Global Secure Access for Financial Institutions

Microsoft Entra Global Secure Access lets a loan officer working from home open the loan origination server and the shared drive she needs, carried over Microsoft's network in place of a VPN tunnel. That changes how far a remote laptop can reach. A virtual private network, or VPN, puts the laptop inside the branch network, where it can usually reach far more than the two applications she needs. A stolen password plus a working VPN client reaches just as far.

Global Secure Access connects each user to specific private applications, applies Conditional Access before users connect, and can confirm that a Microsoft 365 sign-in came from your own compliant network.

Part of it may already be in your license. Microsoft's Global Secure Access licensing overview says the Internet Access for Microsoft services capabilities "are included in a Microsoft Entra ID P1 or Microsoft Entra ID P2 license." Microsoft 365 Business Premium and Microsoft 365 E3 both include Entra ID P1. The VPN replacement itself, Microsoft Entra Private Access, comes with the Microsoft Entra Suite or as a standalone purchase.

ABT, a Tier-1 Microsoft Cloud Solution Provider serving 750+ financial institutions, licenses Microsoft 365 at Microsoft's price with Guardian Foundation, a hardened tenant baseline, included. This guide is for IT teams at credit unions, banks, and mortgage companies. It covers what Global Secure Access is, what your license already carries, and how a VPN replacement rolls out one application at a time. It then shows how the service's records line up with what examiners and the Federal Trade Commission (FTC) Safeguards Rule ask for.

What Global Secure Access is

Global Secure Access is Microsoft's umbrella name for two products, Microsoft Entra Internet Access and Microsoft Entra Private Access. Together they form a cloud-delivered network perimeter that travels with the user, which Microsoft calls its Security Service Edge (SSE). You manage both from one place in the Microsoft Entra admin center, beside the Conditional Access policies you already run. Microsoft delivers the service from its wide area network, which spans 70 regions and 190+ network edge locations.

• Microsoft Entra Private Access connects users, in the office or remote, to private resources such as file servers, line-of-business applications, and on-premises web apps, without a VPN. Microsoft describes it as "per-app adaptive access based on Conditional Access policies, for more granular security than a VPN."
• Microsoft Entra Internet Access is an identity-based Secure Web Gateway for internet and software-as-a-service (SaaS) traffic, with web content filtering and threat protection.
• Internet Access for Microsoft services, delivered through the Microsoft traffic profile, routes Microsoft 365 traffic through Global Secure Access and unlocks the compliant network check, Universal Tenant Restrictions, and source IP restoration.

A small client on each device, the Global Secure Access client, captures the traffic each profile covers and sends it through Microsoft's network. Branch offices can also connect as a remote network, which comes up in the licensing section below.

What your Microsoft 365 license already includes

Microsoft splits Global Secure Access into three licensed pieces. Its licensing overview and the Microsoft Entra licensing page lay out where each one comes from.

Every user of Private Access or Internet Access also needs Entra ID P1 or P2, so a Business Premium or E3 institution has the base already. Microsoft licenses most Global Secure Access services per user.

On November 3, 2026, Microsoft's Entra pricing page listed the Microsoft Entra Suite at $12.00 per user per month and Microsoft Entra Global Secure Access as a standalone product at $10.00 per user per month, both paid yearly. The page notes that prices may vary by agreement. The Entra Suite also carries identity governance features beyond network access, and Microsoft 365 E7 includes the Entra Suite.

Branch connectivity has its own threshold. A remote network, which connects a whole branch office through its router, needs a combined total of at least 50 licenses from Entra ID P1 and Entra Internet Access. For the wider plan decision, see our Microsoft 365 E3 vs E5 vs Business Premium comparison for financial institutions.

Three features to turn on with Entra ID P1

Before any VPN project, an institution on Business Premium or E3 can enable the Microsoft traffic profile and get three controls that Conditional Access alone can't provide.

The compliant network check. This adds your organization's Global Secure Access network as a condition in Conditional Access. Microsoft's compliant network documentation describes the payoff: "If an adversary steals a session token and attempts to replay it from a device that isn't connected to your organization's compliant network (for example, by requesting an access token with a stolen refresh token), Microsoft Entra ID immediately denies the request and blocks further access." That is the attack pattern behind the Microsoft 365 token replay campaign against banks, credit unions, and lenders. The check is specific to your tenant, and your team keeps no list of egress IP addresses to maintain.

The compliant network check is one preventive control against token replay from outside your network. The response side is where ABT's M365 Guardian comes in. Guardian Contain adds round-the-clock detection on Microsoft Defender XDR signals, correlated by ABT's own detection engine, with pre-authorized automated containment that revokes a compromised session in seconds at any hour. Tokenator, ABT's automated response engine, watches for suspicious OAuth token behavior and revokes the compromised sessions it finds.

Universal Tenant Restrictions. These apply your tenant restrictions v2 policy on every device with the client or behind a remote network. Users on your devices "can only sign in to tenants and applications authorized in your TRv2 policy," so a staff laptop signs in only to your own tenant and the partner tenants you approve.

Source IP restoration. Cloud proxies normally hide a user's real address. Source IP restoration passes the original egress IP to Microsoft Entra ID and Microsoft Graph, so IP-based Conditional Access keeps working, risk detections stay accurate, and sign-in and audit logs show the address the user actually connected from. Microsoft enables it by default for new tenants, and if you turned on Global Secure Access before June 2025, check the setting.

A typical compliant network policy blocks every location except the "All Compliant Network locations" named location. Microsoft's example excludes emergency access accounts and, when you enroll devices in Intune, the Microsoft Intune Enrollment and Microsoft Intune apps to avoid a circular dependency. Run it in report-only mode first, and review our guide to Conditional Access exclusions before you add any.

How Private Access replaces the VPN

Private Access publishes the private resources you choose, by fully qualified domain name (FQDN) or IP address, and uses Conditional Access to decide whether this user, on this device, gets through. Five terms carry most of the design:

Each Quick Access or per-app app is an enterprise application in Microsoft Entra ID. You assign users and groups to it and target it with Conditional Access policies, for example requiring multifactor authentication (MFA) and a compliant device before anyone reaches the core banking file share. Microsoft's Private Access deployment guide notes that this point-to-point model "prevents bad actors from lateral movement or port scans on your corporate network."

The connector servers deserve planning. Microsoft's connector requirements are short:

• Windows Server 2016 or later, with a line of sight to the applications you plan to publish.
• TLS 1.2 enabled on the server before you install the connector.
• Outbound connections only. The connector reaches out to the service, so your firewall opens outbound ports, and Microsoft advises against inline inspection of that outbound TLS traffic.
• More than one server for high availability, so a patch reboot doesn't take remote access down.
• A current connector version. Private Access needs version 1.5.3417.0 or later, and Microsoft says to reinstall older connectors to get it.

A VPN replacement rollout in five steps

Microsoft's deployment guide names VPN replacement as the primary Private Access scenario and lays out an order that keeps the VPN available as a fallback until the new path is proven.

Step 5 is where the least-privilege value arrives.

Quick Access gives the pilot group the same reach the VPN gave them, which keeps disruption low for the first wave. The per-app apps narrow that reach: the lending team gets the loan origination server, the operations team gets the core banking file share, and no group is assigned a whole subnet. Microsoft suggests adding app segments a few at a time so you can confirm traffic flows for each one. When the last segment moves out of Quick Access and the pilot holds, you have a repeatable process for each wave of users.

The rollout order from Microsoft's deployment guide. Steps one through four run alongside the VPN, which stays in place until the last wave moves.

Deploying the Global Secure Access client

The Global Secure Access client runs on Windows, macOS, Android, and iOS. It captures traffic with a lightweight filter driver, so it can run beside another security service edge product during a transition. On Windows, Microsoft's client prerequisites are specific:

• A joined or registered device. The device must be Microsoft Entra joined, Microsoft Entra hybrid joined, or Microsoft Entra registered, with registration in preview.
• A supported Windows version. 64-bit Windows 10 (LTSC 2021 or newer), Windows 11, or an Arm64 version of Windows 11.
• A license for each user, per the licensing section above.

Intune can deploy the client to Windows devices. Administrators can also stop nonprivileged users from disabling it: with the registry setting in place, turning the client off brings a User Account Control prompt for local administrator credentials. That pairs naturally with removing local admin rights through Intune Endpoint Privilege Management.

Check one limitation before you roll out. Microsoft's known limitations say the Windows client doesn't currently support secure DNS, such as DNS over HTTPS, DNS over TLS, or DNSSEC, or DNS over TCP port 53. Microsoft gives registry settings that turn off the built-in DNS client in Edge and Chrome, so test your browser policies with the pilot group.

Internet Access for web and SaaS traffic

Microsoft Entra Internet Access extends the same identity-aware model to the rest of the internet. Its Secure Web Gateway uses Conditional Access context, such as user, device, location, and risk, when it applies network policy. You can filter web content by category or by domain name, inspect TLS traffic, and apply Conditional Access to internet destinations that aren't federated with Microsoft Entra ID.

For a community institution that already filters web traffic at a branch firewall, Internet Access matters most for the users who aren't at a branch. The same policy follows the laptop home or to a hotel network. Internet Access comes with the Entra Suite or as a standalone purchase.

How it maps to FFIEC and the FTC Safeguards Rule

Bank and credit union examiners work from the Federal Financial Institutions Examination Council (FFIEC) IT Examination Handbook, and its Information Security booklet has a section on remote access.

The same section adds that "Because VPN connections provide access to sensitive internal networks, the connections require additional authentication from the remote user." Here is how Global Secure Access lines up with the expectations most tied to remote access, and what your institution still keeps.

Your examiner judges the remote access program as a whole. The value of Global Secure Access in that conversation is the record: which apps are published, who is assigned, which Conditional Access policy applied, and what the traffic logs show.

Mortgage companies under the FTC Safeguards Rule should note that 16 CFR 314.4(c) applies at every size. The 314.6 exemption for institutions with customer information on fewer than five thousand consumers covers only paragraphs (b)(1), (d)(2), (h), and (i). Our FTC Safeguards Rule guide for mortgage lenders on Microsoft 365 covers the rest of the rule, and our FFIEC IT examination readiness guide covers exam preparation.

Six exam expectations side by side. Global Secure Access supplies the record, and your institution keeps the policies, approvals, and reviews.

A six-step Global Secure Access plan

Steps 1 through 4 use Entra ID P1, which Business Premium and E3 include, so if your users hold it, those steps can start this month. Steps 5 and 6 are a project with a budget line and a pilot calendar, and the VPN stays up as the fallback until the last wave moves. For the Conditional Access foundation under all six steps, see our guide to Conditional Access policies for financial institutions.

Licensing and the free Security Assessment through ABT

If your institution holds Microsoft 365 Business Premium or E3, your license already includes Entra ID P1 and the Microsoft traffic profile features in steps 1 through 4. Run that licensing through ABT, a Tier-1 Microsoft Cloud Solution Provider with 25+ years in regulated IT, and Guardian Foundation, the hardened tenant baseline, is included at no additional charge. Every M365 Guardian rung includes Microsoft Entra ID Conditional Access, multifactor authentication and single sign-on, and Microsoft Intune device compliance, which are the controls the compliant network check and Private Access policies build on. Guardian Contain, the next rung, adds the round-the-clock detection and automated session revocation that answer a stolen token.

If your plan calls for Private Access or Internet Access, ABT can quote the Microsoft Entra Suite or the standalone products at Microsoft's price, on their own line, for the users who need them. An ABT financial services IT strategist can help you size which users need those licenses and compare the Entra Suite and standalone prices for your headcount.

The first question is how your Conditional Access looks today. ABT's free Security Assessment answers it with a read-only review of MFA coverage, Conditional Access policies, legacy authentication exposure, admin account hygiene, and guest access settings. You receive a written report and a review call, and most assessments complete within two weeks.

Frequently Asked Questions