> **GSA** is Microsoft's [[Security Service Edge (SSE)|SSE]] offering. It's an umbrella over two products: > > - **Microsoft Entra Internet Access**, Microsoft's Secure Web Gateway. It secures and filters outbound internet traffic with URL filtering, malware protection, and Conditional Access integration. It also has a dedicated path for Microsoft 365 traffic. > > - **Microsoft Entra Private Access**, Microsoft's ZTNA solution and the VPN replacement. It gives users access to internal, private applications without a traditional VPN. Per-app access, TCP and UDP support, and it works through lightweight connectors deployed inside your network. If you've used Azure AD Application Proxy (now Entra App Proxy), Private Access is its successor. > > Together these two products make up **Global Secure Access**, managed from a single blade in the Entra admin center.^[https://ar0x.com/posts/what-is-gsa/] > ![[Pasted image 20260629161257.png]] # Traffic Forwarding Profiles ## Microsoft Traffic Requires Microsoft Entra ID P1 or P2^[https://learn.microsoft.com/en-us/entra/global-secure-access/concept-traffic-forwarding#licensing]. # Private Access Profile https://chris-brumm.com/2024/09/07/Deep-Dive-DNS-in-Entra-Private-Access/