Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.

2.4.2. Private Access

💡 First Principle: VPNs grant a network; zero-trust network access grants an application. Private Access brokers an outbound-only, per-app tunnel between the user's GSA client and a connector beside the app — the private network is never exposed, inbound firewall stays closed, and "access" no longer implies "adjacency."

Architecture: private network connectors (the same connector family as Application Proxy) install on servers near the apps and make outbound connections to the SSE edge; the user's client forwards private-profile traffic to the edge; the edge stitches the two flows. You publish either Quick Access — broad ranges/FQDNs for fast VPN-replacement migration — or discrete Global Secure Access apps (per-app segments defining IP/FQDN + ports), the end-state that enables per-app CA policy, per-app assignment, and least-privilege segmentation. The recommended journey: Quick Access first for parity, then carve per-app segments and tighten.

The decision table the exam draws from:

NeedBest fitWhy
Workforce remote access to many internal apps, any TCP/UDP protocolPrivate AccessClient-based ZTNA, per-app CA, no inbound exposure
Publish one internal web app to users without the client (partners, unmanaged devices)Application ProxyURL-based publishing with pre-auth, no client needed
Legacy full-network tunnel, appliance-managedTraditional VPNThe model being replaced — flat access, backhaul

Note what Private Access adds over both: SSO to Kerberos/NTLM apps via Entra Kerberos integration, MFA in front of protocols that never supported it (SMB, RDP, SSH), and per-app conditional access with device compliance — "add MFA to an on-prem RDP server without touching it" is a Private Access answer.

⚠️ Exam Trap: Private Access requires the GSA client on user devices (and connectors app-side); Application Proxy requires neither client nor inbound ports but only speaks web. "External partner on an unmanaged browser must reach one internal web app" → App Proxy; "employees on managed devices need SMB/RDP/anything internal" → Private Access.

Reflection Question: Both App Proxy and Private Access use outbound-only connectors. Explain why the client-side difference (browser vs GSA client) is what determines which scenarios each can serve.

See how it connects
Alvin Varughese
Written byAlvin Varughese
Founder18 professional certifications