A laptop that never touches the corporate network mounts a file share and opens a remote desktop session, with Kerberos single sign-on intact and multifactor authentication enforced at the identity layer. Domain controllers published properly, the Kerberos negative cache defused, and an honest account of what this does not replace.
Connectors, a connector group that is not Default, Quick Access with the port expression that leaves DNS alone, private DNS suffixes in a split-brain estate, and the first per-app application promoted out of discovery and rescoped. With the end-to-end test that actually proves the enterprise application beat Quick Access.
Private Access is a real VPN retirement path, and the way to walk it is not the tidy one. You replace the tunnel with broad access first, then spend months making it smaller, and the thing you replaced it with never entirely goes away.
The compliant network check turns network position into something your identity system asserts rather than something you maintain a list of. It is included with the licence you already hold, and it stops at a boundary that shapes every decision later in this series.
From a tenant with nothing to an enforced compliant network Conditional Access policy, with the client packaged, the co-requisite device settings deployed, every exclusion argued for, and an end-to-end test that proves the block instead of assuming it.
For years the network and the identity were governed separately, and the seam between them was where attackers lived. Global Secure Access closes that seam by making the network path itself something the identity system authorizes.
Global Secure Access licensing follows the traffic forwarding profile, which makes the whole model easier to reason about than the SKU list suggests. Here is what each profile costs, what the free tier really includes, and the three meters that are not on the price page.
