4 of the 7 questions we have for this objective, shown with the answer and the reasoning.
Evaluate solutions for network security and Security Service Edge (SSE)
Ashcombe Consulting has 3,000 Windows and macOS laptops used mostly from home and client sites. The company is retiring its on-premises web proxy appliances. Security requires blocking web categories such as gambling and malware for all users, allowing a finance group access to specific banking FQDNs that are blocked for everyone else, and tying these controls to the user's identity and device compliance rather than to the office network. Minimizing new infrastructure is the deciding factor.
What should you recommend?
- ADeploy the Global Secure Access client and use Microsoft Entra Internet Access web content filtering policies in security profiles that are assigned to users through Conditional AccessEntra Internet Access is a cloud-delivered secure web gateway: the client steers internet traffic to Microsoft's edge, web content filtering blocks categories and FQDNs, and security profiles linked to Conditional Access apply different policies per user group and device state with no on-premises hardware.
- BRoute all laptop traffic through a point-to-site VPN into Azure and filter it with Azure Firewall Premium web categoriesThis replaces one hairpin with another, adds VPN gateways and firewall capacity to operate, and applies rules by source IP rather than by user identity and device compliance.
- CUse Microsoft Defender for Cloud Apps Conditional Access App Control session policies to block the categoriesSession policies control actions inside federated cloud applications in the browser; they are not a general secure web gateway for all internet destinations.
- DEnable Microsoft Defender for Endpoint web content filtering onlyDefender for Endpoint web content filtering can block categories by device group, but it cannot express per-user identity and Conditional Access-based allow exceptions for the finance group or enforce policy on devices without Defender for Endpoint.
Why: Microsoft Entra Internet Access is the secure web gateway component of Global Secure Access, Microsoft's Security Service Edge offering: traffic from the client is steered to the cloud edge, web content filtering policies are grouped into security profiles, and Conditional Access links profiles to users and device conditions. The deciding constraints are identity-based policy and no new infrastructure, which eliminate VPN-plus-firewall hairpins. The traps are products that filter at a different scope: Defender for Cloud Apps controls sessions inside SaaS apps, and Defender for Endpoint web filtering is device-group based rather than identity and Conditional Access based.
Evaluate solutions for network security and Security Service Edge (SSE)
Weatherby Actuarial hosts a reporting database in Azure SQL Database named sql-wb-reports. An on-premises reporting server connected to Azure through a site-to-site VPN must query the database, and the compliance team requires that the database have no reachable public endpoint and that all traffic between on-premises and the database stay on private IP addresses.
What should you recommend?
- ACreate a private endpoint for sql-wb-reports in a virtual network reachable over the VPN and disable public network access on the logical serverA private endpoint gives the database a private IP address in the virtual network that is routable over the VPN, and disabling public network access removes the public endpoint entirely.
- BEnable a virtual network service endpoint for Microsoft.Sql on the gateway subnetService endpoints apply only to traffic originating inside Azure virtual networks; on-premises traffic over a VPN cannot use them, and the database keeps its public endpoint.
- CAdd the on-premises server's public IP address to the Azure SQL server-level firewall rulesA firewall allowlist still exposes the public endpoint and sends traffic over the internet rather than private addresses.
- DDeploy Azure Bastion and have the reporting server connect through itBastion provides browser-based RDP and SSH to virtual machines; it is not a connectivity path for a database client application.
Why: The private endpoint versus service endpoint distinction is foundational: a private endpoint assigns the PaaS resource a private IP in your virtual network and allows the public endpoint to be disabled, whereas a service endpoint only optimizes and restricts traffic that already originates in Azure and leaves the public endpoint in place. The deciding constraint is on-premises access over private IPs with no public endpoint, which only Private Link satisfies. The trap is the service endpoint, which is frequently mistaken for a private connectivity feature but is unusable from on-premises.
Evaluate solutions for network security and Security Service Edge (SSE)
Kingsmere Engineering wants to retire its legacy VPN. Remote engineers need RDP to CAD workstations, SMB access to a file server, and an internal HTTP web app, all hosted in two on-premises datacenters. Security requires per-application access with multifactor authentication and device compliance enforced for every connection, including RDP and SMB, and requires that no inbound firewall ports be opened on the datacenter perimeter.
What should you recommend?
- AMicrosoft Entra Private Access with private network connectors in each datacenter, Global Secure Access applications defined per destination and port, and Conditional Access policies requiring MFA and compliant devices on each applicationPrivate Access brokers TCP and UDP traffic, including RDP and SMB, through outbound-only connectors so no inbound ports are needed, and each Global Secure Access application can carry its own Conditional Access policy for identity-aware, per-app Zero Trust access.
- BMicrosoft Entra application proxy for all three applicationsApplication proxy publishes HTTP and HTTPS applications accessed through a browser; it cannot broker RDP or SMB sessions.
- CAzure VPN Gateway point-to-site with Microsoft Entra authentication and ExpressRoute to the datacentersA VPN grants network-level access rather than per-application access, applies Conditional Access only at tunnel establishment, and keeps the VPN model the company wants to retire.
- DAzure Bastion with native client support for RDP, and Azure Files for the shared dataBastion reaches Azure virtual machines, not on-premises workstations, and migrating the file server to Azure Files changes the workload instead of securing access to it.
Why: Microsoft Entra Private Access is the Zero Trust Network Access component of Global Secure Access: private network connectors make outbound-only connections from the datacenter, the Global Secure Access client steers traffic for defined application segments, and because the traffic is brokered at the application level, any TCP or UDP protocol, including RDP and SMB, can be placed behind Conditional Access with MFA and device compliance. The deciding constraints are per-app policy for non-HTTP protocols and no inbound perimeter ports. The trap is Microsoft Entra application proxy, which shares the connector technology but is limited to browser-based HTTP applications.
Evaluate solutions for network security and Security Service Edge (SSE)
Bellhaven Pharmaceuticals discovered that employees were signing in to an unsanctioned external Microsoft 365 tenant from corporate laptops and uploading research files to that tenant's OneDrive. The company also wants Microsoft 365 sessions to be rejected if an attacker replays a stolen token from outside the corporate security perimeter. The solution must work for remote users without backhauling traffic through on-premises proxies, and the company already deploys the Global Secure Access client.
What should you recommend?
- AEnable the Microsoft 365 traffic forwarding profile in Global Secure Access, configure universal tenant restrictions v2 to allow only the corporate tenant, and require the compliant network condition in Conditional Access for Microsoft 365 appsMicrosoft Entra Internet Access for Microsoft Services steers Microsoft 365 traffic through the Microsoft edge, where tenant restrictions v2 headers are injected to block foreign tenants without a proxy, and the compliant network check rejects tokens presented from outside Global Secure Access.
- BConfigure tenant restrictions v1 on the on-premises proxy and require all laptops to use a VPNTenant restrictions v1 depends on a proxy injecting headers and forces traffic backhaul, which the scenario explicitly wants to avoid, and it provides no token-replay protection.
- CCreate a Conditional Access policy with the named location of the office public IP addresses and block Microsoft 365 access from other locationsIP-based named locations do not work for remote users without a VPN, do not stop sign-in to an external tenant, and are easier to spoof than the compliant network signal.
- DEnable cross-tenant access settings in Microsoft Entra ID to block outbound B2B collaboration with all external organizationsCross-tenant access settings govern B2B collaboration and B2B direct connect performed with corporate identities; they do not stop a user authenticating with an account that belongs to a different tenant, which is what tenant restrictions are for.
Why: Microsoft Entra Internet Access for Microsoft Services is the Microsoft 365 traffic profile in Global Secure Access, and it exists for exactly these cross-tenant controls: universal tenant restrictions v2 are applied at the Microsoft edge so no on-premises proxy is needed to block external or consumer tenants, and the compliant network Conditional Access condition ensures that only sessions arriving through Global Secure Access are accepted, defeating token replay from elsewhere. The deciding constraint is remote enforcement without backhaul. The traps are tenant restrictions v1 and named locations, which both depend on network perimeters, and cross-tenant access settings, which cover B2B collaboration with corporate identities rather than sign-in with a foreign account.