Make Stolen Tokens Useless With the Entra ID P1 License You Already Have

Summary

The video explains how Microsoft Entra ID and Global Secure Access (GSA) combine identity and network controls to protect users, devices, sessions, and AI agents.

Two capabilities—source IP restoration and compliant network—are available with Entra ID P1. The speakers say they do not require an advanced GSA license. Organizations still need to route traffic through GSA, for example by deploying the GSA client or using another supported traffic-acquisition method.

Key Features and Analysis

GSA’s identity-and-network model

A client or another traffic-routing method sends network traffic through Microsoft’s distributed GSA service, where organization-defined policies are applied. Because GSA and Entra share security signals, policies can account for user, device, location, and session context.

The speakers argue that this integrated approach enables faster, more consistent protection than treating identity and networking as separate systems.

Source IP restoration

When traffic passes through a proxy, sign-in logs may show the proxy’s address instead of the user’s original IP. GSA can securely pass the original source IP to Entra, helping make sign-in records, IP-based Conditional Access decisions, and location or impossible-travel evaluations more accurate.

Compliant network and stolen-token defense

Entra can recognize traffic coming through a GSA connection associated with the tenant as a compliant network. A Conditional Access policy can require this network for access.

If an attacker steals a refresh token or a Primary Refresh Token (PRT) cookie, the token is not itself bound to a device. However, attempts to use it from outside the organization’s compliant network are blocked.

The signal is tenant-specific: a GSA device associated with one tenant cannot satisfy another tenant’s compliant-network requirement.

BYOD browser protection

Users on personal devices can access work resources through a managed work browser profile without installing the GSA client. In the demo, switching to the work profile applies browser-based GSA routing and policy; an attempt to visit Facebook from that profile is blocked.

The speakers describe the browser approach as a useful option, while noting that the full GSA client offers the broadest set of controls.

Policies for agent traffic

GSA can distinguish some agent-driven network activity from user activity, enabling different policies and logging. One recommended baseline is to block agents from sensitive actions.

In the demo, a policy blocks an agent from sending a Dropbox file-deletion request, even though the user may be allowed to delete the file. The example policy blocks the HTTP DELETE method for agent traffic, but not for user traffic.

Copilot Studio integration

A Copilot Studio administrator can enable GSA integration with a checkbox, routing agents’ internet traffic through GSA so internet-access policies apply. This server-to-server scenario does not require installing GSA clients on end-user devices.

Universal Continuous Access Evaluation (CAE)

When traffic to applications—including private resources—is routed through GSA, GSA can act on Entra CAE signals even if an application does not natively support CAE.

The speakers say an SSH session can be terminated within roughly 2–5 minutes after a relevant identity or device-state change. They also describe recently added device-state signals, including device deletion, disablement, and compliance changes.

Compliant-Network Setup Walkthrough

1. Deploy the GSA client to devices or configure another supported way to route traffic through GSA.
2. In Entra Conditional Access, create a policy targeting the intended users and resources. The demo targets all resources.
3. Configure the policy to block access from all network locations except compliant network locations.
4. Exclude break-glass accounts to avoid locking administrators out.
5. Start in report-only mode. Check coverage and sign-in results, then pilot enforcement with a smaller group before expanding it.

The speakers also stress that network and identity teams may need to work more closely as organizations adopt these integrated controls and manage agentic workloads.

Main Speakers and Sources

• Merill Fernando — Host of Entra Chat.
• Alexander (Alex) Pavlovsky — Global Secure Access product manager; explains GSA architecture, compliant network, Conditional Access, and CAE.
• Marilee (Merily) Turscak — Entra product manager focused on safe AI adoption; presents the BYOD and agent-policy demonstrations.