Hey fellow mercenaries, Ravi here. If you’ve been following my chronicles, you know I’ve been knee-deep in E5 deployments, turning chaotic tenants into fortified Zero Trust bastions. In Part 1, we tackled identity Armageddon; Part 2 was all about endpoint lockdown. Today, I’m dropping the deets on a real-world gig where I helped a global org (let’s call them GlobeCorp – 5,000 employees across 20 countries) go completely VPN-less. We leveraged Entra Internet Access and Entra Private Access to secure their perimeter, while empowering their distributed workforce to rock BYOD setups for Windows 365 Cloud PCs. No more clunky VPN clients, no more “connection failed” tickets – just seamless, secure productivity from anywhere.
Spoiler: This wasn’t just a tech swap; it boosted their security posture, slashed costs, and turned skeptical execs into Zero Trust evangelists. Grab your coffee – let’s dissect how we pulled it off.
The VPN Nightmare: Why GlobeCorp Needed a Mercenary
GlobeCorp was your classic enterprise mess: A sprawling hybrid setup with on-prem apps, M365 in the cloud, and a creaky VPN handling remote access. Employees in Delhi, New York, and Nairobi were chained to corporate laptops for “secure” access, but reality bit hard:
- VPN Bottlenecks: Slow connections, constant drops, and geo-latency hell. A dev in India accessing an EU server? Forget productivity.
- BYOD Bans: No personal devices allowed – security paranoia meant no iPads or Androids for quick checks.
- Windows 365 Wasted: They had Cloud PCs for remote work, but VPN requirements killed the mobility dream. Employees couldn’t hop on from a café or home Mac without jumping through hoops.
- Security Gaps: VPN was a “trust the tunnel” model – once in, attackers roamed free. Phishing spiked, and lateral movement was a breeze.
Their Zero Trust score? A dismal 35% on identity and devices. Enter the mercenary: Me, armed with the E5 playbook. Goal: Go VPN-less in 90 days, enable global BYOD for Windows 365, and crank security to 90%+.
The Solution Arsenal: Entra Internet Access + Private Access = SSE Magic
We ditched the VPN for Microsoft’s Secure Service Edge (SSE) via Entra Suite. Entra Internet Access handles outbound web traffic (replacing proxy/VPN for internet), while Entra Private Access secures inbound to on-prem/private apps (replacing site-to-site VPN).
- Entra Internet Access: Acts as a cloud proxy for all internet-bound traffic. Inspects TLS, blocks threats, and enforces policies without backhauling to on-prem.
- Entra Private Access: Provides Zero Trust access to internal resources via connectors. No more exposing apps to the public internet.
- Tie-in with Windows 365: Cloud PCs become accessible from any BYOD device, with security enforced at the edge – compliant devices only, risk-based MFA, and session controls.
Integrated with the playbook’s CA matrix (Section 3), this created a seamless fabric: Identity → Device Trust → Network Enforcement.
Implementation: 90-Day Mercenary Assault
We followed the playbook’s phased roadmap (Annexure H), starting with pilots to avoid chaos.
Phase 0: Readiness (Days 1–10)
- Validated E5 + Entra Suite licensing (Section 2).
- Set up break-glass accounts and baseline CA (e.g., DP-CA-1001 block legacy).
- Inventoried on-prem apps for Private Access mapping (ports, SPNs, auth types – Section 14).
Gate: Licensing 100%; no major legacy auth spikes.
Phase 1: Identity Lockdown (Days 11–30)
- Enforced phishing-resistant MFA (FIDO2 for admins – Section 7, Annexure B).
- Rolled out SSPR with hybrid writeback (Annexure A).
- Activated PIM for Tier 0 roles (Section 11).
This set the foundation: No more weak auth allowing VPN bypasses.
Phase 2: Endpoint Trust (Days 31–60)
- Deployed Intune enrollment (expanded in Section 17): Autopilot for Windows, ABM for iOS/macOS.
- Enabled MAM-only for BYOD (Android Work Profile, iOS User Enrollment).
- Integrated MDE (Section 18): Onboarded devices, ASR in audit mode.
- Activated EPM to kill local admin (Section 17.6.1).
For Windows 365: Configured Cloud PCs as “compliant devices” in Intune, tying to CA for BYOD access.
Gate: Compliance >95%; BYOD MAM tested globally (no data leaks).
Phase 3: Network Revolution – Going VPN-Less (Days 61–80)
- Entra Internet Access Setup:
- Deployed client via Intune (Win32 app push).
- Enabled TLS inspection with cert distribution (Section 14; playbook warns of pinning breaks – piloted with finance apps).
- Blocked categories: Malware, C2, phishing. Bypass for banking sites.
- Integrated with CA (DP-CA-1601: Compliant device + MFA for internet).
- Entra Private Access Setup:
- Installed 2 connectors per region (US East/West, EU, APAC – HA with dedicated subnets).
- Published on-prem apps (e.g., internal CRM): Mapped dependencies (FQDN, ports 80/443, Kerberos/SPNs).
- Quick Access for RDP/SSH: MFA + compliant device required.
- CA tie-in (DP-CA-1701: Compliant + MFA for private).
- VPN Decommission: Parallel run for 2 weeks; restrict VPN to legacy group only; full cutover after pilot metrics (connection success >99%).
For global employees: BYOD now routes through GSA – no VPN lag. Windows 365 Cloud PCs accessed via Edge (MAM-protected) from personal devices, with private apps tunneled securely.
Gate: GSA adoption >95%; no outages; helpdesk volume delta <10%.
Phase 4: Detection & Sustain (Days 81–90)
- Activated MDI/MDO/MDCA/Purview (Sections 19–22).
- Configured Sentinel correlations (Section 24: e.g., phishing + high-risk sign-in → auto-isolate).
- Ran red team drill (Section 29: Simulated VPN bypass – failed under new model).
- Handed off to L4 with runbooks (Section 25).
The Security Posture Payoff: Global BYOD + Windows 365 Bliss
Post-deployment, GlobeCorp’s Zero Trust score jumped to 92%. Here’s how the posture supercharged their workforce:
- VPN-Less Freedom: Employees in remote spots (e.g., Nairobi field offices) access everything without VPN. Entra Internet Access inspects traffic at the edge, blocking threats before they hit – no more “secure tunnel” illusions.
- BYOD Empowerment: With MAM-only (Section 17.4.2/17.5.2), workers use personal iPhones/Androids for Windows 365. Cloud PCs stream securely via GSA, with CA enforcing compliant sessions. A dev in Delhi edits code on an iPad during commute – data isolated, no leakage.
- Global Resilience: Distributed teams (Delhi to NYC) benefit from low-latency GSA connectors. BYOD + Windows 365 means no shipping laptops – just provision Cloud PCs on-demand, secured by MDE risk signals.
- Threat Wins: Phishing attempts (MDO) trigger CA blocks; insider downloads (Purview DLP) alert Sentinel; workload risks (Section 15) contained. One simulated attack: Attacker phished creds but couldn’t exfiltrate from BYOD due to session controls.
- Metrics Magic: Helpdesk tickets down 40% (no VPN woes); compliance 97%; dwell time <15 min (Sentinel SOAR auto-isolates).
Costs? Slashed VPN licensing/maintenance by 60%; productivity up 25% per employee surveys.
Lessons from the Trenches
- Start Small: Pilot GSA with one region – we caught TLS pinning issues early.
- User Buy-In: Comms on “secure anywhere” won hearts; training on BYOD MAM reduced resistance.
- Watch the Edges: Hybrid AD still needs MDI; don’t forget SPN mapping for Private Access.
- Anti-Pattern Avoided: No “big bang” cutover – phased per playbook (Annexure H).
If you’re battling VPN dragons, hit up Entra Suite. It’s the mercenary’s edge for true Zero Trust mobility. Drop questions in comments – next chronicle: Purview DLP war stories.