Add and delete remote networks device links

You can create device links when you create a new remote network or add them after the remote network is created.

This article explains how to add and delete device links for remote networks for Global Secure Access.


To configure remote networks, you must have:

  • A Global Secure Access Administrator role in Microsoft Entra ID.
  • Created a remote network.
  • The preview requires a Microsoft Entra ID P1 license. If needed, you can purchase licenses or get trial licenses.

You can add a device link to a remote network at any time.

  1. Sign in to the Microsoft Entra admin center as a Global Secure Access Administrator.

  2. Browse to Global Secure Access (preview) > Devices > Remote network.

  3. Select a remote network from the list.

    Screenshot of the remote network page, with the existing branches highlighted.

  4. Select Links from the menu.

  5. Select the + Add a link button.

    Screenshot of the Links area with the add a link button highlighted.

There are several details to enter on the General tab. Pay close attention to the Peer and Local BGP addresses. The peer and local details are reversed, depending on where the configuration is completed.

Screenshot of the general tab of the create device link process.

  1. Enter the following details:
    • Link name: Name of your CPE.
    • Device type: Choose a device option from the dropdown list.
    • IP address: Public IP address of your device.
    • Peer BGP address: Enter the BGP IP address of your CPE.
      • This address is entered as the local BGP IP address on the CPE.
    • Local BGP address: Enter a BGP IP address that is not part of your on-premises network where your CPE resides.
      • For example, if your on-premises network is, then you can use as your Local BGP address.
      • This address is entered as the peer BGP​​ IP address on your CPE.
    • Link ASN: Provide the autonomous system number (ASN) of the CPE.
      • A BGP-enabled connection between two network gateways requires that they have different ASNs.
      • For more information, see the Valid ASNs section of the Remote network configurations article.
    • Redundancy: Select either No redundancy or Zone redundancy for your IPSec tunnel.
    • Zone redundant local BGP address: This optional field shows up only when you select Zone redundancy.
      • Enter a BGP IP address that is not part of your on-premises network where your CPE resides and is different from the Local BGP address.
    • Bandwidth capacity (Mbps): Specify tunnel bandwidth. Available options are 250, 500, 750, and 1000 Mbps.
  2. Select the Next button.

The Details tab is where you establish the bidirectional communication channel between Global Secure Access and your CPE. Configure your IPSec/IKE policy and select the Next button.

Screenshot of the default device link details.

  • IKEv2 is selected by default. Currently only IKEv2 is supported.
  • The IPSec/IKE policy is set to Default but you can change to Custom.
  • If you choose the custom IPSec/IKE policy, first review the How to create remote network with custom IKE policy article.
  • If you select Custom, you must use a combination of settings that are supported by Global Secure Access. The valid configurations you can use are mapped out in the Remote network valid configurations reference article.
  • Whether you choose Default or Custom, the IPSec/IKE policy you specify must match the policy you enter on your CPE.
  1. Enter the Pre-shared key (PSK). The same secret key must be used on your CPE.

  2. Select the Save button.

    Screenshot of the security tab for the device link.

You can delete device links through the Microsoft Entra admin center and using the Microsoft Graph API.

  1. Sign in to the Microsoft Entra admin center as a Global Secure Access Administrator.

  2. Browse to Global Secure Access (preview) > Devices > Remote network. Device links appear in the Links column on the list of remote networks.

  3. Select the device link from the Links column to access the device link details page.

  4. Select the Delete icon for the device link you need to delete. A confirmation dialog appears. Select Delete to confirm the deletion.

    Screenshot of the delete icon for remote network device links.

Terms of Use

Your use of the Microsoft Entra Private Access and Microsoft Entra Internet Access preview experiences and features is governed by the preview online service terms and conditions of the agreement(s) under which you obtained the services. Previews may be subject to reduced or different security, compliance, and privacy commitments, as further explained in the Universal License Terms for Online Services and the Microsoft Products and Services Data Protection Addendum (“DPA”), and any other notices provided with the Preview.

Next steps