Global Secure Access vs Always On VPN vs DirectAccess

The options

• Microsoft Entra Private Access (Global Secure Access)

  CHF 4.00

  user/month

  Microsoft list price for Switzerland, excl. VAT, as of 25 September 20261

  Includes

  • ✓ZTNA to private apps on any port/protocol, Quick Access, per-app TCP/UDP, private DNS, Kerberos SSO; builds on Entra application proxy2
  • ✓Clients for Windows, macOS, iOS, Android2
  • ✓Included in Microsoft Entra Suite (CHF 9.70) and therefore in Microsoft 365 E73

  Requires

  • →Users need Entra ID P1 or P22
  • →Private network connector on-premises (same connector as application proxy)4

• Microsoft Entra Internet Access (Global Secure Access)

  CHF 4.00

  user/month

  Microsoft list price for Switzerland, excl. VAT, as of 25 September 20261

  Includes

  • ✓SWG: web content filtering, TLS inspection, prompt-injection protection, DLP2
  • ✓Microsoft traffic profile (Internet Access for Microsoft services: universal tenant restrictions, compliant network check, source IP restoration) is included in Entra ID P1/P2 at no extra cost2

  Limits

  • –Remote networks (branch connectivity) need >=50 combined Entra ID P1 + Internet Access licences2

  Requires

  • →Entra ID P1 or P22

• Always On VPN (Windows Server RRAS)

  CHF 967.72

  16-core Windows Server 2025 Standard licence · one-time MSRP; Windows Server CALs additionally required for every user or device accessing the server

  Converted from USD 1,176.00 at 0.8229 (ECB, 23 September 2026) — no CHF price published5

  Includes

  • ✓Windows built-in VPN client, IKEv2 with SSTP fallback, user + device tunnel, per-app VPN, traffic filters, Conditional Access integration (short-lived Entra-issued certificate), Intune/ConfigMgr deployment of ProfileXML6
  • ✓Server side: RRAS VPN server + NPS (RADIUS); Windows client available in all Windows editions6

  Limits

  • –Device Tunnel only on domain-joined Windows 10/11 Enterprise or Education (1709+)6
  • –Remote Access (VPN/DirectAccess) is not supported on Azure VMs7

  Requires

  • →Windows Server licence (core-based) + Windows Server CALs; Azure Arc pay-as-you-go alternative $33.58 per core/month5

• DirectAccess (deprecated)

  No separate list price — see what it requires

  Includes

  • ✓Always-connected remote access for domain-joined clients without user-initiated VPN7

  Limits

  • –Deprecated (announced June 2024) and will be removed in a future release of Windows; Microsoft recommends migrating to Always On VPN. No removal date published.8
  • –Microsoft highly recommends Always On VPN instead of DirectAccess for new deployments7
  • –Only domain-joined Windows Enterprise clients7

  Requires

  • →Windows Server with Remote Access role + domain-joined Windows Enterprise clients7

• Azure VPN Gateway point-to-site (Switzerland North)

  CHF 111.47

  gateway/month (VpnGw1, 730 h x CHF 0.1527/h) · Azure pay-as-you-go retail, excl. data egress

  List price, excl. VAT, as of 24 September 20269

  Includes

  • ✓Protocols: OpenVPN (Windows/macOS/Linux/iOS/Android), SSTP (Windows), IKEv2; auth via certificate, RADIUS/AD or Microsoft Entra ID (OpenVPN + Azure VPN Client only; enables Conditional Access + MFA)10
  • ✓CHF hourly (switzerlandnorth): Basic 0.0289 (~CHF 21.10/mo), VpnGw1 0.1527, VpnGw1AZ 0.1688 (~CHF 123.22/mo), VpnGw2 0.3939 (~CHF 287.55/mo), VpnGw3 1.0048, VpnGw4 1.6881, VpnGw5 2.9341; P2S connection beyond included 0.008/h; S2S connection 0.0121/h9
  • ✓First 128 P2S connections included; max P2S per SKU: Basic 128, VpnGw1 250, VpnGw2 500, VpnGw3 1,000, VpnGw4 5,000, VpnGw5 10,000; egress charged at standard data-transfer rates11

  Limits

  • –Reaches Azure VNets (on-prem only via S2S/ExpressRoute); Basic SKU lacks IKEv2, IPv6 and RADIUS10
  • –Azure VPN Client for Linux (Preview) retired 2026-08-31; manually registered Azure VPN Client app IDs retire 2028-03-3110

  Requires

  • →Azure subscription; Entra ID auth itself has no separate licence stated in docs (Conditional Access policies require Entra ID P1)10

• Microsoft Entra application proxy

  No separate list price — see what it requires

  Includes

  • ✓Publishes on-premises web apps (IWA/KCD, header-based, forms, SAML, RD Gateway, MSAL rich clients, WebSockets) via outbound-only private network connector with Entra pre-authentication and Conditional Access12

  Limits

  • –HTTP/HTTPS web publishing only (external URL on TCP 80/443); no client-certificate auth to back-end; not intended for internal users4
  • –If the licence expires, application proxy is automatically disabled (config kept up to 1 year)4

  Requires

  • →Microsoft Entra ID P1 or P2 licence4

• Windows 365 Enterprise (Cloud PC as access pattern)

  CHF 35.90

  user/month · Standard 2 vCPU/8 GB/128 GB, excl. VAT (de-ch page; showed 'currently unavailable in your region' to the fetcher)

  List price, excl. VAT, as of 24 September 202613

  Includes

  • ✓Other de-ch configs: Basic 2vCPU/4GB CHF 27.10, Premium 4vCPU/16GB CHF 57.70, GPU Standard CHF 271.2013
  • ✓Switzerland North is a supported Cloud PC region14

  Requires

  • →Users need Windows E3, Intune, Microsoft Entra ID P1 and Windows 365 licences (e.g. via M365 E3/E5)14

• Azure Virtual Desktop

  No separate list price — see what it requires

  Includes

  • ✓Access rights included in M365 E3/E5/A3/A5/F3/Business Premium, Windows Enterprise E3/E5, Windows VDA per user; Azure compute/storage billed separately15

  Requires

  • →Windows Server session hosts require RDS CALs with SA or RDS User Subscription Licences15
  • →External commercial users: per-user access pricing via enrolled Azure subscription15

Key differences

1. 1Application proxy = web apps only; Private Access = any TCP/UDP app with same connector, per-app ZTNA2
2. 2Entra ID P1 includes the Microsoft traffic profile of Global Secure Access and application proxy; Private/Internet Access for other traffic are paid (CHF 4.00 each or Entra Suite CHF 9.70)3
3. 3Always On VPN is the Microsoft-recommended successor to DirectAccess; both are Windows Server Remote Access roles licensed through Windows Server + CALs8
4. 4Windows 365 / AVD move the session to the cloud instead of bringing the device onto the network15

Who it’s for

• Entra Private Access: organisations replacing VPN with identity-centric ZTNA
• Application proxy: publishing a handful of internal web apps with Entra SSO
• Always On VPN: organisations with Windows Server infrastructure needing full-tunnel/device-tunnel VPN
• Azure VPN Gateway P2S: remote access to Azure-hosted workloads
• Windows 365 / AVD: contractors, BYOD, or apps that must stay in the datacenter/cloud

ClearSource’s reading of Microsoft’s documentation — not a recommendation for your situation.

What changed recently

1. 2024-06

   DirectAccess deprecation announced (June 2024)8

2. 31 August 2026

   Azure VPN Client for Linux (Preview) retired10

3. Windows 365 Frontline renamed Windows 365 Flex14