To connect on-premises Linux devices to Global Secure Access for Internet Access, a network-level connection is required. This is because the Global Secure Access Client software is currently only available for Windows devices. The correct method is to create a remote network, which establishes a secure IPsec VPN tunnel from the on-premises network's edge router or firewall to the Global Secure Access service. This configuration routes all outbound internet traffic from devices within that network, including the Linux devices, through the Microsoft Security Service Edge (SSE) solution without requiring any client software on the individual endpoints.

A. Deploy a private network connector.

This is incorrect. Private network connectors are components of Microsoft Entra Private Access, used to provide secure access to on-premises applications, not for forwarding general internet traffic.

B. Configure the Adaptive Access settings.

This is incorrect. Adaptive Access is a feature for applying granular, risk-based Conditional Access policies to traffic after connectivity to Global Secure Access has been established.

C. Install the Azure Connected Machine agent on the devices.

This is incorrect. The Azure Connected Machine agent is part of Azure Arc and is used to manage on-premises servers with Azure management services; it does not function as a network client for Global Secure Access.

1. Microsoft Entra documentation

"How to configure remote network connectivity for Microsoft Entra Internet Access." This document explicitly states

"You can connect remote networks

such as a branch office location

to Global Secure Access... This remote network connectivity creates an IPsec tunnel from your on-premises customer premises equipment (CPE) to the nearest Global Secure Access endpoint." This is the client-agnostic method that supports devices like Linux.

2. Microsoft Entra documentation

"The Global Secure Access Client for Windows (preview)." This source confirms that the endpoint client is specifically for the Windows operating system

thereby necessitating a different approach (remote network) for other operating systems like Linux.

3. Microsoft Entra documentation

"Configure connectors for Microsoft Entra Private Access." This document clarifies the role of connectors: "Connectors are lightweight agents that sit on-premises... The connector facilitates the outbound connection to the Global Secure Access service." This confirms their use is for Private Access

not Internet Access.

4. Azure Arc documentation

"Azure Connected Machine agent overview." This source details the agent's purpose: "The Azure Connected Machine agent enables you to manage your Windows and Linux machines hosted outside of Azure on your corporate network... This agent does not replace the Azure Log Analytics agent... or any other agent that you use to monitor or manage your server." This confirms its role is for management

not network traffic forwarding for Global Secure Access.