In short: Harmony SASE Private Access, now Check Point SASE Private Access, is zero trust network access (ZTNA). Users reach only the applications their identity and device posture allow, through the SASE agent or agentlessly, over a full-mesh global private backbone. It also connects offices and cloud networks through dedicated gateways, includes firewall as a service, and is licensed per user.
What Private Access does
Private Access gives employees, contractors and branch offices secure access to applications and data that are not on the public internet: file servers, line-of-business apps, remote desktops, internal web apps and workloads in Azure, AWS or Google Cloud.
Unlike a remote access VPN, which typically gives a connected user a route to the whole network, Private Access applies identity-centric zero trust rules. A user gets the applications their role needs, no more, and only from a device that meets your security requirements. Check Point's own wording is that users need to connect to applications, not the entire network. For the general model, see our ZTNA guide on cloud-security.cloud.
Key capabilities
| Capability | What it means |
|---|---|
| Agent-based ZTNA | The Check Point SASE agent on managed devices connects users to permitted applications and networks |
| Agentless ZTNA | Access without installing an agent to HTTP/HTTPS, RDP, SSH and VNC applications, with Enterprise Browser adding stronger data controls |
| Device posture checks | Verify a device meets your requirements before it connects, then repeat the check while it stays connected |
| Per-application access control | Zero trust rules grant access to specific applications by user and group |
| Device inventory | See the managed devices connecting to your network and their current posture |
| Full-mesh connectivity | Connect any user or site to any resource or data centre, wherever it is |
| Global private backbone | Traffic between points of presence runs over Check Point's own backbone, with multiple tier-1 links at each point of presence, reserved bandwidth and peering agreements |
| Dedicated gateways and firewall as a service | Cloud gateways in the regions you choose, each with its own static IP address, deployable in multiples for redundancy and load balancing, plus network-level policy in the cloud |
| Unified cloud console | Onboard and offboard users, change permissions and add networks in one place |
Access is tied to your identity provider. Check Point documents integrations with Microsoft Entra ID, Okta, Google Workspace, OneLogin, JumpCloud, AD FS and on-premises Active Directory, and SCIM provisioning with Entra ID or Okta keeps users and groups in step with your directory, so disabling a leaver's account also cuts off their access.
What a device posture check can test
Posture checks are where zero trust becomes concrete. If a device fails, the SASE agent blocks its private access. Check Point's admin guide lists checks including:
- Endpoint security: a specific or any supported anti-malware product is running and up to date (Windows, macOS and Linux)
- Firewall: a firewall or Windows Security Center is active (Windows)
- Operating system: a specified OS is installed (Windows and macOS)
- Disk encryption: the hard drive is encrypted (Windows and macOS)
- Device certificate: a valid certificate from a trusted CA is installed (Windows and macOS)
- Domain sign-in: the user is signed in to a specified Active Directory domain (Windows and macOS)
- Files, processes and registry: required or banned files and processes on all three platforms, and registry keys on Windows
Supported endpoint products include Harmony Endpoint (Check Point Endpoint Security), Windows Defender and a range of other anti-malware products.
Replacing your VPN
Private Access is most often bought to retire a remote access VPN. The usual reasons are:
- Exposure: VPN concentrators are internet-facing and have been a frequent target for attackers. With Private Access, users connect to Check Point's gateways and your networks connect to those gateways through tunnels, so users no longer connect directly to your own VPN endpoint
- Lateral movement: a compromised VPN user can often reach far more than they need; per-application access limits the damage
- Performance: users connect automatically to the nearest gateway and travel over the private backbone, instead of everyone funnelling through one office connection
- Administration: one cloud console for users, groups, networks and posture rules
A typical migration connects your networks to Check Point SASE, publishes applications, moves a pilot group, then the rest of the organisation, and finally switches the VPN off. Check Point warns that other agents that tunnel or inspect traffic on the same device may conflict with the SASE agent, so each device should move across in one step.
Third parties, contractors and acquisitions
Private Access accommodates employees, third parties and branch offices under the same policy model. For contractors and agencies you can grant temporary access to the specific applications they support, without issuing them a corporate laptop. Where you cannot install an agent, agentless access or the Check Point Enterprise Browser keeps corporate data off the device.
Check Point also positions Private Access for mergers and acquisitions: it can act as a bridge between separate networks, so you can see and secure an acquired business first, then align identity providers, move cloud services, merge on-premises resources and apply zero trust policies across the combined network.
Sites, clouds and networks
Private Access is not only for remote users. Offices, data centres and cloud networks connect into the SASE network, and the full-mesh design means a user in Manchester can reach an application in an Azure region or a server in a London data centre without routing through head office. Check Point documents IPsec connections from AWS, Azure, Google Cloud and IBM Cloud, from Check Point firewalls and from other vendors' firewalls, plus its own SASE connector.
Sites connect over their existing internet services, so a resilient leased line at key locations is still worthwhile. Where branches need link steering and failover, the SD-WAN component of the Check Point SASE suite can be added.
Licensing and how we help
Private Access is licensed per user, on its own or alongside Internet Access. Every Check Point SASE network needs at least one dedicated gateway, and gateways are licensed alongside users; Check Point withdrew shared gateways from 12 August 2026. We will confirm what your package includes. See Harmony SASE pricing for the factors that affect cost.
Forever Systems audits your current VPN use, maps users to applications, designs networks, gateways and posture rules, integrates your identity provider, runs the pilot and decommissions the old VPN. Contact us to plan a VPN replacement.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Check Point SASE Private Access?
It is the zero trust network access (ZTNA) component of the Check Point SASE platform, formerly Harmony SASE. It gives users access to specific private applications based on identity and device posture, over Check Point's global private backbone.
Can Harmony SASE Private Access replace a VPN?
Yes, for most remote access needs. It grants per-application access instead of network-wide access, checks device posture before and during the connection, and is managed from a cloud console.
Does Private Access need an agent?
Managed devices normally use the Check Point SASE agent. For unmanaged or third-party devices, agentless ZTNA gives access to web, RDP, SSH and VNC applications without installing an agent, and Enterprise Browser adds data isolation and DLP controls.
What is a device posture check?
A check that the connecting device meets your security requirements, for example that anti-malware software is running and up to date, the disk is encrypted or a company certificate is installed. Check Point SASE blocks private access if the device fails, and repeats the check while it stays connected.
How are gateways licensed in Check Point SASE?
Each network needs at least one dedicated gateway with its own static IP address, and you can add more for other regions, redundancy or load balancing. Gateways are licensed alongside users; we will confirm what your package includes when we quote.