- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Microsoft Entra Internet Access
Your users sign in through Entra but browse through an old proxy. The web rules should know who they are — Microsoft Entra Internet Access sends each device’s web traffic to Microsoft’s edge — Chennai and Pune among its PoPs — where Conditional Access decides what that user may reach, with TLS inspection generally available since November 2025.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Microsoft platform family
This page covers Microsoft Entra Internet Access — the secure web gateway in Global Secure Access, sold standalone or in the Entra Suite. The rest:
Quick facts
30-second orientation- Product
- Identity-centric secure web gateway, the internet half of Microsoft’s Global Secure Access SSE
- Maker
- Microsoft Corporation, Redmond; sold standalone or inside the Microsoft Entra Suite
- Status
- Generally available since July 2024; TLS inspection reached general availability in November 2025
- Price
- $5 a user a month, paid yearly; Microsoft publishes ₹415 a user a month for India
- Prerequisite
- Every covered user also needs Microsoft Entra ID P1 or P2 ($7 or $10 a user a month)
- Layer
- Forward proxy: the client tunnels TCP web traffic to Microsoft’s edge; no DNS-only tier
- Clients
- Windows and macOS clients; on iOS and Android the Defender for Endpoint app carries the traffic
- CASB
- Not in this SKU; Microsoft’s CASB is Defender for Cloud Apps, licensed separately
- India
- Points of presence in Chennai (South India) and Pune (Central India), both with branch gateways
- In India via
- TechBag — licence mapping against your Entra plans, INR invoicing with GST, a TLS pilot
Understand identity-centric web gateways before you buy one
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is an identity-centric web gateway?
A secure web gateway that takes its rules from who you are — your Entra user, device and risk — not your IP address.
An office proxy behind a VPN vs Entra Internet Access — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | An office proxy behind a VPN | Microsoft Entra Internet Access |
|---|---|---|
| Where filtering happens | An on-site proxy remote users reach over VPN | Microsoft’s edge, from Chennai or Pune |
| Who a rule applies to | An IP range or an AD group synced by hand | The Entra user, device and sign-in risk |
| Laptops off the network | Unfiltered until the VPN comes up | Tunnelled by the Global Secure Access client |
| Encrypted traffic | Inspected on a box sized years ago | TLS inspection at the edge, GA since 2025 |
| Price you can read | Appliance quote, support renewals | $5 or ₹415 a user a month, yearly |
| What it is NOT | — | A CASB, a DNS filter or a malware sandbox |
The cheapest test is a trial on ten managed laptops: switch off Secure DNS, apply category rules, and read the traffic logs a week later.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Client
On Windows and macOS a client acquires TCP web traffic and tunnels it to Microsoft; on iOS and Android the Defender for Endpoint app does the same job.
Identity
The user and device sign in to Entra ID; Conditional Access adds the matching security profile to the access token, so every web rule knows who is asking.
Edge
Microsoft’s points of presence, Chennai and Pune among them, evaluate TLS, web content, threat intelligence, file and DLP policies in a fixed order, then forward or block.
Branches
Branch routers can send traffic over IPsec to the same edge; a baseline profile applies tenant-wide rules there, with internet traffic over branch tunnels in preview.
A client that tunnels web traffic and an edge that reads your Conditional Access token — policy follows the user, not the IP.
Nine capabilities. Filter, inspect, govern.
Entra Internet Access filters the web by who is browsing, using the same Conditional Access that already guards sign-in.
Block by category or domain
Rules allow or block web categories and FQDNs, with wildcards, and apply per user or group through Conditional Access.
Known-bad destinations stopped
A threat intelligence policy blocks high-severity domains and URLs from Microsoft and third-party feeds, with an allow list for false alarms.
Rules for agents, not just people
Source-type rules treat traffic from AI agents apart from users, and HTTP-method rules can stop an agent’s PUT or DELETE calls.
Decrypt at the service edge
HTTPS is decrypted at Microsoft’s edge with your signed intermediate or a Microsoft-managed certificate, then re-encrypted onward.
Control uploads by file type
Content policies block or allow uploads and downloads by MIME type across all destinations; Purview DLP scanning is in preview.
Prompt injection screened
With TLS inspection on, prompt policies check what users send to generative AI apps and block injection attempts in flight.
One policy engine for sign-in and web
The same Conditional Access that gates sign-in delivers the web security profile, so risk, device and group shape browsing rules.
Shadow IT and shadow AI found
Traffic through the edge feeds a discovery view of cloud and generative AI apps in use, without a separate log connector.
Malware scanning, bought apart
For inline malware and deeper DLP, a Netskope offer activates from the Entra marketplace; it needs TLS inspection and its own licence.
Watch Entra Internet Access in action
Configuring TLS inspection, a hands-on tour of the Entra Suite, a launch-era deep dive and Microsoft’s 100-second overview. All from Microsoft’s official Microsoft Security and Microsoft Mechanics channels, 2024 to 2026.
Configure TLS Inspection in Microsoft Entra Internet Access
A six-minute walkthrough: build the certificate, write a TLS inspection policy and link it to a security profile.
Microsoft Entra Suite hands-on tour of identity and network access protections
The Entra Suite end to end, showing where Internet Access sits beside Private Access and identity governance.
A closer look at Microsoft Entra Internet Access
A 23-minute session from just after GA on policies, Conditional Access and the user experience.
Microsoft Entra Internet Access Overview
Microsoft’s 100-second introduction, published on the July 2024 general-availability day.
Want a live, India-context walkthrough for your environment?
Book a guided demo →A proxy sees an IP address. Entra Internet Access sees the user, the device and the risk.
Here’s what genuinely sets it apart — and exactly where it stops.
Web rules that know who is browsing
Policies reach the edge inside the user’s access token, so a block can depend on the group, the device’s compliance or the sign-in risk Entra already calculates. A contractor on an unmanaged laptop and a finance user on a compliant one can get different rules for the same site, written in the Conditional Access screens your identity team already runs.
A published price, in rupees too
Microsoft lists Internet Access at $5 a user a month on a yearly commitment and prints ₹415 on its Indian pricing page, which few gateways do. For estates already paying for Entra ID P1 through Microsoft 365 E3 or E5, the add-on is the whole cost; for others, P1 at $7 (₹580) comes first, so check what you hold.
Indian PoPs and one console for the stack
Microsoft lists Global Secure Access points of presence in Chennai and Pune, each with remote-network gateways for branches. Web filtering, Private Access and the Microsoft traffic profile all sit in the Entra admin center, and traffic logs can be exported through diagnostic settings to a workspace you place in an Indian Azure region.
Where it stops
There is no Microsoft malware scanner inline yet; that comes from a separately bought Netskope offer. URL-path filtering and Purview DLP are in preview, QUIC and IPv6 are not acquired, and HTTP/2-only sites need a TLS bypass. Traffic logs stay 30 days in the product, and Gartner did not place Microsoft in its 2025 or 2026 SSE Magic Quadrant.
The numbers behind the platform
What your Entra Internet Access rollout looks like
Check the licences you already hold
List who has Entra ID P1 through E3, E5 or Business Premium; only they can be covered, and Internet Access is not in E5.
Prepare the devices
Push the client with Intune, switch off Secure DNS in Chrome and Edge, block UDP 443 and set IPv4 preferred on a pilot group.
Filter before you decrypt
Start with category, FQDN and threat-intelligence rules on the baseline profile, then add stricter profiles by group.
Run TLS inspection as a project
Sign the intermediate, deploy the root with Intune, keep the recommended bypass categories and list every pinned app that breaks.
Settle logs and the add-ons
Export traffic logs to an Indian workspace for 180 days, and decide on Defender for Cloud Apps and Netskope ATP.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We already held P1 through E3, so the gateway cost us $5 a head and no new console. Category rules were live in a day.”
“Contractors on personal laptops get a stricter security profile than staff. Conditional Access made that a ten-minute change.”
“Pushing the root certificate with Intune was easy. Finding the pinned mobile apps that broke under inspection took two weeks.”
“Turn off Secure DNS in Chrome and Edge before the pilot, or half the traffic never reaches the client. Nobody told us that.”
“Pune and Chennai PoPs kept page loads normal for our Bengaluru and Hyderabad offices; nobody noticed the switch from the old proxy.”
“Malware scanning needed a separate Netskope deal, and the logs only stay 30 days. Budget both before you sign.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the secure web gateway market — tap any vendor to see why it sits where it does.
TechBag Secure Web & DNS Grid
Execution strength vs product vision — the classic market map, minus the paywall.
$5 or ₹415 a user a month, yearly, plus Entra ID P1.
Inspection Depth × Identity Integration
The grid nobody publishes — how deep a gateway inspects traffic vs how tightly its rules follow the user, device and sign-in risk.
Rules ride on Conditional Access tokens; malware scanning via Netskope.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Entra Internet Access vs the secure web gateway field
Against Zscaler Internet Access, Netskope Next Gen SWG, Cloudflare One Gateway, Cisco Umbrella and Palo Alto Prisma Access — on layer, TLS, roaming, threat and data controls, price, India PoPs and lock-in.
| Dimension | Microsoft Entra Internet Access | Zscaler Internet Access | Netskope Next Gen SWG | Cloudflare One Gateway | Cisco Umbrella | Palo Alto Prisma Access |
|---|---|---|---|---|---|---|
| What it is | Identity-centric SWG | Cloud inline proxy | Instance-aware proxy | DNS + HTTP gateway | DNS layer, then SIG | Cloud-delivered NGFW |
| Enforcement layer | Proxy only | Proxy, no DNS tier | Proxy | DNS and proxy | DNS, proxy at SIG | Proxy plus DNS |
| How traffic arrives | Client; branch preview | Agent, tunnels, PAC | Client and tunnels | WARP, DNS, tunnels | DNS change or client | GlobalProtect, sites |
| TLS inspection | GA Nov 2025, limits | Full, the reference | Full inline | Full at the $7 tier | Selective, SIG only | Full decryption |
| Off-network roaming | Four OS clients | Client Connector | Netskope Client | WARP client | Secure Client module | GlobalProtect |
| Threat protection | Threat intel only | Sandbox by edition | Inline threat engine | AV scan; isolation up | Domains; files at SIG | Advanced threat services |
| Data protection and CASB | No CASB; DLP preview | CASB + DLP editions | CASB heritage, DLP | Both modes; depth extra | API CASB; DLP at SIG | Inline CASB, DLP extra |
| Pricing model | Per user, yearly | Per user, by edition | Per user, platform | Per user, self-serve | Per user, by tier | Quote, users + sites |
| Published entry price | $5 · ₹415/user/mo | ~$6–12 reported | Not published | Free to 50, then $7 | $2.25–6.50/user/mo | Quote only |
| Included vs add-on | P1 needed; CASB apart | Editions add depth | Platform modules | Enterprise for depth | Proxy needs SIG | Services licensed apart |
| India points of presence | Chennai, Pune | 4 Indian cities | 8 Indian data centres | 6 Indian cities | Mumbai, Chennai | 4 Indian locations |
| Analyst standing | Not in the SSE MQ | SSE Leader, 5th year | SSE Leader since 2022 | 2026 SSE Visionary | Evaluated in 2026 | SSE Leader, 4th year |
| Identity and lock-in | Entra identity required | Any SAML identity | Directory-agnostic | Many IdPs, free tier | Point DNS back | Palo Alto policy model |
| Best fit | Entra-first estates | Depth everywhere | Per-app-instance control | Published-price proxy | DNS floor, fast | Palo Alto firewall shops |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Entra Internet Access if…
- ✓Your users already sign in with Entra ID P1, and you want web rules written in the same Conditional Access policies
- ✓A published price matters — $5 or ₹415 a user a month, yearly — and Chennai and Pune PoPs suit your offices
- ✓Your devices are managed, so the client, the root certificate and the DoH settings can all be pushed with Intune
Compare alternatives if…
- ✓You need inline malware sandboxing from one vendor — Zscaler, Netskope and Prisma Access build it in
- ✓You want a cheap DNS-layer floor on every device first — Cisco Umbrella and Cloudflare start there
- ✓Cloud-app instance control or API CASB is the requirement — Netskope does both natively
Do not expect…
- ✓A CASB in the SKU — Defender for Cloud Apps is a separate licence
- ✓QUIC, IPv6 or HTTP/2-only sites to be inspected without workarounds
- ✓A Gartner SSE Magic Quadrant placement in 2025 or 2026
Microsoft Entra Internet Access is one of 44 secure web & DNS products TechBag carries. The Secure Web & DNS guide narrows them to a shortlist and shows the reasoning. →
What does a proxy that ignores identity cost you?
Drag the sliders (users you protect; IT staff-hour cost). Estimates model the IT time spent on VPN backhaul complaints, proxy exceptions and keeping a separate web filter in step with the directory, at an assumed 1.5 hours per user a year, with 70% of it removed by rules that follow Entra identity. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Published: Microsoft lists Entra Internet Access at $5 a user a month, paid yearly on an annual commitment, and shows ₹415 a user a month on its Indian pricing page. Every covered user also needs Entra ID P1 ($7, ₹580) or P2 ($10, ₹830), which Microsoft 365 E3, E5 and Business Premium already include. The Entra Suite bundles Internet Access with Private Access and more at $12 (₹1,000). Defender for Cloud Apps and the Netskope malware add-on are bought separately. TechBag maps what you already hold, then invoices in INR with GST.
Entra Internet Access
Best when your users already hold Entra ID P1
- $5 (₹415) a user a month, paid yearly
- Web filtering, TLS inspection, threat intel
- CASB and malware scanning bought apart
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Microsoft Entra Suite
Best for replacing the VPN and the proxy together
- $12 (₹1,000) a user a month, paid yearly
- Internet Access plus Private Access
- Needs Entra ID P1; special P2 and E5 pricing
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Does every user to be covered hold Entra ID P1 or P2? Internet Access sits on top of it, and E5 does not include it.
Are the devices managed, so the client, root certificate and DoH settings can be pushed? Unmanaged ones fall to Defender for Cloud Apps.
Can you switch off Secure DNS in Chrome, Edge and Windows? The client cannot tunnel traffic that resolves over DoH.
Who signs the intermediate, and which pinned or HTTP/2-only apps need bypass rules? Limits: 100 policies, 8,000 destinations.
Is threat intelligence enough, or will you buy Netskope ATP for inline malware scanning, as a separate licence?
Do you need API scans of SaaS data or session controls? Those are Defender for Cloud Apps; Purview DLP inline is in preview.
CERT-In wants 180 days of logs and its FAQ names proxy logs; the product keeps 30 days. Where will the export live?
SEBI CSCRF 4.b and 4.c ask for proxy servers and web filters; for 4.e DNS filtering, which resolver covers non-client devices?
Questions buyers ask
Ready to evaluate Entra Internet Access?
Count the users who already hold Entra ID P1 first, or let a TechBag advisor pilot the client on one group and plan TLS inspection as the certificate project it is.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.