2.4.2. Private Access
💡 First Principle: VPNs grant a network; zero-trust network access grants an application. Private Access brokers an outbound-only, per-app tunnel between the user's GSA client and a connector beside the app — the private network is never exposed, inbound firewall stays closed, and "access" no longer implies "adjacency."
Architecture: private network connectors (the same connector family as Application Proxy) install on servers near the apps and make outbound connections to the SSE edge; the user's client forwards private-profile traffic to the edge; the edge stitches the two flows. You publish either Quick Access — broad ranges/FQDNs for fast VPN-replacement migration — or discrete Global Secure Access apps (per-app segments defining IP/FQDN + ports), the end-state that enables per-app CA policy, per-app assignment, and least-privilege segmentation. The recommended journey: Quick Access first for parity, then carve per-app segments and tighten.
The decision table the exam draws from:
| Need | Best fit | Why |
|---|---|---|
| Workforce remote access to many internal apps, any TCP/UDP protocol | Private Access | Client-based ZTNA, per-app CA, no inbound exposure |
| Publish one internal web app to users without the client (partners, unmanaged devices) | Application Proxy | URL-based publishing with pre-auth, no client needed |
| Legacy full-network tunnel, appliance-managed | Traditional VPN | The model being replaced — flat access, backhaul |
Note what Private Access adds over both: SSO to Kerberos/NTLM apps via Entra Kerberos integration, MFA in front of protocols that never supported it (SMB, RDP, SSH), and per-app conditional access with device compliance — "add MFA to an on-prem RDP server without touching it" is a Private Access answer.
⚠️ Exam Trap: Private Access requires the GSA client on user devices (and connectors app-side); Application Proxy requires neither client nor inbound ports but only speaks web. "External partner on an unmanaged browser must reach one internal web app" → App Proxy; "employees on managed devices need SMB/RDP/anything internal" → Private Access.
Reflection Question: Both App Proxy and Private Access use outbound-only connectors. Explain why the client-side difference (browser vs GSA client) is what determines which scenarios each can serve.