Question

A financial services company is retiring its traditional VPN and on-premises secure web gateway. Employees work remotely and need two things: (1) secure, filtered access to public internet and SaaS applications with data exfiltration controls, and (2) clientless-style connectivity to internal line-of-business applications hosted in an Azure VNet and an on-premises datacenter without exposing them to the public internet. The architect must select the appropriate Microsoft Security Service Edge (SSE) components for each need. Which combination correctly maps the requirements?

Accepted Answer

Use Microsoft Entra Internet Access for internet/SaaS traffic with web content filtering, and Microsoft Entra Private Access to publish the internal apps through Conditional Access-governed connectors.

Answer

Use Microsoft Entra Private Access for both internet/SaaS filtering and internal app access, since it tunnels all traffic through the Global Secure Access client.

Answer

Use Azure Firewall Premium for internet/SaaS filtering and an Azure Point-to-Site VPN gateway for the internal applications.

Answer

Use Microsoft Entra Internet Access for both requirements because it inspects all traffic destinations, including private internal applications.