2.4.1. Security Service Edge Architecture and GSA Clients
💡 First Principle: To police traffic you must first see it, so GSA's architecture is acquisition + decision: lightweight clients (or configured networks) forward selected traffic to Microsoft's global edge, where identity-aware policy decides its fate. What you choose to forward defines what you can control.
The components: the Global Secure Access client installs on Windows, macOS, Android, iOS and captures traffic per policy; remote networks (branch routers via IPsec) forward traffic without per-device clients; the SSE edge (Microsoft's global POPs) evaluates and forwards. Three traffic forwarding profiles partition the world — Microsoft 365 (Exchange/SharePoint/Teams traffic), Private access (your internal apps), and Internet access (everything else) — each independently enabled and scoped to users/groups. The client honors the union of profiles assigned to its user.
Two identity superpowers ride on this plumbing. Universal Conditional Access lets CA policies target traffic profiles as a resource — apply MFA/compliant-device requirements to the network path itself, even for apps that never heard of Entra. The compliant network check adds a CA condition: "is this request arriving through my tenant's GSA?" — replacing fragile egress-IP allowlists with a check that can't be spoofed from a coffee shop and survives IP churn. (Named locations list IPs; compliant network asserts the managed path.)
Deployment realities worth knowing: the client coexists carefully with VPNs (split-tunnel conflicts are the classic issue), profiles are evaluated client-side so an unassigned user's traffic flows normally, and Private Access requires connectors (next section) as the app-side landing.
⚠️ Exam Trap: Compliant network ≠ trusted named location. Named locations trust IP ranges (spoofable, high-maintenance); the compliant network condition verifies traffic transited your GSA tenant — the exam's modern answer for "ensure access only from the corporate network without maintaining IP lists."
Reflection Question: Why can't an attacker satisfy the compliant-network condition by learning your office's egress IPs — and what would they have to compromise instead?
