How Entra Global Secure Access Changes Zero Trust for AI Agents

In this blog post How Entra Global Secure Access Changes Zero Trust for AI Agents we will explain what Microsoft’s unified access offering changes, how the technology works, and what technology leaders should review before relying on it for employees and AI agents.

Many businesses have one security system for remote access, another for internet filtering, and a growing collection of controls around AI. Each tool may work, but the gaps between them make policies harder to manage and leave IT teams unable to answer a basic question: who or what accessed which resource, under what conditions?

Microsoft Entra Global Secure Access aims to close those gaps. At a high level, it places a cloud-based security checkpoint between an identity — whether a person or an AI agent — and the public or private resource it wants to reach.

What Microsoft has actually changed

From 2 November 2026, organisations can purchase Microsoft Entra Private Access and Microsoft Entra Internet Access together as one Global Secure Access offering. Both services remain available separately.

This distinction matters. Microsoft has not suddenly released an entirely new network security product. The main change is simpler purchasing and a clearer path towards managing private and internet traffic through the same identity-aware security platform.

• Private Access controls connections to internal applications, cloud workloads and data centre resources. It can replace many traditional virtual private network, or VPN, use cases.
• Internet Access controls connections to websites, software-as-a-service applications and external AI services.
• Conditional Access applies rules based on identity, device condition, location, risk and other business context.

In practical terms, an organisation can move away from separate VPN, web filtering and identity policies. That can mean fewer products to operate, fewer conflicting rules and a clearer audit trail.

How the technology works in plain English

Global Secure Access is Microsoft’s security service edge technology. This means security checks happen through Microsoft’s cloud network rather than depending only on a firewall in your office.

For employee devices, a lightweight Global Secure Access client can direct selected network traffic through Microsoft’s service. Branch offices can also forward traffic through remote network connections.

Private applications are connected using private network connectors. These connectors make outbound connections to Microsoft, so businesses do not need to expose an inbound doorway from the public internet simply to give staff remote access.

Internet-bound traffic can pass through a secure web gateway, which is essentially an identity-aware internet checkpoint. It can block unsafe destinations, restrict categories of websites and apply different policies to different users or groups.

The important difference is that Microsoft Entra ID already knows who the user is. It can also understand whether the device complies with company security requirements and whether the identity presents unusual risk.

Instead of saying, “Anyone connected to the VPN can reach the finance server,” the policy can say, “Only authorised finance staff using a managed and secure device can reach this specific application.”

Zero Trust can now follow more of the connection

Traditional Zero Trust often concentrates on the login. The user proves their identity, completes multifactor authentication and receives access.

That is necessary, but it is no longer enough. Risk can change after login, and AI agents may operate for long periods without a person actively watching each action.

Global Secure Access extends policy enforcement into the network path. Private application access, internet activity and supported AI agent traffic can be evaluated using more consistent identity and security information.

This creates three useful business outcomes:

• Reduced lateral movement: gaining access to one application does not automatically open the rest of the internal network.
• Faster incident investigation: identity and network activity can be linked more clearly.
• Lower operating complexity: IT teams can reduce duplicate policies across identity, VPN and internet security products.

It also supports the “verify explicitly” and “least privilege” principles behind Zero Trust. However, it does not make every environment Zero Trust by default. Poorly scoped access rules remain poorly scoped access rules, even when they are managed from a newer portal.

Why this matters more for AI agents

AI agents do not behave like employees. They can call external services, retrieve internal data and trigger actions at machine speed. One agent may make hundreds of connections while completing what appears to be a single task.

We previously explored why Zero Trust for AI agents requires a different architecture. Identity remains essential, but organisations also need control over where the agent can connect, which tools it can call and what data can leave the business.

Microsoft is beginning to address this through Global Secure Access and Entra Agent ID, which gives supported agents their own manageable identity. For Microsoft Copilot Studio agents, traffic can be forwarded through the Secure Web and AI Gateway so policies can be applied to web requests, custom connectors and external tool connections.

Microsoft has also introduced preview capabilities that can discover managed and previously unknown agents using the network, and identify Model Context Protocol traffic. Model Context Protocol, usually shortened to MCP, is a standard that allows AI agents to connect to tools and data sources.

This visibility is valuable because an agent cannot be governed if the security team does not know it exists. It also helps uncover “shadow agents” created or installed without formal IT approval.

However, coverage is not automatic. The agent’s traffic must follow a controlled path, its identity must be managed, and policies must be configured. An independently hosted OpenAI or Anthropic Claude agent making direct connections from an unmanaged environment will not become secure simply because Global Secure Access has been licensed.

A common 200-person business scenario

Consider a 200-person organisation with a legacy VPN for an on-premises finance system, a separate web filtering product, Microsoft 365 security controls and several new Copilot Studio agents.

The service desk manages VPN failures. The security team manages internet policies elsewhere. The AI project team controls agent connectors, but nobody has a complete view of which external services those agents contact.

With a carefully planned Global Secure Access rollout, the business could provide per-application access to the finance platform, apply identity-based internet rules and direct supported agent traffic through a common control point.

The outcome is not just a cleaner technical diagram. It can mean fewer remote-access tickets, faster security investigations, less duplicated licensing and a lower chance that an agent quietly transfers business information to an unapproved service.

What Global Secure Access does not replace

Global Secure Access should be treated as one part of a broader security architecture. It does not replace Microsoft Defender, which detects threats on devices and across Microsoft services. It also does not replace Wiz, which identifies risks and dangerous connections across cloud environments.

It will not complete Essential 8 compliance either. The Essential 8 is the Australian government’s cybersecurity framework covering controls such as multifactor authentication, patching, application control, restricted administration and reliable backups.

Global Secure Access can support stronger access control and network visibility, but organisations still need to assess and implement all eight strategies at an appropriate maturity level.

There are privacy considerations as well. Some advanced AI visibility features can inspect encrypted traffic and record prompt activity. Australian organisations should complete a privacy impact assessment, define appropriate retention periods and decide who can access those records before enabling detailed inspection.

Five questions to answer before adopting it

1. Which private applications still depend on broad VPN access? Start with systems where access can be limited to specific users and devices.
2. Which internet security products could overlap? Compare capabilities and licences before assuming immediate savings.
3. Where do your AI agents run? Document Copilot Studio, Azure, local and third-party agents.
4. Can you identify each agent and its owner? Every production agent should have an accountable business owner and controlled identity.
5. What traffic should be logged or inspected? Balance security visibility with Australian privacy obligations and employee expectations.

The best approach is usually a staged deployment rather than a company-wide switch. Test a small group of users, one or two private applications and a controlled AI agent environment. Measure connection performance, support requests, blocked activity and policy accuracy before expanding.

The practical takeaway

The new Global Secure Access offering makes Microsoft’s direction clear: private resources, internet services, employees and AI agents are being brought under a more consistent identity-led access model.

For organisations already invested in Microsoft 365, Azure, Intune — which manages and secures company devices — and Microsoft Defender, this may reduce security complexity. The real value, however, depends on architecture, licensing and careful policy design.

CloudPro Inc combines more than 20 years of enterprise IT experience with hands-on work as a Microsoft Partner and Wiz Security Integrator. If you are unsure whether Global Secure Access would reduce costs and risk in your environment, or simply overlap with tools you already own, we are happy to take a practical look — no strings attached.