What Global Secure Access actually is
Global Secure Access (GSA) is Microsoft's Security Service Edge platform — the bundle of network security capabilities Microsoft has been quietly building inside Entra since 2023. There are two products under the umbrella. Microsoft Entra Internet Access is the Secure Web Gateway (SWG) — a cloud proxy that inspects internet-bound traffic from corporate devices, blocks risky sites, and enforces Conditional Access against SaaS apps. Microsoft Entra Private Access is the Zero Trust Network Access (ZTNA) replacement for VPN — devices tunnel into specific on-prem or Azure apps via Entra identity, not a flat network. Both run as a lightweight agent on Windows and macOS devices that you push via Intune.
Who GSA replaces in an AU tenant
If you have Microsoft 365 plus any of: Cisco AnyConnect VPN, Palo Alto GlobalProtect VPN, Zscaler ZIA, Zscaler ZPA, Cisco Umbrella, Netskope, Cloudflare Access, or an on-prem proxy appliance — GSA is the Microsoft consolidation play. The pitch is one identity (Entra), one console, one billing line, and Conditional Access policies that already cover your users now extending to network access. The reality for mid-market AU tenants is that GSA Internet Access is production-ready, GSA Private Access can replace most VPN use cases but still has feature gaps versus mature ZTNA products, and the threat-prevention layer is less mature than Zscaler or Netskope. It's a credible 'good enough plus Microsoft consolidation' option, not yet a feature-for-feature swap.
Licensing and AUD pricing
GSA Internet Access and Private Access are sold as standalone Entra add-ons per user per month, or bundled inside the Microsoft Entra Suite (which also includes Entra ID Governance, Entra Verified ID and Entra ID Protection). For most AU mid-market buyers, the maths only stacks up if you're consolidating away from a paid SWG/VPN spend and bundling with Entra ID P2. Microsoft surcharges are roughly USD $5–10 per user per month for the individual modules; AUD pricing is opaque but follows roughly 1.5x the USD list. Frontrow recommends modelling the consolidation TCO before signing — the consumption surprise is usually log retention in Sentinel, not the GSA seat cost itself.
Rollout pattern for AU mid-market
The Frontrow rollout sequence is: pilot Internet Access on a 20-seat group with audit-mode policies for two weeks, watch traffic-inspection logs in Sentinel, then enforce. Stand up Private Access for one critical app (typically a finance system or on-prem ERP) replacing a VPN profile, validate latency from each AU capital, then expand. Don't try to migrate a full Zscaler deployment in one cutover — it almost always finds a break-glass app no one had documented.