Replace VPN Access with Microsoft Entra Private Access

Traditional VPNs create network-level trust: once connected, a user can often reach more of the private network than the task requires. Microsoft Entra Private Access replaces that with identity-driven, per-app connectivity. Microsoft's Entra blog post of September 16, 2026 lays out the case for moving off VPN in phases, and Microsoft Learn documents the setup steps (Microsoft Entra Blog).

Private Access is one half of Global Secure Access, Microsoft's Security Service Edge (SSE). The other half is Microsoft Entra Internet Access. Per Microsoft Learn, Private Access "builds on the capabilities of Microsoft Entra application proxy" and extends access to any private resource, port, and protocol, with Conditional Access deciding each connection (What is Global Secure Access?).

Why this matters for small and mid-sized businesses

Most small and mid-sized businesses run one VPN that gives every remote user a route into the office or Azure network. That one tunnel ends up holding file shares, RDP to servers, line-of-business apps, and printers. If a laptop or account is compromised, the attacker gets the same broad network reach.

• Who is affected: any organization with remote staff reaching on-premises or IaaS resources (file servers, RDP hosts, ERP or accounting apps, internal web apps) through a VPN appliance.
• What breaks if you rush: DNS for internal names, apps that check the source IP, users in nested groups who suddenly lose access, and devices where a group policy overrides the client's DNS rules (see Gotchas).
• Cost of ignoring it: VPN gateways still need patching, licenses, and capacity, and remote access stays outside the Conditional Access policies you already use for Microsoft 365.

Quick Access vs per-app access

Private Access gives you two ways to publish private resources. Both use the same connectors, client, and Conditional Access. The difference is how finely you scope them.

When a segment overlaps between an Enterprise application and Quick Access, the Enterprise application wins. Microsoft's deployment guide says to keep creating per-app applications until no segments are left in Quick Access, then disable Quick Access (Private Access deployment guide). You can use Application Discovery to see which segments users actually hit.

Licensing and prerequisites

Step-by-step: replace VPN access with Entra Private Access

These steps follow Microsoft Learn's Quick Access, per-app access, connector, and deployment guide articles. All admin steps happen in the Microsoft Entra admin center (entra.microsoft.com), except client deployment.

1. Inventory and plan. List what the VPN reaches today (subnets, FQDNs, ports), the app owners, and who uses each app. Write a rollback plan that says when you would remove the client or turn off the forwarding profile. Create a Microsoft Entra security group for pilot users and assign them directly, because nested groups are not supported for app assignment.
2. Install connectors. Go to Microsoft Entra admin center > Global Secure Access > Connect > Connectors > Download connector service. Install and register it on each Windows Server as an Application Administrator. Then select New connector group and add the connectors. Confirm each connector shows as active.
3. Configure Quick Access. Go to Global Secure Access > Applications > Quick access. Enter a name, select the connector group, and select Save. Then select Add Quick Access application segment and add IP addresses, CIDR ranges, IP-to-IP ranges, or FQDNs with ports (for example 445 for SMB or 3389 for RDP). On the Private DNS tab, enable private DNS and add your internal DNS suffixes.
4. Assign users. From Quick Access select Edit application settings > Users and groups and add the pilot group.
5. Add Conditional Access. Go to Global Secure Access > Applications > Enterprise applications, open the app, select Conditional Access > New policy. The app is pre-filled as the target resource. For example, require MFA and a compliant device, exclude emergency access accounts, and start in Report-only. You can also build it under Entra ID > Conditional Access > Policies.
6. Turn on the forwarding profile. Go to Global Secure Access > Connect > Traffic forwarding and turn on the Private access profile. Assign it to the pilot group.
7. Deploy the client. Download it from Global Secure Access > Connect > Client download. To deploy with Intune, go to Microsoft Intune admin center > Apps > All apps > Add > Windows app (Win32) and use Microsoft's packaging script, which also sets IPv4 preferred. Silent install uses the /quiet switch.
8. Pilot, then move to per-app. Have pilot users test each app with the VPN disconnected. Then, for each app, go to Global Secure Access > Applications > Enterprise applications > New application, add its segments, assign users, and attach a Conditional Access policy. Assign users to the new app before moving a segment out of Quick Access. Assignments don't carry over, and changes can take about 15 minutes to reach clients.
9. Retire VPN routes per app. When no segments are left in Quick Access and owners have signed off, disable Quick Access and remove the matching VPN routes and firewall rules in waves.

Creating Quick Access, apps, and Conditional Access policies is shown in the portal above. Microsoft also documents Graph APIs for automation, but those endpoints are in beta. The PowerShell below is read-only, for checking state.

# Microsoft Graph PowerShell: check the Private access forwarding profile is enabled
# Requires a role such as Global Secure Access Administrator or Global Reader
Connect-MgGraph -Scopes "NetworkAccess.Read.All"
Get-MgBetaNetworkAccessForwardingProfile |
  Select-Object Name, TrafficForwardingType, State

Gotchas

• Nested groups don't work. Users must be assigned directly to the app or to a group assigned to the app.
• Moving a segment from Quick Access to an Enterprise application can lock users out. Assignments are not copied, so assign users to the new app first.
• Private Access needs the client. Private Access traffic is acquired only by the Global Secure Access client. Remote networks (branch IPsec tunnels) can't carry Private Access traffic.
• Local subnet IPs aren't tunneled. IP-based Private Access works only for ranges outside the device's local subnet.
• Secure DNS and DNS over TCP break FQDN rules. The Windows client doesn't support DoH, DoT, DNSSEC, or DNS over TCP port 53. Disable secure DNS and the built-in DNS client in browsers.
• Group Policy NRPT rules override private DNS. If a GPO pushes Name Resolution Policy Table rules (even an empty legacy list), private DNS stops working.
• IPv6 isn't tunneled. The client handles IPv4 only. Microsoft's Intune script sets IPv4 preferred for this reason.
• No multi-session hosts. The client doesn't support concurrent sessions (RDS session hosts, multi-session AVD), and it can't be installed on a machine that hosts VMs or has a Hyper-V external switch.
• Conditional Access applies at the app, not the traffic profile. Target the Quick Access or per-app Enterprise applications. Compliant network check isn't supported for Private Access apps.
• Overlapping segments. Don't overlap segments between Global Secure Access apps. The only allowed overlap is Enterprise application vs Quick Access, and there the Enterprise application wins.
• Connector servers. Don't install the connector on the same machine as Microsoft Entra Password Protection Proxy, and don't inspect or terminate the connector's outbound TLS.
• Government clouds. Global Secure Access is available in GCC but not GCC High or DoD.

Source for the client and access-control limits: Known limitations for Global Secure Access.

About Microsoft Edge for Business: Microsoft has not published a native Edge for Business integration for Entra Private Access. Private Access uses the Global Secure Access client on the device, not a browser-only mode. Edge for Business security connectors that reach private apps through the browser are third-party SSE integrations, such as Cisco Secure Access. If you are evaluating Edge for Business, VDI, and VPN replacement together, treat them as separate decisions.

How to verify it worked

1. Connectors: In Global Secure Access > Connect > Connectors, each connector shows as active. On the server, the Microsoft Entra private network connector and connector updater services are Running.
2. Client: On a pilot device the tray icon shows Global Secure Access - Connected. In Advanced diagnostics > Forwarding profile, use Policy tester to confirm which rule matches each app destination.
3. Access: With the VPN disconnected, open each pilot app. Then check the user's sign-in logs to confirm the Conditional Access result for the Quick Access or per-app application.
4. PowerShell: Confirm the Private access profile is enabled and the connectors are active.

Connect-MgGraph -Scopes "NetworkAccess.Read.All"
Get-MgBetaNetworkAccessForwardingProfile |
  Where-Object { $_.TrafficForwardingType -eq "private" } |
  Select-Object Name, State

# Connector status (beta API; least-privileged delegated permission is Directory.ReadWrite.All)
Connect-MgGraph -Scopes "Directory.ReadWrite.All"
(Invoke-MgGraphRequest -Method GET `
  -Uri "https://graph.microsoft.com/beta/onPremisesPublishingProfiles/applicationProxy/connectors").value |
  ForEach-Object { "{0}  {1}" -f $_.machineName, $_.status }

Frequently asked questions

Does Entra Private Access replace every VPN immediately? No. Microsoft's deployment guide recommends a pilot group, a rollback plan, and deployment in waves. Start with Quick Access to copy VPN reach, move apps to per-app access, and retire VPN routes only after each app is tested.

What is the difference between Global Secure Access and Private Access? Global Secure Access is the umbrella name for Microsoft's SSE in the Entra admin center. Microsoft Entra Private Access is the part for private corporate resources and VPN replacement. Microsoft Entra Internet Access covers internet and SaaS traffic.

What licenses do I need for Entra Private Access? Each user needs a Microsoft Entra Private Access license, either standalone or through Microsoft Entra Suite, plus Microsoft Entra ID P1 or P2.

What is the difference between Quick Access and per-app access? Quick Access is one app holding broad IP ranges and FQDNs, meant as a transition from VPN. Per-app access uses a separate Global Secure Access Enterprise application for each private app, with its own assignments and Conditional Access policies.

Does Entra Private Access work through Microsoft Edge for Business without a client? Microsoft has not published that capability. Private Access traffic is acquired by the Global Secure Access client. Edge for Business security connectors for private-app access are third-party SSE integrations, such as Cisco Secure Access.

What should a first pilot measure? Sign-in success and Conditional Access results, app behavior with the VPN disconnected, DNS resolution of internal names, help-desk tickets, and whether the rollback plan works.

When should the VPN be retired? Gradually, once no segments remain in Quick Access, each per-app application works with its own Conditional Access policy, app owners have signed off, and the rollback plan has been tested.