Video summary

The Ultimate Microsoft Entra Global Secure Access Migration Guide

Main summary

Key takeaways

Technology

Tech/Product Focus in the Video

The episode (Entro Chat) centers on Microsoft Entra Global Secure Access (GSA) migration, with a focus on tooling that moves configuration from competitor secure access products into:

  • Entra Private Access
  • Entra Internet Access

The speaker first provides background on Entra (formerly “Ashure”) features, then discusses common migration pain points and best-practice pitfalls, especially around:

  • UPN changes
  • Conditional Access (CA) device filtering

Key Migration Tool: “migrate to GSA” (Open Source)

The tooling is an open-source PowerShell toolkit/module available via GitHub (not published to the PowerShell Gallery).

It performs a 3-step workflow:

  1. Export configuration from a source product into local JSON files
    • Uses PowerShell functions/modules based on public API documentation.
  2. Convert/transform exported JSON into a standard CSV schema expected by GSA/Entra provisioning.
  3. Provision into Entra using the Microsoft Graph API
    • PowerShell scripts reference the generated CSVs.

Supported Source Products Mentioned

The toolkit began with Zscaler Private Access → Entra Private Access, then expanded to cover:

  • Zscaler Internet Access → Entra Internet Access
  • Netskope Private Access
    • Also mentions Netskope Secure Web Gateway
  • Cisco Umbrella
  • Palo Alto firewall migration scripts
  • MDE (Microsoft Defender for Endpoint)
    • Scripts to block certain web categories or FQDNs

Additional note:

  • Citrix NetScaler migration was added as well, described as easier due to a more “flat file” configuration style.

Main Feature Details (How the Tool Behaves)

Local export/conversion only

  • Export happens locally.
  • Conversion/transform also happens locally.
  • There’s no “AI” in the conversion execution itself—AI was used during development to help write code/specs.

Consistent output schema

  • Conversion produces CSV(s) in a consistent structure so provisioning can be standardized.
  • For Entra Private Access, some objects are stored in one file.
  • For Entra Internet Access, outputs include files such as policies and security profiles.

Conflict detection & safety controls

During conversion, the tool detects issues such as:

  • Overlapping segments (not safely representable in Entra)

Conflicting items are:

  • flagged
  • set to “Do not provision” by default
  • requiring manual review/fix

Never delete / safety-by-design

  • The provisioning step never deletes configuration
    • Explicitly described as having no single delete API call.
  • It tends to skip existing applications rather than modify them, to avoid breaking active production setups.

Conditional Access handling

  • The tool can provision CA-related artifacts.
    • Example: for Internet Access, CA policies may be created but not enabled automatically.
  • Users are expected to review and enable CA policies after validating what was provisioned.

Retries and throttling

  • Provisioning includes robustness:
    • retries (e.g., waiting for service principals to be ready)
    • throttling handling

Review / Tutorial Guidance Included

Migration is not fully end-to-end

The tool accelerates about the “80%”:

  • translating configuration
  • provisioning bulk objects

…but design and best-practice validation still requires human review.

Manual review step

After conversion, users open/edit CSV files, for example:

  • rename references
  • unselect items
  • adjust group/app connector names
  • assign users/groups

Testing/validation: Conditional Access device filtering

The speaker warns CA device filtering can be bypassed or fail depending on how device identity is derived (e.g., user-agent/usage string manipulation).

Recommended test:

Sign in via browser → open Developer Tools → change the user agent string and confirm whether the intended CA policy triggers.

Additional Entra Concepts / Analysis Mentioned (Non-migration)

UPN rename / mutable identifier issues

  • The guest describes earlier work addressing breakages when users change names/UPNs.
  • Core premise: assuming UPN is immutable was a design flaw.
  • Resulted in fixes across multiple Microsoft services, including:
    • Windows join / PRT-related breakages
    • OneDrive-type behaviors

Conditional Access best-practice pitfalls

Warnings include:

  • Avoid multiple CA policies with overly granular device targeting that leave “holes.”
  • Device targeting that excludes unknown devices can be problematic.
    • Manipulating inputs so device identity can’t be matched may prevent policy application.

Where Best Practices Tools Fit In

The session mentions complementing the migration tool with Microsoft “Mister” / Zero Trust Assessment concepts.

Example mentioned:

  • Checks like “nested groups assigned to Global Secure Access” shouldn’t be relied on because traffic forwarding profiles may apply only to top-level users.

Practical Resource Mentioned

  • Documentation and download location: aka.ms/migrate to GSA
  • GitHub repo link (PowerShell module download/import)

Main Speakers / Sources (End)

  • Andre Canelo (Microsoft) — primary source; creator/major contributor/driver of the migration tooling and Entra expertise.
  • Host (“Entro Chat” interviewer, name not clearly shown in subtitles) — introduces Andre and leads through CA/UPN and tool migration topics.

Original video