Replace VPN access with identity-driven security

What changed

Microsoft Entra Private Access replaces broad network-level VPN access with identity- and application-specific Zero Trust access to private resources.

Why it matters

Per-application access can reduce lateral movement and apply Conditional Access to private applications, but connector placement, name resolution and fallback access must be validated before VPN retirement.

Known limitations

• Availability, prerequisites and rollout scope remain authoritative in the linked Microsoft documentation.

Now check

• Inventory private applications, protocols, DNS dependencies and user groups before defining Entra Private Access segments
• Pilot connector high availability and Conditional Access with MFA, device-compliance and least-privilege policies
• Validate routing, name resolution, sign-in logs, performance and emergency fallback before removing VPN access