GSA remote network connectivity
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 1106074 · +39 −39 lines · also on GitHub
⋯ 2 unchanged lines
33
description: Learn how remote network connectivity in Global Secure Access allows users to connect to your corporate network from a remote location, such as a branch office.
44
ms.topic: concept-article
55
ms.reviewer: abhijeetsinha
6
−ms.date: 03/31/2026
6
+ms.date: 04/01/2026
77
ai-usage: ai-assisted
88
---
99
⋯ 1 unchanged line
1111
1212
## Overview
1313
14
−Global Secure Access supports two connectivity options: installing a client on end-user device and configuring a remote network, for example a branch location with a physical router. Remote network connectivity streamlines how your end-users and guests connect from a remote network without needing to install the Global Secure Access Client.
14
+Global Secure Access supports two connectivity options: installing a client on an end-user device and configuring a remote network, such as a branch location with a physical router. Remote network connectivity streamlines how your end-users and guests connect from a remote network without needing to install the Global Secure Access Client.
1515
1616
This article describes the key concepts of remote network connectivity along with common scenarios where it's useful.
1717
1818
## What is a remote network?
1919
20
−Remote networks are remote locations or networks that require internet connectivity. For example, many organizations have a central headquarters and branch office locations in different geographic areas. These branch offices need access to corporate data and services. They need a secure way to talk to the data center, headquarters, and remote workers. The security of remote networks is crucial for many types of organizations.
20
+Remote networks are remote locations or networks that require internet connectivity. For example, many organizations have a central headquarters and branch office locations in different geographic areas. These branch offices need access to corporate data and services. They need a secure way to communicate with the data center, headquarters, and remote workers. The security of remote networks is crucial for many types of organizations.
2121
22
−Remote networks, such as a branch location, are typically connected to the corporate network through a dedicated Wide Area Network (WAN) or a Virtual Private Network (VPN) connection. Employees in the branch location connect to the network using customer premises equipment (CPE).
22
+Typically, you connect remote networks, such as a branch location, to the corporate network through a dedicated Wide Area Network (WAN) or a Virtual Private Network (VPN) connection. Employees in the branch location connect to the network by using customer premises equipment (CPE).
2323
2424
## Current challenges of remote network security
2525
26
−**Bandwidth requirements have grown** – The number of devices requiring internet access increases exponentially. Traditional networks are difficult to scale. With the advent of Software as a Service (SaaS) applications like Microsoft 365, there are ever-growing demands of low latency and jitter-less communication that traditional technologies like Wide Area Network (WAN) and Multi-Protocol Label Switching (MPLS) struggle with.
26
+**Bandwidth requirements have grown** – The number of devices requiring internet access is increasing exponentially. Traditional networks are difficult to scale. With the advent of Software as a Service (SaaS) applications like Microsoft 365, there are ever-growing demands for low latency and jitter-free communication that traditional technologies like Wide Area Network (WAN) and Multi-Protocol Label Switching (MPLS) struggle with.
2727
28
−**IT teams are expensive** – Typically, firewalls are placed on physical devices on-premises, which requires an IT team for setup and maintenance. Maintaining an IT team at every branch location is expensive.
28
+**IT teams are expensive** – Typically, you place firewalls on physical devices on-premises, which requires an IT team for setup and maintenance. Maintaining an IT team at every branch location is expensive.
2929
30
−**Evolving threats** – Malicious actors are finding new avenues to attack the devices at the edge of networks. Edge devices in branch offices or even home offices are often the most vulnerable point of attack.
30
+**Evolving threats** – Malicious actors continue to find new avenues to attack the devices at the edge of networks. Edge devices in branch offices or even home offices are often the most vulnerable point of attack.
3131
3232
> [!TIP]
3333
> For guidance on enhancing the resilience of remote networks, see [Best practices for Global Secure Access remote network resilience](remote-network-resilience.md).
3434
3535
## How does Global Secure Access remote network connectivity work?
3636
37
−To connect a remote network to Global Secure Access, you set up an Internet Protocol Security (IPSec) tunnel between your on-premises equipment and the Global Secure Access endpoint. Traffic that you specify is routed through the IPSec tunnel to the nearest Global Secure Access endpoint. You can apply security policies in the Microsoft Entra admin center.
37
+To connect a remote network to Global Secure Access, set up an Internet Protocol Security (IPsec) tunnel between your on-premises equipment and the Global Secure Access endpoint. Route the traffic you specify through the IPsec tunnel to the nearest Global Secure Access endpoint. You can apply security policies in the Microsoft Entra admin center.
3838
3939
Global Secure Access remote network connectivity provides a secure solution between a remote network and the Global Secure Access service. It doesn't provide a secure connection between one remote network and another.
40
−To learn more about secure remote network-to-remote network connectivity, see the [Azure Virtual WAN documentation](/azure/virtual-wan/).
40
+For more information about secure remote network-to-remote network connectivity, see the [Azure Virtual WAN documentation](/azure/virtual-wan/).
4141
4242
## Supported traffic forwarding profiles
4343
44
−Remote networks support different traffic forwarding profiles for acquiring traffic. Traffic forwarding profiles control which traffic is routed through Global Secure Access. Security profiles (such as the baseline profile) control what policies are applied to that acquired traffic.
44
+Remote networks support different traffic forwarding profiles for acquiring traffic. Traffic forwarding profiles control which traffic is routed through Global Secure Access. Security profiles, such as the baseline profile, control what policies are applied to that acquired traffic.
4545
4646
| Traffic forwarding profile | Global Secure Access client | Remote network |
4747
|---|---|---|
⋯ 2 unchanged lines
5050
| **Private Access** | ✅ Supported | ❌ Not supported |
5151
5252
> [!IMPORTANT]
53
−> The **Microsoft traffic** and **Internet Access** traffic forwarding profiles can be assigned to remote networks. The **Private Access** traffic forwarding profile requires the Global Secure Access client installed on end-user devices. For more information, see [Assign a traffic profile to a remote network](how-to-assign-traffic-profile-to-remote-network.md) and [Understand traffic forwarding profiles](concept-traffic-forwarding.md).
53
+> You can assign the **Microsoft traffic** and **Internet Access** traffic forwarding profiles to remote networks. The **Private Access** traffic forwarding profile requires the Global Secure Access client installed on end-user devices. For more information, see [Assign a traffic profile to a remote network](how-to-assign-traffic-profile-to-remote-network.md) and [Understand traffic forwarding profiles](concept-traffic-forwarding.md).
5454
55
−Once traffic is acquired through a forwarding profile, you apply security policies to it using security profiles. The [baseline security profile](how-to-apply-security-policies-remote-network.md) enforces policies at the tenant level for all traffic routed through Global Secure Access, including remote network traffic. User-aware security profiles linked to Conditional Access policies require the Global Secure Access client.
55
+After you acquire traffic through a forwarding profile, apply security policies to it by using security profiles. The [baseline security profile](how-to-apply-security-policies-remote-network.md) enforces policies at the tenant level for all traffic routed through Global Secure Access, including remote network traffic. User-aware security profiles linked to Conditional Access policies require the Global Secure Access client.
5656
5757
[!INCLUDE [remote-network-traffic-enforcement-include](../includes/remote-network-traffic-enforcement-include.md)]
5858
59
−## Why remote network connectivity is important for you?
60
−Maintaining security of a corporate network is increasingly difficult in a world of remote work and distributed teams. Security Service Edge (SSE) promises a world of security where customers can access their corporate resources from anywhere in the world without needing to back haul their traffic to headquarters.
59
+## Why is remote network connectivity important for you?
60
+Maintaining security of a corporate network is increasingly difficult in a world of remote work and distributed teams. Security Service Edge (SSE) promises a world of security where customers can access their corporate resources from anywhere in the world without needing to backhaul their traffic to headquarters.
6161
6262
## Common remote network connectivity scenarios
6363
64
−### I don’t want to install clients on thousands of devices on-premises.
65
−Generally, SSE is enforced by installing a client on a device. The client creates a tunnel to the nearest SSE endpoint and routes all internet traffic through it. SSE solutions inspect the traffic and enforce security policies. If your users aren't mobile and based in a physical branch location, then remote network connectivity for that branch location removes the pain of installing a client on every device. You can connect the entire branch location by creating an IPSec tunnel between the core router of the branch office and the Global Secure Access endpoint.
64
+### I don't want to install clients on thousands of devices on-premises.
65
+Generally, you enforce SSE by installing the client on a device. The client creates a tunnel to the nearest SSE endpoint and routes all internet traffic through it. SSE solutions inspect the traffic and enforce security policies. If your users aren't mobile and are based in a physical branch location, remote network connectivity for that branch location removes the pain of installing the client on every device. You can connect the entire branch location by creating an IPSec tunnel between the core router of the branch office and the Global Secure Access endpoint.
6666
6767
### I can't install clients on all the devices my organization owns.
68
−Sometimes, clients can't be installed on all devices. Global Secure Access currently provides clients for Windows. But what about Linux, mainframes, cameras, printers, and other types of devices that are on premises and sending traffic to the internet? This traffic still needs to be monitored and secured. When you connect a remote network, you can set policies for all traffic from that location regardless of the device where it originated.
68
+Sometimes, you can't install the client on all devices. Global Secure Access currently provides clients for Windows, macOS, Android, and iOS. But what about Linux, mainframes, cameras, printers, and other types of devices that are on-premises and send traffic to the internet? You still need to monitor and secure this traffic. When you connect a remote network, you can set policies for all traffic from that location regardless of the device where it originated.
6969
7070
### I have guests on my network who don't have the client installed.
71
−Guest devices on your network might not have the client installed. To ensure that those devices adhere to your network security policies, you need their traffic routed through the Global Secure Access endpoint. Remote network connectivity solves this problem. No clients need to be installed on guest devices. All outgoing traffic from the remote network is going through security evaluation by default.
71
+Guest devices on your network might not have the client installed. To ensure that those devices adhere to your network security policies, you need their traffic routed through the Global Secure Access endpoint. Remote network connectivity solves this problem. You don't need to install the client on guest devices. All outgoing traffic from the remote network goes through security evaluation by default.
7272
73
−### How much bandwidth is allocated per tenant
73
+### What is the bandwidth allocation for each tenant?
7474
75
−The total bandwidth you're allocated is determined by the number of licenses purchased. Each Microsoft Entra ID P1 license, Microsoft Entra Internet Access license, or Microsoft Entra Suite license contributes to your total bandwidth. Bandwidth for remote networks can be assigned to IPsec tunnels in increments of 250 Mbps, 500 Mbps, 750 Mbps, or 1,000 Mbps. This flexibility allows you to allocate bandwidth to different remote network locations according to your specific needs. For optimal performance, Microsoft recommends configuring at least two IPsec tunnels per location for high availability. The table below details the total bandwidth based on the number of licenses purchased.
75
+The number of licenses you buy determines your total bandwidth allocation. Each Microsoft Entra ID P1 license, Microsoft Entra Internet Access license, and Microsoft Entra Suite license adds to your total bandwidth. You can assign bandwidth for remote networks to IPsec tunnels in increments of 250 Mbps, 500 Mbps, 750 Mbps, or 1,000 Mbps. This flexibility means you can allocate bandwidth to different remote network locations based on your specific needs. For best performance, Microsoft recommends configuring at least two IPsec tunnels per location for high availability. The following table shows the total bandwidth based on the number of licenses you purchase.
7676
7777
#### Initial bandwidth allocation
7878
79
−| # of licenses | Total Bandwidth (Mbps) |
79
+| Number of licenses | Total Bandwidth (Mbps) |
8080
|---------------|------------------------|
8181
| 50 – 99 | 500 Mbps |
8282
| 100 – 499 | 1,000 Mbps |
⋯ 19 unchanged lines
102102
| 10,000 + | 35,000 Mbps + |
103103
104104
**Table notes**
105
−- Minimum number of licenses to use remote network connectivity feature is 50.
106
−- The number of licenses is equal to the total number of licenses purchased (Microsoft Entra ID P1 + Microsoft Entra Internet Access /Microsoft Entra Suite). After 10,000 licenses you get an additional 500 Mbps for every 500 licenses purchased (example 11,000 licenses = 36,000 Mbps).
107
−- Organizations crossing the 10,000-license mark often operate at an enterprise scale requiring more robust infrastructure. The jump to 35,000 Mbps ensures ample capacity to meet the demands of such deployments, supporting higher traffic volumes and providing the flexibility to expand bandwidth allocations as needed.
108
−- If more bandwidth is required, additional bandwidth is available for purchase in increments of 500 Mbps via the Remote Network Bandwidth SKU.
105
+- You need at least 50 licenses to use the remote network connectivity feature.
106
+- The number of licenses is the total number of licenses you purchase (Microsoft Entra ID P1 + Microsoft Entra Internet Access / Microsoft Entra Suite). After 10,000 licenses, you get an extra 500 Mbps for every 500 licenses you buy (for example, 11,000 licenses = 36,000 Mbps).
107
+- Organizations that go beyond 10,000 licenses often operate at an enterprise scale and need more robust infrastructure. The jump to 35,000 Mbps ensures ample capacity to meet the demands of such deployments, supports higher traffic volumes, and provides the flexibility to expand bandwidth allocations as needed.
108
+- If you need more bandwidth, you can buy extra bandwidth in increments of 500 Mbps through the Remote Network Bandwidth SKU.
109109
110
−#### Examples of Allocated Bandwidth per tenant:
110
+#### Examples of allocated bandwidth per tenant
111111
112
−**Tenant 1:**
112
+**Tenant one:**
113113
114114
- 1,000 Microsoft Entra ID P1 licenses
115115
- Allocated: 1,000 licenses, 3,500 Mbps
116116
117
−**Tenant 2:**
117
+**Tenant two:**
118118
119119
- 3,000 Microsoft Entra ID P1 licenses
120120
- 3,000 Internet Access licenses
121121
- Allocated: 6,000 licenses, 11,000 Mbps
122122
123
−**Tenant 3:**
123
+**Tenant three:**
124124
125125
- 8,000 Microsoft Entra ID P1 licenses
126126
- 6,000 Microsoft Entra Suite licenses
127127
- Allocated: 14,000 licenses, 39,000 Mbps
128128
129
−#### Examples of Bandwidth distribution for Remote Networks
129
+#### Examples of bandwidth distribution for remote networks
130130
131
−**Tenant 1:**
131
+**Tenant one:**
132132
133
−Total Bandwidth: 3,500 Mbps
133
+Total bandwidth: 3,500 Mbps
134134
135135
Allocation:
136136
⋯ 2 unchanged lines
139139
- Site C: 2 IPsec tunnels: 2 x 500 Mbps = 1,000 Mbps
140140
- Site D: 2 IPsec tunnels: 2 x 750 Mbps = 1,500 Mbps
141141
142
−Remaining Bandwidth: None
142
+Remaining bandwidth: None
143143
144
−**Tenant 2:**
144
+**Tenant two:**
145145
146
−Total Bandwidth: 11,000 Mbps
146
+Total bandwidth: 11,000 Mbps
147147
148148
Allocation:
149149
⋯ 3 unchanged lines
153153
- Site D: 2 IPsec tunnels: 2 x 1,000 Mbps = 2,000 Mbps
154154
- Site E: 2 IPsec tunnels: 2 x 1,000 Mbps = 2,000 Mbps
155155
156
−Remaining Bandwidth: 4,000 Mbps
156
+Remaining bandwidth: 4,000 Mbps
157157
158
−**Tenant 3:**
158
+**Tenant three:**
159159
160
−Total Bandwidth: 39,000 Mbps
160
+Total bandwidth: 39,000 Mbps
161161
162162
Allocation:
163163
⋯ 5 unchanged lines
169169
- Site F: 2 IPsec tunnels: 2 x 1,000 Mbps = 2,000 Mbps
170170
- Site G: 2 IPsec tunnels: 2 x 1,000 Mbps = 2,000 Mbps
171171
172
−Remaining Bandwidth: 28,500 Mbps
172
+Remaining bandwidth: 28,500 Mbps
173173
174174
## Next steps
175175
- [List all remote networks](how-to-list-remote-networks.md)
⋯ 2 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:20 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.