:16:41,800
and one clear business need.

409
00:16:41,800 --> 00:16:43,400
Then ask three plain English questions

410
00:16:43,400 --> 00:16:46,600
who needs this app, what exact app or service do they need,

411
00:16:46,600 --> 00:16:48,600
and what sign-in or device checks should apply

412
00:16:48,600 --> 00:16:50,000
before they get access.

413
00:16:50,000 --> 00:16:53,400
A focused private access pilot is your practical first step.

414
00:16:53,400 --> 00:16:56,200
After that, look at Internet Access for Web, SAS, and AI traffic.

415
00:16:56,200 --> 00:16:59,200
Bring your identity, network, device, and data protection teams

416
00:16:59,200 --> 00:17:00,400
into the conversation early

417
00:17:00,400 --> 00:17:03,400
because each team owns part of the access decision.

418
00:17:03,400 --> 00:17:05,600
Remember, access should follow the work

419
00:17:05,600 --> 00:17:07,000
not the network.

420
00:17:07,000 --> 00:17:09,200
Global secure access replaces broad tunnels

421
00:17:09,200 --> 00:17:10,400
with controlled routes.

422
00:17:10,400 --> 00:17:13,200
Start with one app, then subscribe to M365,

423
00:17:13,200 --> 00:17:15,800
EdFam, and share this with someone starting their journey.

424
00:17:15,800 --> 00:17:18,800
I'm Mirko Peters, and this has been another knowledge nugget.