2.4. Global Secure Access

💡 First Principle: If identity is the control plane, why do access decisions stop at the app's front door while raw network traffic flows on yesterday's rules? Global Secure Access extends Conditional Access to the network path itself — every packet leaves through Microsoft's Security Service Edge, where the same user/device/risk signals decide what traffic goes where.

The stakes: the VPN model backhauls everything to a concentrator with a flat network behind it — one stolen VPN credential yields lateral movement across the estate. SSE inverts it: per-app, identity-verified tunnels with no inbound exposure and no implicit lateral reach. This skill area is new to the current syllabus, third-party materials often omit it, and Microsoft loves to test fresh objectives — treat 2.4 as high-yield.

⚠️ Common Misconception: "GSA is a networking product, so it's about latency and POPs." Its differentiator is identity-aware networking: universal Conditional Access over traffic, compliant-network checks replacing brittle IP allowlists, and risk signals policing network sessions — networking as an extension of Entra, not beside it.