Skip to content
← Licensing FAQ

Global Secure Access vs Always On VPN vs DirectAccess

By ClearSourcePublished Last checked

Every Microsoft option for remote access, from Microsoft Entra Private Access to VPN Gateway and Cloud PCs, with licences and prices.

In short:

  • Microsoft Entra Private Access: organisations replacing their VPN with access to each private app on its own, signed in through Microsoft Entra ID
  • Application proxy: publishing a handful of internal web apps with Microsoft Entra SSO
  • Always On VPN: organisations with Windows Server infrastructure needing full-tunnel/device-tunnel VPN
  • Azure VPN Gateway P2S: remote access to Azure-hosted workloads
  • Windows 365 / AVD: contractors, BYOD, or apps that must stay in the datacenter/cloud

ClearSource’s reading of Microsoft’s documentation — not a recommendation for your situation.

Microsoft Entra Private Access (Global Secure Access) CHF 4.00, Microsoft Entra Internet Access (Global Secure Access) CHF 4.00 per user and month. Microsoft list prices for Switzerland, annual commitment, excl. VAT, as of 4 October 2026; IT partners often quote lower.

The upgrade path

CHF list price per user and month, annual commitment, excl. VAT

  1. Entra Private Access (Global Secure Access)
    CHF 4.00

    Needs: Users need Microsoft Entra ID P1 or P2 · Private network connector on-premises (same connector as application proxy)

    Includes
    • Per-app access to private apps on any port/protocol (ZTNA: users reach single apps, not the whole network), Quick Access, per-app TCP/UDP, private DNS, Kerberos SSO; builds on Microsoft Entra application proxy
    • Clients for Windows, macOS, iOS, Android
    • Included in Microsoft Entra Suite (CHF 9.70) and therefore in Microsoft 365 E7
  2. +0.00
    Entra Internet Access (Global Secure Access)
    CHF 4.00

    Needs: Microsoft Entra ID P1 or P2

    Includes
    • SWG: web content filtering, TLS inspection, prompt-injection protection, DLP
    • Microsoft traffic profile (Internet Access for Microsoft services: universal tenant restrictions, compliant network check, source IP restoration) is included in Microsoft Entra ID P1/P2 at no extra cost
  3. +31.90
    Windows 365 Enterprise (Cloud PC as access pattern)
    CHF 35.90

    Needs: Users need Windows E3, Microsoft Intune, Microsoft Entra ID P1 and Windows 365 licences (e.g. via Microsoft 365 E3/E5)

    Includes
    • Other de-ch configs: Basic 2vCPU/4GB CHF 27.10, Premium 4vCPU/16GB CHF 57.70, GPU Standard CHF 271.20
    • Switzerland North is a supported Cloud PC region

The options

  • Security

    Microsoft Entra Private Access (Global Secure Access)

    CHF 4.00

    user/month

    Microsoft list price for Switzerland, excl. VAT, as of 4 October 2026 [1]

    Lowest list price

    Includes

    • Per-app access to private apps on any port/protocol (ZTNA: users reach single apps, not the whole network), Quick Access, per-app TCP/UDP, private DNS, Kerberos SSO; builds on Microsoft Entra application proxy [2]
    • Clients for Windows, macOS, iOS, Android [2]
    • Included in Microsoft Entra Suite (CHF 9.70) and therefore in Microsoft 365 E7 [3]

    Requires

    • Users need Microsoft Entra ID P1 or P2 [2]
    • Private network connector on-premises (same connector as application proxy) [4]
  • Security

    Microsoft Entra Internet Access (Global Secure Access)

    CHF 4.00

    user/month

    Microsoft list price for Switzerland, excl. VAT, as of 4 October 2026 [1]

    Lowest list price

    Includes

    • SWG: web content filtering, TLS inspection, prompt-injection protection, DLP [2]
    • Microsoft traffic profile (Internet Access for Microsoft services: universal tenant restrictions, compliant network check, source IP restoration) is included in Microsoft Entra ID P1/P2 at no extra cost [2]

    Limits

    • Remote networks (branch connectivity) need at least 50 combined Microsoft Entra ID P1 + Internet Access licences [2]

    Requires

    • Microsoft Entra ID P1 or P2 [2]
  • Add-on

    Always On VPN (Windows Server RRAS)

    ≈ CHF 967.72

    16-core Windows Server 2025 Standard licence · one-time MSRP; Windows Server CALs additionally required for every user or device accessing the server

    Converted from USD 1'176.00, list price read on 24 September 2026, at 0.8229 (ECB, 23 September 2026) — no CHF price published [5]

    Includes

    • Windows built-in VPN client, IKEv2 with SSTP fallback, user + device tunnel, per-app VPN, traffic filters, Conditional Access integration (short-lived Microsoft Entra-issued certificate), Microsoft Intune/ConfigMgr deployment of ProfileXML [6]
    • Server side: RRAS VPN server + NPS (RADIUS); Windows client available in all Windows editions [6]

    Limits

    • Device Tunnel only on domain-joined Windows 10/11 Enterprise or Education (1709+) [6]
    • Remote Access (VPN/DirectAccess) is not supported on Azure VMs [7]

    Requires

    • Windows Server licence (core-based) + Windows Server CALs; Azure Arc pay-as-you-go alternative $33.58 per core/month [5]
  • Add-on

    DirectAccess (deprecated)

    No separate list price — see what it requires

    Includes

    • Always-connected remote access for domain-joined clients without user-initiated VPN [7]

    Limits

    • Deprecated (announced June 2024) and will be removed in a future release of Windows; Microsoft recommends migrating to Always On VPN. No removal date published. [8]
    • Microsoft highly recommends Always On VPN instead of DirectAccess for new deployments [7]
    • Only domain-joined Windows Enterprise clients [7]

    Requires

    • Windows Server with Remote Access role + domain-joined Windows Enterprise clients [7]
  • Add-on

    Azure VPN Gateway point-to-site (Switzerland North)

    CHF 111.47

    gateway/month (VpnGw1, 730 h x CHF 0.1527/h) · Azure pay-as-you-go retail, excl. data egress

    List price, excl. VAT, as of 24 September 2026 [9]

    Includes

    • Protocols: OpenVPN (Windows/macOS/Linux/iOS/Android), SSTP (Windows), IKEv2; auth via certificate, RADIUS/AD or Microsoft Entra ID (OpenVPN + Azure VPN Client only; enables Conditional Access + MFA) [10]
    • CHF hourly (switzerlandnorth): Basic 0.0289 (~CHF 21.10/mo), VpnGw1 0.1527, VpnGw1AZ 0.1688 (~CHF 123.22/mo), VpnGw2 0.3939 (~CHF 287.55/mo), VpnGw3 1.0048, VpnGw4 1.6881, VpnGw5 2.9341; P2S connection beyond included 0.008/h; S2S connection 0.0121/h [9]
    • First 128 P2S connections included; max P2S per SKU: Basic 128, VpnGw1 250, VpnGw2 500, VpnGw3 1,000, VpnGw4 5,000, VpnGw5 10,000; egress charged at standard data-transfer rates [11]

    Limits

    • Reaches Azure VNets (on-prem only via S2S/ExpressRoute); Basic SKU lacks IKEv2, IPv6 and RADIUS [10]
    • Azure VPN Client for Linux (Preview) retired 2026-08-31; manually registered Azure VPN Client app IDs retire 2028-03-31 [10]

    Requires

    • Azure subscription; Microsoft Entra ID auth itself has no separate licence stated in docs (Conditional Access policies require Entra ID P1) [10]
  • Security

    Microsoft Entra application proxy

    No separate list price — see what it requires

    Includes

    • Publishes on-premises web apps (IWA/KCD, header-based, forms, SAML, RD Gateway, MSAL rich clients, WebSockets) via outbound-only private network connector with Microsoft Entra pre-authentication and Conditional Access [12]

    Limits

    • HTTP/HTTPS web publishing only (external URL on TCP 80/443); no client-certificate auth to back-end; not intended for internal users [4]
    • If the licence expires, application proxy is automatically disabled (config kept up to 1 year) [4]

    Requires

    • Microsoft Entra ID P1 or P2 licence [4]
  • Enterprise

    Windows 365 Enterprise (Cloud PC as access pattern)

    CHF 35.90

    user/month · Standard 2 vCPU/8 GB/128 GB, excl. VAT (de-ch page; showed 'currently unavailable in your region' to the fetcher)

    List price, excl. VAT, as of 24 September 2026 [13]

    Includes

    • Other de-ch configs: Basic 2vCPU/4GB CHF 27.10, Premium 4vCPU/16GB CHF 57.70, GPU Standard CHF 271.20 [13]
    • Switzerland North is a supported Cloud PC region [14]

    Requires

    • Users need Windows E3, Microsoft Intune, Microsoft Entra ID P1 and Windows 365 licences (e.g. via Microsoft 365 E3/E5) [14]
  • Add-on

    Azure Virtual Desktop

    No separate list price — see what it requires

    Includes

    • Access rights included in Microsoft 365 E3/E5/A3/A5/F3/Business Premium, Windows Enterprise E3/E5, Windows VDA per user; Azure compute/storage billed separately [15]

    Requires

    • Windows Server session hosts require RDS CALs with SA or RDS User Subscription Licences [15]
    • External commercial users: per-user access pricing via enrolled Azure subscription [15]

Key differences

  1. Application proxy = web apps only; Private Access = any TCP/UDP app with the same connector, one app at a time [2]
  2. Microsoft Entra ID P1 includes the Microsoft traffic profile of Global Secure Access and application proxy; Private/Internet Access for other traffic are paid (CHF 4.00 each or Entra Suite CHF 9.70) [3]
  3. Always On VPN is the Microsoft-recommended successor to DirectAccess; both are Windows Server Remote Access roles licensed through Windows Server + CALs [8]
  4. Windows 365 / AVD move the session to the cloud instead of bringing the device onto the network [15]

What changed recently

  1. 2024-06

    DirectAccess deprecation announced (June 2024) [8]

  2. 31 August 2026

    Azure VPN Client for Linux (Preview) retired [10]

  3. Windows 365 Frontline renamed Windows 365 Flex [14]

Where Microsoft’s own pages disagree

  • Microsoft 365 F3: the Windows 11 Enterprise right is footnoted as “VDI only for licensed users of a shared device with a Qualifying OS (except for Azure Virtual Desktop)”, while the Azure Virtual Desktop licensing page lists F3 plainly as an eligible licence. [16] [15]
  • The Always On VPN overview (updated 30 July 2026) still mentions Windows Information Protection, which Microsoft removed from Windows 11 24H2. [6] [8]

Sources

  1. 1Microsoft Entra – Preise (microsoft.com/de-ch) (25 September 2026)
  2. 2What is Global Secure Access? (Microsoft Learn) (19 May 2026)
  3. 3Microsoft Entra pricing (de-ch) (24 September 2026)
  4. 4Microsoft Entra application proxy FAQ (Microsoft Learn) (1 May 2026)
  5. 5Windows Server 2025 pricing (en-us) (24 September 2026)
  6. 6About Always On VPN for Windows Server Remote Access (Microsoft Learn) (30 July 2026)
  7. 7DirectAccess (Microsoft Learn, Windows Server) (16 February 2026)
  8. 8Deprecated features in the Windows client (Microsoft Learn) (27 August 2026)
  9. 9Azure Retail Prices API - VPN Gateway, switzerlandnorth, CHF (24 September 2026)
  10. 10About Azure Point-to-Site VPN connections (Microsoft Learn) (15 September 2026)
  11. 11Azure VPN Gateway pricing (24 September 2026)
  12. 12Publish on-premises apps with Microsoft Entra application proxy (Microsoft Learn) (12 May 2026)
  13. 13Windows 365 Enterprise compare plans & pricing (de-ch) (24 September 2026)
  14. 14Windows 365 requirements (Microsoft Learn) (4 September 2026)
  15. 15Licensing Azure Virtual Desktop (Microsoft Learn) (18 November 2025)
  16. 16Changing from a Microsoft 365 E plan to a Microsoft 365 F plan (Microsoft Learn) (3 August 2026)

Microsoft’s own pages, read on or before 25 September 2026.

Microsoft changes for these products

All Microsoft changes →
  1. Microsoft 365 E7: in CSP from 1 May 2026 with launch discounts of 10–15% until 31 December 2026

Want offers for these licences?

Free and without obligation: checked Swiss IT partners send you an offer. Nothing goes out until you confirm by email.

What next?

Model it for your organisationEnter your headcount and see the cost at Microsoft’s Swiss list prices, with a check for gaps and overlaps.Open the licence modeller →Find a Swiss IT partner162 Swiss IT partners that sell Microsoft licences. Filter by canton, language and product.IT partners for Security & identity →

Keep reading

Related comparisons