Using Private Access for the on-premises app and Internet Access for the SaaS app

SC-100 By islever Editorial Last updated Sep 25, 2026

Evaluate solutions for network security and Security Service Edge (SSE)

Short answer

B Use Private Access for the on-premises app and Internet Access for the SaaS app.

Question

You have an on-premises app named App1. Remote users access App1 by using VPN connections. You have a third-party software as a service (SaaS) app named App2. You need to deploy Global Secure Access to manage access to App1 and App2. What should you use for each app?

Microsoft Entra Private Access for App2 and Microsoft Entra Internet Access for App1
Microsoft Entra Private Access for App1 and Microsoft Entra Internet Access for App2 Correct Answer
Microsoft Entra Internet Access for App1 and App2
Microsoft Entra Private Access for App1 and App2

Key Takeaways

Private Access secures access to on-premises/private apps (App1), while Internet Access secures access to SaaS/internet apps (App2); choosing the opposite or the same product for both is incorrect.

For Global Secure Access management of an on-premises app (App1, reached by VPN) and a SaaS app (App2), use Microsoft Entra Private Access for the on-premises app and Microsoft Entra Internet Access for the SaaS app.

Common mistake: Selecting Internet Access for the on-premises app (A/C) — on-premises apps are reached through Private Access, not Internet Access.

Expert Analysis

Why the Answer Is Correct

Microsoft Entra Private Access is the SSE capability for securing access to on-premises and private applications like App1, while Microsoft Entra Internet Access secures access to SaaS and internet applications like App2. Pairing them correctly (Private for App1, Internet for App2) matches the deployment requirement.

Why the Other Options Are Wrong

Using Internet Access for the on-premises App1 (A, C) is wrong because on-premises apps are reached through Private Access. Using Private Access for the SaaS App2 (D) is wrong because SaaS apps are reached through Internet Access.

Community Comment Notes

The community favored B (88 votes). Comments cite the Private Access and Internet Access concept pages and note that the on-prem app needs Private Access and the SaaS app needs Internet Access; a minority inverted the mapping.

Official Reference

https://learn.microsoft.com/en-us/entra/global-secure-access/concept-internet-access

This link opens the official vendor documentation in a new tab.

Community Votes

100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

AlbertE1nstein 👍 3 Answered B

B. Microsoft Entra Private Access for App1 and Microsoft Entra Internet Access for App2
jim85 👍 2 Answered B

for App1: https://learn.microsoft.com/en-us/entra/global-secure-access/concept-private-access for App2: https://learn.microsoft.com/en-us/entra/global-secure-access/concept-internet-access
Ali96 👍 2 Answered B

The best choice is Option B: Microsoft Entra Private Access for App1 (for the on-premises app) and Microsoft Entra Internet Access for App2 (for the SaaS application).
Er_01 👍 1 Answered A

Internet for app1 as it is on prem. Private is no vpn for app2 that is SaaS.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide