Trail tip: Secure access to any app—legacy to AI, no VPN needed

0:00 [Music] Good morning or good afternoon everyone. Welcome to Trail Tip, day three of the Microsoft Entra Suite summer camp. I'm Laura Veno, product marketing manager on the Microsoft Entra team, your host for summer camp this week. If today is your first time joining us, welcome. We have a packed week of webinars. If you missed the first two, these are now available on demand. On Monday, we covered an overview of the Microsoft entry suite and the findings of the recent total

0:46 economic impact study. Yesterday, campers Reed and Anton covered how our user Violet Martinez was granted secure access to the resources she needs in her new promotion to finance manager. Today I'm very excited to be joined by my fellow campers Abdi and Maril Lee who will showcase how Violet can securely access private resources without needing a legacy VPN. And just like in our previous sessions, we will end the webinar with a camp fireside chat. So if you have any questions, please make sure to leave them in the comments. If you're joining us for the first time, I'll do a quick overview of the Microsoft Entry Suite before we get into the demo. The Microsoft Entra Suite is a complete zero trust access solution that empowers your

1:32 workforce to securely connect to any cloud or onremise app, resource, or AI within your corporate network or from the open internet. If you joined any of our other sessions, you'll know that the Microsoft Entra suite includes five deeply integrated products. Private access, our zero trust network access solution. Internet access, our identity ccentric secure web gateway, ID governance, our IG solution, ID protection, our machine learning based identity threat protection, and lastly, verified ID, our privacy respecting identity verification. In our demos this week, we will showcase several new features now available in Microsoft Entra. And now I'll pass it over to my colleague Abdi to showcase

2:18 how the Microsoft Entry suite enables secure access to any application. Over to you Abdi. Thanks Laura. Hi everyone. I'm Abdi Sabati, senior product marketing manager for Sassy solution on the identity and network access team at Microsoft. I'm excited to be here with you today. Before I walk you through how seamlessly and securely Violet can access resources in her organization, let's take a step back. As we covered in the Microsoft intro session on Monday, today we are navigating increasingly complex environments managing a mix of cloudnative and on premises apps, a growing number of identities and endpoints with users connecting remotely or locally from their corporate network. And yet many are still relying on

3:04 fragmented identity and network security tools, manual provisioning, and legacy technologies like VPNs to enable access. That's not just inefficient, it is risky. This shift signals the growing need for a new approach, one that simplifies and unifies fragmented technologies while enabling seamless collaboration across teams. It's about adapting in real time, scales effortlessly across environments and delivers secure frictionless access. That's precisely what the Microsoft Intra Suite is designed to deliver by unifying signals across identity, endpoint, and network. The interest gives you a single control plane to

3:50 manage access whether your employees are connecting to private apps hosted locally on your private network or any internet apps or resources beyond your network boundaries. This means you can continuously enforce consistent policies, detect threats earlier and respond faster no matter where the users are or what they're trying to access. And that brings us to today's scenario. Following Woodgrove Bank's recent merger with Kontoso Bank, Violet is preparing a report for the new fiscal year. She's working in a hybrid environment and needs fast, secure access to sensitive financial applications, whether legacy or modern, and without relying on VPN. As part of her workflows, Violet needs to remotely access a financial dashboard

4:36 hosted on Woodgrow's Bank's Windows server. This scenario involves requesting access to new apps and resources in a way that's fast, secure, and compliant. I'll walk you through how the Microsoft interest rate makes this possible. Let's get into the demo. Violet is trying to connect to the financial resource using remote desktop app on her company managed device. There is no VPN client installed because she doesn't need one. Her device is running the global secure access client which enables zero trust network access to resources through Microsoft security service solution. She's prompted to sign into global secure access before establishing a connection. Once

5:23 authenticated, Violet initiates the session using the RDP server IP address. Since Woodgrove company policy now enforces just in time privileged access to sensitive resources, her initial request is denied and she's required to elevate her access through privilege identity management dashboard to be able to access the RDP server. to elevate her access. Violet logs into the Microsoft intraadmin center portal from the device and initiates the privilege access elevation process. As an eligible member of privilege group, Violet activates her PIM roll. This grants her elevated access for 8 hours as defined in the conditional

6:08 access policy. With PIM privileges now active, Violet attempts to access the financial resource dashboard again using the remote desktop app. This time, Violet gets prompted for multiffactor authentication due to a conditional access policy which requires fishing resistant MFA. In response to MFA prompt, Violet chooses her pass key and it gives her a QR code. This will prompt for wireless pass key stored in the authenticator app. Pass keys make fishing resistant authentication so simple. She clicks sign in with pass key and that's it. Once her access is verified, she's granted just in time access to local resources without ever touching the

6:55 corporate network directly. This is zero trust in action. Access is granted based on identity device compliance and realtime risk, not location or network perimeter. But she's not done yet. Violet now wants to analyze the data using her team's internal woodrove AI powered app. This tool is used to run analytics on sensitive financial data. And because of this, it is only accessible via the local network. Because Violet has already been granted access to the Woodgrove Windows server, she can now seamlessly access additional apps and resources within allowed network segments. and based on her zero trust access policy without needing to reach out to it or connect through VPN

7:42 which could increase the risk of lateral threat movement. Now I'll pass it over to Marily to show how we set this up in the Microsoft intraadmin center. Back to Marilyn. Thanks Abdi. Hi, I'm Merrily. I'm a senior product manager on the identity and network access team and I'm here to show how admins can quickly set up secure access to on- premises applications using Microsoft Entra global secure access. Like Abdi mentioned, now that Woodgrove Bank has acquired Ktoso Bank, let's walk through how we can modernize their security to replace legacy VPNs with identitycentric ZTNA. We will gain granular visibility into all of the company's private applications and we will then walk through how to grant Violet just in time access to specific private applications

8:28 so she can pull the data she needs for her report. First, we'll go to the Microsoft Entra admin center and enable our traffic forwarding profiles for Microsoft 365, Microsoft Entra Internet Access, and Microsoft Entra Private Access. We'll need to ensure that these are assigned to all users. Historically, you'd need to set up a VPN, but as we move forward to stronger security posture, we want to use a zero trust network access approach, which for us is Microsoft Entra private access. This configuration begins with enabling traffic forwarding profiles, then setting up a private network connector to provide secure outbound access to your apps. configure enterprise apps to work with your private network connector

9:13 and then secure that access with a fishing resistant MFA and device compliance conditional access policy. Next, let's go ahead and set up private DNS to ensure internal apps are discoverable and accessible securely without exposing them to the public. We'll go to quick access, select the check mark to enable private DNS, and add the DNS suffix for the application. Next, we'll set up multio connectors. These enable organizations to optimize traffic flow from their global secure access clients to their private apps and resources by assigning connector groups based on preferred geographic locations. This capability allows for improved performance and reduced latency by ensuring that traffic is routed through the most optimal paths. We have already

10:00 set up a connector group for our RDP finance dashboard and selected North America as the region for that group. If we go to the network access settings of the enterprise application, we can see our connector group is listed in the dropdown and the destination IP for the RDP server is included in the application segments. To install the connectors, we can download them directly from the Entra admin center. We can install the connectors inside of a corporate network or on a virtual machine that runs in the cloud. Once the connectors are installed, we can monitor these to view their statuses and confirm that they are active. Now that quick access has been set up with app discovery, we can identify who's using which private applications based on network traffic and onboard those applications to Microsoft enter

10:47 ID. This allows us to get visibility into our private apps and resources. So we can create application segments for specific devices, users, and processes. We can then expand our conditional access controls such as single sign on across identified private applications and enforce more granular controls by grouping applications. Next, we will make sure we have just in time access set up to allow Violet to access financial data and other corporate resources. We will go to our RDP finance dashboard enterprise application in the Entra admin center. We have already configured a security group called finance group. This controls access to our RDP application. Under users and groups, we already have the security group dev SSH for RDP

11:32 assigned. If we look at the group members, we can see that Violet is already a member of the group. We enable privileged identity management for this group in the Entra admin center, making it eligible for just in time access. If we go to privileged identity management, we can see that Violet has an active assignment which is valid for 8 hours. This duration is granted each time Violet elevates her permissions. We already have a conditional access policy in place requiring strong authentication and targeting this PIM enabled group for the RDP app. When Violet needs access, she will log into the Entra admin center and activate her PIM assignment for the group. Once elevated, she can connect to the RDP server. After the access period expires, we require Violet to reactivate

12:19 her PIM assignment to regain access, maintaining just in time security. We will next show how we have configured our conditional access policy to require strong authentication, target the PIM enabled group, and allow access to the RDP app. Like we covered in previous sessions, conditional access works by evaluating the context of each sign-in attempt and enforcing the appropriate policy based on the conditions you specify. The context includes information such as the user identity, the device they are using, the location they are signing in from, the application they are accessing, and the risk level of the sign-in. Based on these factors, conditional access can grant or deny access or challenge the user for additional verification. This conditional access policy is an

13:05 example of additional riskbased conditional access policies you can create in Microsoft Entra ID protection. With Entra ID protection, we can automatically flag risky behaviors like this and block access in real time. In our conditional access policy, you see that we've included the PIM enabled group dev, SSH or RDP. In the target resources, we've included the on-prem RDP finance dashboard that Violet will need to access. In the grant controls, we require fishing resistant authentication. This will require Violet to enter a pass key. We've also configured a sign-in frequency of every time. With risk based conditional access, your organization can set dynamic policies to remediate risk

13:51 automatically without sacrificing security posture or admin productivity. In fact, tenants who use riskbased conditional access remediate user risks 140 times faster than those who don't. The risk data can also be used in your SIM or XDR tools to equip the sock with even more visibility during threat hunting. At the same time, Entra identity protection receives signals from across your security stack and works together with tools like Microsoft Defender to provide the identity team with comprehensive detections wherever their identities may be deployed. This helps identity admins work seamlessly with their security operations center teams and protects against identity compromises through identity threat detection and response.

14:37 This is where the power of unified ITDR really shines. We're not just reacting to threats. We're proactively reducing risk by correlating signals across the stack. We see with ITDR that it requires a tight partnership between identity and access management and extended detection and response teams. We already talked about how little time organizations have to stop attacks. But imagine needing to coordinate access across different teams that work in different tools, have different workflows, and in some cases are actually looking at different data. Our focus has been to streamline how these teams work together through Microsoft equipped with a comprehensive view of identities, apps, environments, whether you're deployed in the cloud, on premises, hybrid, or expanding protection to the network layer. Let's

15:23 look at an example of how these detections and signals from across Microsoft come together in our identity protection dashboard. If we go to risky users, we see that one user has been flagged as risky. Copilot now provides a detailed summary and shows that the user attempted to access a primary refresh token and receive this alert from Microsoft Defender for endpoint. We can remediate this risk and trigger a password reset for the user. On the other hand, the security operations center can also view details about the detection history and risk status in Microsoft Defender alerts. With that, I'll pass it off to Abdi to summarize the demos we just walked through. Thanks, Marley. To recap, we followed how WLED seamlessly and securely accessed private resources without a

16:11 VPN. From the admin side, we replaced legacy VPN with Microsoft intra private access, which is an identity ccentric zero trust network access solution using traffic profiles and segmented app access. We use private app discovery to continuously gain visibility into all Woodrove's banks private apps. We enabled Violet to access the Woodgrove Bank server without needing a VPN. Lastly, we granted Violet access through a PIM enabled group and fishing resistant pass keybased MFA. Before we wrap, it is important to highlight the real world impact of enabling these capabilities. According to the latest total economic impact study by Forester, organizations using Microsoft interest

16:56 suite achieved measurable results, leveraging the suite as a unified platform to secure identity and network access, including replaced legacy VPNs and cut VPN license cost by 60%. Decreased engineering effort by 80%. These aren't just incremental improvements or efficiency gains. They represent transformational outcomes that help organizations scale securely, lower compliance risk, and empower users to be productive from day one. If you're looking for the next step to start upgrading your zerorust access strategy, our amazing teams here at Microsoft and our partners are here to help you unlock these benefits for your organization

17:41 with the Microsoft interest rate deployment support across every step of your journey. And now I'll pass it back to Laura who will kick off the Q&A. Thanks Abdi and Merrily for walking us through those amazing demos. Before we switch over to our Camp Fireside chat, let's highlight a few Microsoft Entry Suite resources. If you're looking for next steps on how to modernize access to private applications, don't miss our new quick start guide. You can also get started with the Microsoft Entra Suite free trial and learn more about its benefits and value by checking out the new total economic impact study. We hope to see you all at the last summer camp session tomorrow, Campfire Watch, where we'll highlight how to detect shadow AI

18:27 and protect internet access. Now, let's pivot over to some live Q&A in our campfire side chat. Hello. Well, hello everyone and welcome to our uh camp fireside chat. Um we hope you enjoyed the demos we showcased today and we are very very excited to answer all your questions. Um before we get into uh our introductions with our amazing um camp counselors today, I'd like to remind everyone if you have any questions, please do leave them um in the comments under the the video. Uh with that, we could do some introductions. I'll kick it off. Um, as always, I'm your uh summer camp host. My name is Laura Veringo and I'm a product

19:13 marketing manager on the Microsoft Entra team. Now, I'll pass it over to Janice. Hi, I'm Janice Rketts. I'm a senior product manager on the identity and network access team. And Abdi. Hi everyone. I'm Abdi Sabati, senior PMM for identity network access team focusing on Sassy and SEC solutions. is Merrily. Hi, I'm Merily. I'm a senior product manager on the identity and network access team focusing on all things Entrust Suite and helping customers deploy our solutions. Awesome. Now, to kick things off, um again, everyone feel free to leave your comments in the chat below. Um we'll kick things off. Uh Abdi, can you give us a little bit of a um overview for

19:59 this question on how does unifying identity network access make things better for our company on a day-to-day basis? Thanks Laura, great question and thanks everyone for joining us today. Uh let me touch on few points about that. really the unification matters uh today by unifying identity and network access controls. We we really looking at you know how we can make the access easier and more secure and uh when we look at Microsoft intra where you create policies or controls to enforce across your environment. These are created centrally as part of Microsoft intraadmin center all managed through conditional access policy and uh applies across both identity and network layer. Uh so it's like a very kind of a

20:44 granular policy you can create and uh within that kind of realm conditional access becomes your zero trust policy engine and uh where it it looks at signals like users identities uh your device health uh locations and and so on. So you can decide uh how to enforce access what should be allowed what should be blocked and uh like one example would be for example you want to enforce zero trust controls like list privilege access and uh so users can get only get access to what they need to do their work and that you can do that through zero trust access policy as part of conditional access controls. Uh so this you know centralization or unification allows you to you know bring multiple layers of controls within the same policy. For example you can you

21:31 know also enforce continuous access evaluation which you allows you to adjust access controls uh based on the risk or location changes in the environment. So uh just to sum it up like unification like helps you instead of kind of managing multiple tools across the organization multiple platforms across organization it brings them all together in one place so you can control access and reduce risk from uh both identity and network access aspect of things. So back to you Laura. Awesome. Thank you for that. So um now before we get to our next question I'll shout out our link below. So, um, if you have questions, um, you can, um, ask them at aka.mscamquest/secure access. Um, with that, uh, let's get on

22:19 to our next question. Um, actually, this follows what we showcased in the demo when Violet used a, um, a fishing resistant um, method of MFA. We have a similar question on does Microsoft have any preferred physical security keys that help prevent unauthorized access to company information. I can take a shot at it if you'd like. Um, so that's not exactly an intrauite question. I think that is more of an intra ID authentication question. And the truth is we of course are preferring passwordless as much as possible. So yes, a 502 key would be highly preferred. Um, but many companies have different requirements for what their

23:06 security authentication can support. And so we have a wide range of um, available methods that can be used for authenticating your users. Um, but for a physical key um, a 502 key I think. Happy to have others chime in here. That's the answer. I would have said too. Awesome. Okay. Um, so next question we have is I heard conditional access referred to as a zero trust policy engine. What exactly does that mean? Uh, so I can take that one too. um conditional access policies. Conditional access is really the heart of entra ID and one of the underlying reasons why

23:52 global secure access was built integrated with identity. Integration of network controls with conditional access is one of the most significant motivations actually behind developing GSA. So widely loved and utilized enabling customers to granularly define the conditions that must be in place before users can access resources. And we just saw that in the demo. Um, but GSA takes this a step further by enabling you to control that access at the network level. And as we saw in the demo, the resources we targeted with conditional access policies are GSA enterprise apps. A GSA enterprise app is a network level application segment, not a traditional application. We're protecting the actual segment such as the IP address or FQDN, and it is a total game changer, especially protecting your on premises applications

24:38 and resources. Um, my personal favorite example is the ability to control access to on- premises resources with risk based controls, which means you can configure a CA policy that requires additional authentication if a risk signal changes. And this is possible because GSA integrates with enter ID and universal continuous access evaluation is one of the factors you can evaluate with conditional access policies. And that enables global secure access to literally interrupt a network connection based on the risk signal with no dependency on the target application itself to have any awareness of that risk signal. Awesome. Thank you. Um, next up we have um I guess for um organizations that are watching this that might still be using

25:23 legacy VPNs um do we have any advice for first steps um they should take to move off of these legacy VPNs? Um how have companies done this before? Can take that Laura. So when we look at uh you know traditionally VPNs was the only way to connect to the you know your corporate network uh but that brings a lot of risk and challenges uh such as lateral threat movements unnecessary or excessive access to your organization so people can get in from one one device and kind of move move around or even accessing sensitive information if there's not uh proper segmentation or controls in place. So uh the approach we are taking with Microsoft intra private access we are bringing the identity

26:09 centric zero trust network access controls and with that as we talked about whole unification uh kind of aspect of things. This allows us to kind of uh remove that full network access uh and really only give access to the users on what they need to do their job and that really aligns with the zero core zero trust principles like least privilege access and uh kind of kind of minimizing the kind of access level. So, so with that context, I think uh there is a need to move to kind of a ZTNA approach or Ztna solutions and we see across our customers when we talk to them that could some of them may have a lot of complexities in the environments. Uh it could be challenging to move it may take more time. So we trying to make it kind of a more logical approach and giving kind of kind of a phased approach

26:55 options and flexibility on where you are. we meet you where you are. So you can kind of migrate from you know from a legacy or traditional VPN kind of concept to a ZTNA and identitycentric ZTNA. So with that that phase approach we have tools enabled across our solution for example quick access uh which allows you to bring a a set of your network a subset of your network to ZTNA applied identity based controls and be able to see what traffic is traversing across your network. So therefore you can do app discovery, app segmentation and build all these more kind of zero trust segmented access controls within that kind of context and information that now you have which previously you didn't and there was everything was going through this like a VPN tunnel. So within that like this

27:41 phase approach matters so you can start wherever you are in your journey if you want to move kind of a subset of your network or all all your network depending on how sizable is your network. So and based on your groups that you want to migrate and this phase approach will help you to start small uh with subset of users applications or subset of your network and start applying ZTNA controls uh and on top of that identitycentric controls which kind of can be also applied in that kind of a traffic flow and then gradually move to that segmented access uh with the broader subset of your network or users or apps or groups that you have in the environment. So can has to be a logical path to it and we can meet you where you are on your journey and help you to get

28:26 there from here to here. So back to you Laura. Awesome. And then I'll open it up if anyone else has anything else tips add a little bit to what Abdene mentioned too. We have two really great deployment guides for getting started. So these are aka.msa deployment guides and aka.msap docs. And like Abdi mentioned, these will tell you, you kind of have two options for a VPN replacement scenario. We have your full VPN replacement scenario where you configure a quick access and essentially publish your entire network and you can once you see traffic start tunneling, create enterprise applications and then apply even more granular controls and conditional access policies to those

29:12 applications. And then also if you don't want to publish your entire network, if you just want to configure this uh VPN replacement for specific apps, you can do that as well and configure specific enterprise application. But again would definitely recommend checking out those guides. Awesome. Thank you. Now we have kind of a specific scenario question. Um so someone comments um in the past when remote users needed access to on-prem apps we relied on VPNs um even with MFA in place the challenge was that when a user connected they often had broad access to the whole um entire network. So how to how does private access um change this? I can add to that and then I think the

30:00 team can chime in here as well. I think as I mentioned earlier is the zero trust access controls needs to be enforced and uh with traditional approaches like VPNs you really providing that full network access uh so as long as the user kind of connected to the network they can navigate around the network and kind of create harm or you know move around or you know do back channel to the external servers and so on. So uh it really matters like enforcing zero trust principles would be key here uh like assuming bridge le privilege access and so on. So you can really limit control and with private access we kind of enable that kind of granular level of controls that you can start narrowing down access from user to

30:45 application uh with it you know dedicated connections and access controls that kind of makes that as granular as possible uh so minimizing the risk and kind of uh the the challenge that we face with traditional VPNs. Can I add a tiny bit to that? Um, just to get really tactical about what's happening here with the ZT with with quick access and the full VPN replacement, we are defining basically your VPN broad ranges. And so you kind of feel like you have this similar scenario that you had when you still had a VPN. But the point of doing that is to get you to ZTNA, what Abdi and Merily are really trying to emphasize here. And the reason that we are able to do that is because you are running an agent on your device that is acquiring data that

31:31 you have defined in your enterprise app segment. It is only going to pick up the IP address or FQDN that that client has sent a request to. It isn't going to enable that user or that device or that client to access anything other than what has been authorized for acquisition by the GSA agent that is running on that device. That is how you're getting that segmentation because you're defining only these IP addresses, only these FQDNs are allowed for connectivity and then the device will only pick those up and route them to your private network connectors. I want to add a point to that Janice as well. Just thinking about that when you think about zero trust access uh controls is a kind of end to end access. So your users could be remote, your users could be onrem, your users could

32:18 be connecting from a coffee shop. It doesn't matter like uh and that that's that's where that consistent security controls matter uh and bring considering all these layers of controls we talked about. But how consistent is that? How continuous is that? So that kind of also is another angle when you look at when you look at the traditional VPN versus the kind of these new kind of uh kind of era of kind of users are everywhere, apps are everywhere and and that that policy becomes more much more important that control becomes much more important with that kind of context of uh you know uh following the user where it is but applying those consistent policies across the board. Uh so that's kind of a kind of a big kind of big shift from VPN to ZTNA with the new realities we facing today. Awesome.

33:04 Um, and for maybe some organizations that are watching this webinar now and are curious to know, do we have any advice on how private access will coexist with other providers they may have already set in place? Yeah, I can take this one. It's an excellent question and it's actually very close to my heart. It's an important question that the customers I work with have to have in place. So, we're very excited about the ability to offer coexistence and integration solutions that enable that kind of flexibility for customers. Uh, Microsoft offers a robust partner ecosystem. It enables side by side and integrated network security controls for Microsoft Entra. And to accomplish this, Microsoft has and continues to collaborate closely

33:49 with leading security vendors like Netscope, Cisco, Palo Alto Networks, and Zcaler to ensure that seamless integration and coexistence for Microsoft Entra private access and Microsoft Entra internet access. Global secure access also provides that integration with SD1 and network providers for secure and optimal connectivity to simplify your journey to that identity centric sassy architecture. Um, but in addition to that, I'm also really excited to share an announcement. Recently, we announced global secure access integration with Net Scope's advanced threat protection and data loss prevention, which is now in public preview. And that integration enables customers to achieve real time protection against malware, zeroday vulner vulnerabilities, and data leaks. And it simplifies management through a unified platform. So, a lot of work has

34:35 gone into all of these solutions, and we're very excited to make it possible for customers to coexist and have these integrations with thirdparty providers. Thank you. And I love the shout out to the new um integration. That's a good reminder for everyone to join our session tomorrow at 8:30 a.m. Pacific because we will be demoing that um as a little teaser for tomorrow. So, make sure you join to see that in action. Um and if you want to explore more about the um partners uh you can visit aka.mentrasecure access partners. Um so now with that um let's pivot back. I know in the demos we covered a lot on ID protection. So we've gotten a question. How does ID protection help me with auditing? How

35:21 can I help my sock team? Thank you. I'm happy to take that one. So identity protection offers this scoring of low, medium, and high for risk signals. And you can then check the audit logs and see signs of potential compromise. So things like leak credentials and possible travel, unusual locations. And from there, the sock analysts can then determine what exactly this user did. Was this part of a coordinated attack? and uh do an investigation and get really thorough data. And you can also look at trends in risk behavior. So you can look at things like the risk event types, total number of high-risisk detections and um kind of

36:06 see if you're seeing specific trends like you have 30 high-risisk detections but 20 of these are impossible travel or a certain number of these are coming from a specific user. So you get all of these signals through identity protection and can proactively prevent attacks using riskbased conditional access. Awesome. Um and now um one quick reminder, if you have more questions, these questions have been amazing. Please leave them at aka.mscampquest/secure access. Um another call out to what we saw previously in the demos. Um, someone says, "I read about app discovery. Can you tell me more about how that works?"

36:54 I can start and Janice can add to that potentially go deeper on that. But potentially uh you know as we as I touched on it a little bit earlier as well uh traditionally you may not see what is traversing across your network because you don't have visibility on that traffic uh and really different methods or different organizations do different ways to be able to capture that traffic. We are doing that at Paul at uh at our kind of app discovery capabilities as part of private access and we really you know we seeing what traffic is going through the network and identify these traffic from users apps destinations they're going to and really be be able to give you that level of visibility that you can say okay based on this traffic these are the logical policies or app enterprise apps groups

37:40 or segments that I want to create and that will help you again to get to that zero trust level of access controls that you need to have why before you didn't have kind of that develop visibility even on the traffic or apps that traversing to your network. So app discovery becomes really key on uh getting to zero trust access model while and allows you to see what is going on across your network. There are kind of details kind of uh on kind of uh kind of steps and creating the policy and and you know you know putting that as an enterprise app group which we saw some of it in the demo but I think that there are kind of maybe more uh other angles that Janice maybe going to touch on that as well. I think you got about 90% of it. I only would add um a little tiny bit more and that is that app discovery is specific to quick access. It's not linked to any

38:25 other enterprise apps. And one of the things that that enables is for an overlap between the app segments that are defined in quick access and what are in enterprise apps. And we only allow that exception in the case of quick access and defining a single enterprise app. you cannot have any overlap of app segments across enterprise apps because that's confusing for any conditional access policies you might create. So we do allow that. So you don't have to break apart your big ranges that are, you know, in your quick access um IP app segment ranges. You don't have to break those apart when you want to create enterprise apps. So, it's meant to be a point-and-click uh simple way for you to move that data out of quick access into an enterprise app so that now you can apply conditional access policies and control that data separately from all

39:12 the rest that's in your environment. That's awesome. And kind of since this is a um new feature in private access as a followup ABD is has anything else what else is new that we could share with the audience? Yeah, I think uh there are a few things uh we've been talking about past couple of months that we we we released uh app discovery is one of them. Again, we talked about it in extend uh we we we released private DNS support for uh kind of that enables more seamless uh resolution across hybrid environments. We we did talk about multi- geo connectors. Uh so these kind of multi geo connector roles help you uh improve performance and uh resiliency for the global users like users connecting from anywhere globally and so

39:59 we give that kind of high performance uh access with the connectors closest to the users and then uh we just uh also uh released public preview for or private access for domain controllers uh uh which allows you uh enforce DC side controls dom domain controller side controls to ensure access to on premises uh resources is protected across both user side and also domain controller side and this is kind of a key feature. We just uh went to public preview on that and there's more on that to come. uh uh but uh this is especially needed for uh you know you know to enable zero trust access or zero trust protection for when users are on uh on prem and protecting your uh critical or sensitive

40:45 resources such as domain controllers in your environment. uh and uh considering that your app traffic stays local your authentication uh will go uh to the cloud as necessary but we kind of minimizing the risk of u you know uh any cyber risk or any any attack risk across your sensitive resources with that. So with that I think we we continue adding features capabilities across our product and solution. Uh coming soon we will kind of have more features added and kind of uh by November which is our Ignite which you can sign up to Ignite as well. Uh we're going to add more capabilities features and we're going to talk about those uh within the next few months as well. So stay tuned. Yeah I know um tonight will be a very exciting time. Hope to see everyone

41:31 there as well. Um to kind of go off of that, we got a question. Uh we are a global company. Does Entra Suite help us account for that so that our users don't encounter network latency? That actually comes into the multigo connector scenario that was in the demo and that Abdi was just mentioning. Um right because you want to make sure that when users are connecting to their data say in Europe and the user is in Europe that all of that network traffic remains in Europe and without multigo support that so before we had multigo support even though the connector group might be in Europe and the data might be in Europe we were seeing a necessary routing to the home tenant for GSA backend processing. So, a lot of work

42:17 has been done to enable points of presence and local routing for all of these multigo locations around the world to minimize that latency. And we continue to add those points of presence, trying to continue to reduce that latency that you will see um in your in whatever go that you're um trying to connect to. So, trying to optimize that traffic flow for your clients to apps through private access. I just want to add something to that as well Janice. I think uh the way we kind of uh design or structure our products globally. Uh we are building these solution across within our Microsoft global private network which is the backbone for us. So kind of uh that that kind of improves a lot of efficiency,

43:05 performance, connectivity and uh it makes it easier for us to pop these you know pops locations uh for your security service edge needs. and therefore enabling these connectors as as well in related to that. So I think that's kind of global private network from Microsoft enables us to kind of deliver these security services edge services uh much more effectively and uh bringing that performance and kind of resilency resiliency to the kind of the traffic flows and user experience as well. So just want to touch on that that is kind of really important as well. You just reminded me actually it's not private access but we colllocate with the Microsoft 365 services. So those where your GSA SSE backend data is being processed is in the same data centers as

43:50 Microsoft 365. So there's also improvements in latency for connecting to those apps even though it's not private access. That's a different um component of glob access. Awesome. Those are great some great points. Um, now before we wrap up, maybe we'll do one final question. Um, so maybe each of you can give a little bit of um, advice, but do we have any final tidbits that we can leave organizations with that are looking to integrate the entry suite and specifically also private access into their existing infrastructure? I can start. Uh so first off definitely recommend checking out those deployment guides and we'll leave some links for you as well. But uh would recommend to start out setting up either quick access

44:36 or even starting alternatively starting with just an enterprise application and setting up private access and then from there would recommend testing a few conditional access policies because that's really the key differentiator with our product is that unlike a traditional VPN where you would be publishing your entire network with conditional access you can control who can access specific applications uh within your private network and then even apply more granular controls to require MFA fishing resistant O and make sure that that access is really secure. So would recommend checking out those deployment guides getting started uh with quick access or configuring an

45:21 enterprise application and then definitely configuring those conditional access policies. I will add two little pieces to that. Uh the first one is riskbased conditional access. Really look at that if you haven't looked at that already. The ability to say a particular user signal looks like it's high- risk and require a different level of authentication, a different requirement on that connectivity is very powerful, very cool. So definitely look at when you're creating your conditional access policies, what can you do with riskbased signals to enhance that? And the second thing I will say is one of the things that comes up with my customers is how do I as part of moving from quick access to enterprise apps and ZTNA how do I also manage the user assignment to these

46:08 enterprise apps and you can do that directly on those enterprise apps like you always can access you know put you know permissions directly on things but I would really recommend if you've bought in suite to look at identity governance and use access packages because you can configure those to configure that direct access but you can also configure governance to deliver that access along with other access that new users or users who are moving around your environment will need. So these products are designed to work together. And I know if you're watching this, maybe you're basically the network team and don't really think about that. But spending a little time thinking about that upfront can help you. You're going to do a lot of hard work getting to ZTNA. Maybe if you can also alleviate your later governance problems, not have to do a lot of hard work on that again

46:56 later, that would be helpful. Did I steal your thunder, Abby? Yeah, I can I can I can kind of sum it up a little bit like from uh you know why this matters really and uh you know uh why bringing identity and network access together I think is important uh to to be protected and secure. Why are we really providing that uh kind of a seamless experience to users and reducing the complexity across the environment for IT teams uh you know network teams security teams and really this helps to bring these teams together to work together collaborate better with each other as a a place to kind of manage control access uh uh through

47:42 Microsoft intra and really getting away from that kind of uh multi-tool kind of concept steps and with fewer tools we can manage more effectively. We can bring more consistent security across the board and all these things like really uh matters when we you know our teams working closer together and we need the tools to be able to enable that kind of collaboration. So I think that's kind of uh key and uh the end goal is really accelerating your zero trust journey helping you to stay protected uh making uh it easier uh to deploy these technologies and uh with the kind of uh the kind of end to end approach and that's kind of a simplified approach that helps you to get from here to here from that kind of within that zero trust journey wherever you are like it depends

48:28 like each of you may be in different stages of this journey so we can meet you there uh and help you to kind of get it to the step and next level. And then I think uh we have a couple of other sessions this week as well. You can attend uh to learn more about different angles of the uh solution. Uh we do have step-by-step guidance uh uh for scenarios that we walk you through today. You can go to AKMS quick start uh VPN replacement guide or uh also look at our intrauite workshops that we kind of releasing this week uh under AKMS intrauite workshop uh so uh for other sessions so so you can you know learn about those and ask us any other questions you have so uh back to you

49:13 Laura. Awesome. Um thank you all for joining. I think we got some amazing questions today. As always, if anyone has any other questions, please leave them in the comments and we will follow up with you offline. And as Abby mentioned, summer camp is not yet over. We still have one more session tomorrow, Campfire Watch. So, we really hope you all join at 8:30 a.m. Pacific. Um, and again, to find all the sessions, they will be available on demand. So, if you missed um any session this week, highly recommend checking those out at aka.ms/enters summer camp. Um and with that, thank you so much everyone. It was a pleasure. Thank you. Thank you. Thank you.