Question

Your organization is deploying Microsoft Entra Global Secure Access Private Access to replace a legacy VPN. Users currently need connectivity to a broad range of on-premises IP subnets and internal DNS resources during an initial pilot, with plans to define granular per-application access controls and Conditional Access enforcement later. You want the fastest way to give pilot users working connectivity to the internal network now, while retaining the ability to apply Conditional Access to specific published applications afterward. What should you configure first?

Accepted Answer

Configure Quick Access to publish the broad internal IP ranges, FQDNs, and ports as a single application segment

Answer

Create individual Enterprise applications for each internal server as per-app access segments before enabling the pilot

Answer

Enable the Internet Access traffic forwarding profile and add the internal subnets as bypass rules

Answer

Deploy a Microsoft Entra application proxy connector and publish each internal web app individually