Can We Get Rid of Our VPN? What Microsoft 365 Business Premium Already Includes
Many small offices still run a VPN so remote staff can reach files, a line-of-business app, or the server in the closet. VPNs work, but they're clunky, they're a common target, and once someone is connected they often can see far more than they need. Microsoft now offers a different approach called Global Secure Access. Part of it comes with Microsoft 365 Business Premium. Part of it doesn't.
What is Microsoft Global Secure Access?
It's a small app on each laptop or phone that sends work traffic through Microsoft's own network, where your sign-in rules are checked before anyone reaches an app. Instead of putting a remote worker "inside" your office network, it connects them to just the apps they're allowed to use.
What does Business Premium already include?
Business Premium includes Microsoft Entra ID P1, and Microsoft's licensing page says that covers the Microsoft traffic part of Global Secure Access. That includes:
A trusted network check. You can require that sign-ins to Microsoft 365 come through your organization's own Global Secure Access connection.
Blocking personal or outside accounts from being used on work devices to move company data.
Better sign-in records, showing the real location a sign-in came from.
Why does the trusted network check matter?
Attackers increasingly skip the password and steal the "session token" a browser keeps after you sign in. With it, they can act as you without a password or code, which is why MFA alone isn't always enough. Microsoft says that with the trusted network check on, a stolen token replayed from a device outside your connection is denied. That's a real gain for a feature you may already own, and it pairs well with identity threat protection.
So can we drop the VPN?
Not with Business Premium alone. The piece that actually replaces a VPN, Microsoft Entra Private Access, is a paid add-on (also part of the Microsoft Entra Suite). It gives each remote worker access to specific internal apps and file shares, one app at a time, instead of the whole network. Web filtering, called Internet Access, is a separate add-on too.
A simple way to think about it:
Block stolen sign-in tokens with a trusted network check: Yes.
Stop work data going to personal accounts: Yes.
Replace the VPN for internal apps and file shares: No, add-on.
Filter risky websites: No, add-on.
What should we do first?
List what remote staff actually reach through the VPN today.
Turn on the included trusted network check for Microsoft 365. It's a quick win.
Decide whether the remaining apps justify the add-on, or can move to the cloud.
Keep the VPN patched until it's retired. Old remote-access gear is a favorite way in, so a network security review is worth doing.
How 24uNet helps
We review how your remote staff connect, switch on what Business Premium already includes, and plan a VPN exit if it makes sense. These steps fit our Security Baseline. To talk it through, contact us.
Frequently asked questions
Does Microsoft 365 Business Premium include Global Secure Access?
It includes the Microsoft traffic part, with the trusted network check. The full VPN replacement is an add-on.
What is Microsoft Entra Private Access?
Microsoft's VPN replacement. It connects remote users to specific internal apps instead of the whole network.
Does the trusted network check stop token theft?
Microsoft says a stolen session token replayed from outside your organization's connection is denied.
Do staff need to install anything?
Yes, a small Global Secure Access app on each Windows, Mac or mobile device.
Comments