What Is Microsoft Entra Internet Access? Microsoft’s SWG, Explained for 2026

If your company already lives in Microsoft 365, Microsoft Entra Internet Access looks like the obvious next step. You already pay for Entra ID, your devices are already in Intune, and Microsoft offers a secure web gateway that plugs straight into Conditional Access. Before you add it to a 2027 renewal, it helps to know exactly what Entra Internet Access is, how it moves traffic, and where it stops. If you are new to the category, start with what Security Service Edge (SSE) is, because Entra Internet Access is Microsoft’s entry into that market.

The short answer

Microsoft Entra Internet Access is Microsoft’s identity-centric secure web gateway. Together with Microsoft Entra Private Access, it makes up Global Secure Access, Microsoft’s Security Service Edge. A Global Secure Access client on the device tunnels traffic to Microsoft’s edge, where Microsoft applies web filtering, TLS inspection, threat intelligence, and Conditional Access policy.

It is at its best on Microsoft traffic you already license. For the rest of the web it is a cloud proxy, so every request takes a detour through a Microsoft point of presence, and the deeper AI and data controls stack up as prerequisites on top of the paid Internet Access profile. dope.security takes a different approach: it inspects traffic on the device and sends it direct.

What is Microsoft Entra Internet Access?

Microsoft made Entra Internet Access and Entra Private Access generally available in July 2024, standalone or as part of the Microsoft Entra Suite. The detail most buyers miss is that Internet Access is really two traffic profiles, licensed differently.

• The Microsoft traffic profile. Included with Entra ID P1 or P2. It carries Microsoft 365 traffic and adds universal tenant restrictions, the compliant network check, source IP restoration for Entra and Graph, and richer Microsoft 365 logs.
• The Internet Access traffic profile. The paid secure web gateway. Web category and FQDN filtering, TLS inspection, threat intelligence, content policies, prompt injection protection, and Shadow AI discovery live here.

How much does Entra Internet Access cost?

Microsoft’s list pricing puts Entra Internet Access at $5 per user per month on an annual commitment and the Entra Suite at $12. Both sit on top of an Entra ID P1 or P2 license. Inline DLP through Microsoft Purview adds its own licensing: Microsoft documents a Purview license requirement for "Scan with Purview," and its rollout notice says a global admin must activate Purview pay-as-you-go. So the real line item is the gateway, plus the identity license it rides on, plus the data security licensing behind it.

How Entra Internet Access works

• The client. The Global Secure Access client runs on Windows, macOS, iOS, and Android. It forwards traffic that matches a forwarding profile to Microsoft’s SSE edge.
• The tunnel. Microsoft documents that websites see the edge IP as the source, not the device. Source IP restoration fixes that only for Entra and Microsoft Graph.
• The edge. Microsoft applies policy at its service edge locations, reached over Anycast.
• Branches. Remote networks connect over IPsec from customer equipment. Microsoft notes that Conditional Access is enforced only for users running the client.
• No-client option. An Explicit Forward Proxy is in preview for devices that use a PAC file instead of the client. TLS inspection is mandatory on that path.

If the forward-proxy model is new to you, our forward proxy explainer covers how it behaves. The short version: identity is attached at the edge, but inspection still happens away from the device.

TLS inspection in Entra Internet Access

TLS inspection is the foundation for everything deeper than a domain decision: full URL filtering, block pages, file policies, and prompt inspection. Microsoft made it generally available in November 2025. Global Secure Access decrypts HTTPS at the service edge, evaluates policy, then re-encrypts and forwards the request. You can sign the inspection certificate with your own CA or, as of 2026, use a Microsoft-managed certificate, which Microsoft documents as a preview feature.

Microsoft’s current documentation lists limits worth testing:

• No HTTP/2 negotiation. Most sites fall back to HTTP/1.1. Sites that require HTTP/2 will not load unless you add a bypass.
• Certificate pinning. Pinned apps, common on mobile, need bypass rules. We cover the general problem in certificate pinning and SSL inspection.
• Scale limits. Up to 100 TLS inspection policies, 1,000 rules, and 8,000 destinations per tenant.

Does Entra Internet Access add latency?

Yes, for anything routed through the Internet Access profile, because the gateway sits in Microsoft’s cloud and the request has to reach it first. A large network helps. It does not remove the trip. Measured cloud-proxy latency typically runs 40 to 80 milliseconds near a point of presence and 150 to 400 milliseconds when users are far from one, and a modern SaaS page chains dozens of requests. The math is in the latency math behind cloud proxy SWGs, and the tunnel trade-offs are in split tunnel vs full tunnel.

How much is the detour costing you? Run the Fly-Direct Speed Test to measure your real round-trip latency, or book a 20-minute demo to see on-device inspection live.

What Entra Internet Access does well

• Identity in the policy. Conditional Access can require a compliant network, and the same Entra groups drive web policy. No second identity system to sync.
• Tenant restrictions for Microsoft 365. Universal tenant restrictions help stop data from leaving through a personal or foreign Microsoft 365 tenant.
• Low marginal price. If you own Entra ID P1 or P2, the Microsoft profile costs nothing extra.
• Faster revocation on Windows. Universal continuous access evaluation now reacts to device signals, with the Windows client prompting reauthentication within minutes.
• A real AI roadmap. Microsoft ships Shadow AI discovery, Generative AI insights, and prompt injection protection with preconfigured support for ChatGPT, Claude, Cohere, DeepSeek, Gemini, Grok, Meta AI, Mistral, Perplexity, Pi, and Qwen.

Where Entra Internet Access falls short heading into 2027

Protocol and platform limits

Microsoft’s known limitations page for Global Secure Access, last updated September 30, 2026, lists constraints that matter for a mixed, remote workforce:

• No QUIC or UDP for Internet Access. UDP on ports 80 and 443 is not tunneled. Microsoft suggests blocking QUIC so browsers fall back to TCP.
• IPv4 only. IPv6 traffic is not acquired and goes direct unless you set adapters to prefer IPv4.
• Secure DNS must be off. DNS over HTTPS, DNS over TLS, and DNSSEC are not supported by the client.
• Virtualization gaps. The client cannot run on a machine that hosts virtual machines, and multi-session Azure Virtual Desktop is not supported.
• Fail behavior is a choice. When the cloud connection fails, traffic goes direct or is blocked, depending on how each rule is hardened.
• Government clouds. Available in GCC, but not yet in GCC High, DoD, or other sovereign clouds.

DLP and AI controls arrive as a stack of prerequisites

Content policies can allow or block file and text types on their own, or hand content to Purview with "Scan with Purview." Microsoft’s documentation sets clear limits on that path: content over 3 MB is not scanned, OCR is not supported, only traffic tied to an Entra user identity is sent to Purview, and when Purview cannot finish a scan, traffic is allowed through. It also requires TLS inspection, an Entra joined or hybrid joined device, and a matching Purview DLP policy for inline web traffic.

Prompt injection protection has its own list: text prompts only, JSON-based AI apps only, prompts truncated at 64,000 characters, TLS inspection on, and Windows devices that are Entra joined or hybrid joined. Each piece is real. Together they are a project before you can say "we govern AI."

The hardest AI test is still the same: allow the corporate ChatGPT workspace, block personal ChatGPT on the same domain, and see what is inside the prompt. Universal tenant restrictions focus on Microsoft tenants. Other AI tenants are a separate question to prove in a pilot. We walk through the test in how to block personal ChatGPT while keeping the corporate account.

Entra Internet Access vs dope.security: the head-to-head

• Where inspection happens. Entra Internet Access inspects at Microsoft’s SSE edge after the client tunnels traffic there. dope.security inspects on the device with an on-device SSL inspection proxy.
• Network path. Entra sends web traffic through Microsoft’s edge, and sites see an edge IP. dope.security flies direct to the destination, with up to 4x performance over legacy proxy SWGs.
• AI tenant control. Entra’s universal tenant restrictions center on Microsoft tenants. dope.security Cloud Application Control allows enterprise tenants and blocks personal ChatGPT, Claude, Google, and Microsoft 365 logins on the same domain.
• DLP for prompts and uploads. Entra hands content to Purview with a 3 MB cap, no OCR, and fail-open behavior on incomplete scans. Dopamine DLP extracts text from prompts and uploads on the device and classifies them by meaning with an LLM with zero data retention, with no regex rules to write.
• AI visibility. dope.security AI Analytics shows every AI app in use, with personal versus enterprise accounts, and lets you block from the same screen.
• Licensing shape. Entra Internet Access rides on Entra ID P1 or P2, with Purview licensing for inline DLP. dope.security runs SWG, CASB Neural, and Dopamine DLP under one dope.console.
• Footprint. The dope.security agent runs on Mac and Windows using under 100 MB of RAM.

For the wider field, see secure web gateway vendors in 2026 and Microsoft Purview DLP alternatives. If Microsoft 365 data is the core worry, our Microsoft 365 DLP breakdown covers what E3 and E5 include.

Do you need Entra Internet Access, or just the Microsoft profile?

Here is the practical split. The Microsoft traffic profile is included with Entra ID P1 or P2 and does useful, Microsoft-specific work: tenant restrictions, compliant network checks, and better sign-in logs. Many teams can turn it on and stop there for Microsoft 365.

The paid Internet Access profile is where you are buying a general secure web gateway. That is the decision to evaluate against alternatives, because that is where the detour, the protocol limits, and the AI prerequisites live. If the priority is protecting laptops that work from anywhere, with AI tenant control and prompt-level DLP that does not wait on a cloud edge, a device-first gateway is the cleaner fit. Rollout does not have to be a project: Outreach Health secured 99% of its devices within one week and cut web access tickets by 70% in 90 days.

The bottom line on Microsoft Entra Internet Access

Entra Internet Access earns its place on Microsoft traffic, where identity and tenant restrictions do real work. For the open web it is a cloud proxy with documented protocol limits and AI controls that arrive as a stack of prerequisites. If you want web security, AI tenant control, and DLP to run on the laptop and send traffic straight to its destination, that is what dope.security was built to do. Explore the Fly-Direct Secure Web Gateway or book a 20-minute demo and we will run the personal ChatGPT test live.

Frequently asked questions

What is the difference between Entra Internet Access and Global Secure Access?

Global Secure Access is the umbrella name for Microsoft’s Security Service Edge. It includes Microsoft Entra Internet Access, the secure web gateway, and Microsoft Entra Private Access, the zero trust network access service. Both use the same client and Microsoft’s SSE edge.

How much does Microsoft Entra Internet Access cost?

Microsoft lists Entra Internet Access at $5 per user per month on an annual commitment and the Entra Suite at $12. Both require Entra ID P1 or P2. Inline DLP through Purview needs Purview licensing and pay-as-you-go activation. Confirm current pricing with Microsoft before budgeting.

Is TLS inspection generally available in Entra Internet Access?

Yes. Microsoft made TLS inspection for Entra Internet Access generally available in November 2025. It does not negotiate HTTP/2, so HTTP/2-only sites need a bypass, and certificate-pinned apps need bypass rules too.

Can Entra Internet Access block personal ChatGPT accounts?

Entra’s universal tenant restrictions are built around Microsoft tenants, and Microsoft offers Shadow AI discovery and prompt injection protection for AI apps. Validate the exact corporate-versus-personal policy you need for non-Microsoft AI tools in a pilot. dope.security Cloud Application Control blocks personal ChatGPT, Claude, Google, and Microsoft 365 logins on the device while allowing corporate tenants.

Can I run dope.security alongside Microsoft Entra?

Yes. dope.security supports single sign-on through OIDC and deploys through device management such as Intune. Many teams keep Entra ID for identity and the Microsoft traffic profile for Microsoft 365, and use dope.security as the secure web gateway, AI governance, and DLP layer on the device.