Question

A retail company is deploying Microsoft Entra Private Access to replace its aging VPN. Employees currently gain full network access once connected to the VPN, and the security team wants to move to a least-privilege model where users can only reach specific internal line-of-business applications based on Conditional Access, without exposing entire subnets. The team also needs to onboard several legacy on-premises web apps that authenticate via Kerberos. Which configuration approach best meets these requirements?

Accepted Answer

Define per-app segments as individual Enterprise Applications (Global Secure Access apps) scoped to specific FQDNs/IPs and ports, apply Conditional Access per app, and use single sign-on with Kerberos constrained delegation for the legacy web apps.

Answer

Configure Quick Access to publish the entire internal IP range as a single enterprise application, then apply one Conditional Access policy to that application.

Answer

Deploy Entra Internet Access with a web content filtering policy to control which internal applications users can reach.

Answer

Keep the existing VPN for legacy Kerberos apps and use Entra Private Access only for modern SAML-based applications.