Question

A retail company has 8,000 remote and hybrid employees using company-managed Windows devices. Leadership wants to enforce acceptable-use web filtering, block access to newly registered malicious domains, and inspect encrypted web traffic for threats — all without backhauling internet traffic to on-premises datacenters. The solution must integrate with existing Conditional Access policies so that compliant-device and user-risk signals gate internet access. Which Security Service Edge (SSE) capability should the architect specify?

Accepted Answer

Deploy Microsoft Entra Internet Access with the web content filtering and TLS inspection policies, applying Conditional Access to the Internet Access traffic profile

Answer

Deploy Microsoft Entra Private Access with application segments that publish internet-bound web applications through connectors

Answer

Deploy Azure Firewall Premium in a hub VNet and route all remote-user traffic through a site-to-site VPN to the hub

Answer

Configure Defender for Cloud Apps Conditional Access App Control (reverse proxy) to inspect and filter all outbound internet browsing