Overview Network Pillar
Implementation Effort: High
Stop buying or building Active Directory dependent apps
Implementation Effort: Low
Enable QuickAccess and Deploy Connectors
Implementation Effort: Medium
Migrate key remote apps to QuickAccess & enable private DNS
Implementation Effort: Medium
Secure remote app access with modern security controls (MFA/Device Trust)
Implementation Effort: Low
Bring all legacy apps under full governance lifecycle
Implementation Effort: High
Complete migration of apps to Private Access or Application Proxy
Implementation Effort: Medium
Header Decommission VPN infrastructure
Implementation Effort: Low
Design and Implement SD-WAN capabilities
Implementation Effort: High
Roll out GSA client to all managed devices
Implementation Effort: Low
Discover App Usage and plan for App Segmentation
Implementation Effort: Medium
Define Segmentation Strategy
Implementation Effort: Medium
Rollout App Segments for Macro Segmentation
Implementation Effort: Medium
Secure sensitive legacy AppAccess with PIM
Implementation Effort: Low
Rollout / Implement Application Segments for Macro-segmentation based on business needs
Overview
Implement B2B guest access controls for partner access (Global Secure Access)
Implementation Effort: Medium
Implement Microsoft Entra Private Access for Active Directory domain controllers
Implementation Effort: Medium
Define legacy protection and enforcement
Implementation Effort: Medium
Implement Intelligent Local Access for Private Access
Implementation Effort: Medium
Monitoring: Leverage and monitor Traffic Logging
Implementation Effort: Low
Monitoring: Review GSA Audit Logs
Implementation Effort: Medium
Monitoring: Export Traffic and Audit logs to external SIEM solution
Implementation Effort: Medium
Monitoring: Leverage GSA Azureworkbooks
Implementation Effort: Low
Monitoring: Leverage GSA Sentinel integration
Implementation Effort: Low
Monitoring: Monitor and scale out
Implementation Effort: Medium
Define your SaaS app and Internet Access protection policy
Implementation Effort: Medium
Base SWG: Onboard M365 traffic
Implementation Effort: Low
Base SWG: Update Conditional Access policies to leverage Compliant Network controls
Implementation Effort: Low
Base SWG: Review and Redesign existing Internet Access filtering policies
Implementation Effort: Medium
Base SWG: Onboard Internet Access Secure Web Gateway capabilities
Overview
Configure web content filtering and URL filtering (Preview)
Implementation Effort: Medium
Implement Microsoft Entra Internet Access (Secure Web Gateway)
Implementation Effort: High
Roll out GSA client to all managed devices
Implementation Effort: Low
Protect M365: Implement Universal Tenant Restrictions to protect Auth and Data Plane for M365
Implementation Effort: Medium
Protect M365: Enable GSA Signaling for Conditional Access
Implementation Effort: Low
Protect M365: Implement for Guest Access in AVD and W365 (MS Roadmap)
Overview
Advanced SWG: Enable and Configure TLS inspection
Implementation Effort: Medium
Configure network content filtering with file policies (Preview)
Implementation Effort: Medium
Advanced SWG: Implement Threat Intelligence filtering
Implementation Effort: Low
Integrate Netskope Advanced Threat Protection and Data Loss Prevention
Implementation Effort: Medium
Advanced SWG: Implement Cloud Firewall capabilities (MS Roadmap)
Overview
Advanced SWG: Design and Implement SD-WAN capabilities
Implementation Effort: High
Agentless SWG: Onboard M365 traffic remote or agentless network segments
Implementation Effort: Medium
Agentless SWG: Update Conditional Access policies to leverage Compliant Network controls
Implementation Effort: Low
Configure Internet Access for remote networks (branch offices)
Implementation Effort: Medium
Monitoring: Leverage and monitor Traffic Logging
Implementation Effort: Low
Monitoring: Review GSA Audit Logs
Implementation Effort: Medium
Monitoring: Export Traffic and Audit logs to external SIEM solution
Implementation Effort: Medium
Monitoring: Leverage GSA Azureworkbooks
Implementation Effort: Low
Monitoring: Review remote network health logs
Implementation Effort: Low
Monitoring: Leverage GSA Sentinel integration
Implementation Effort: Low
Monitoring: Monitor and scale out
Implementation Effort: Medium
Discover and Assess Public Network Endpoints/Resources
Implementation Effort: Medium
Create an Azure DDoS Protection Plan for VNETs / Enable Azure DDoS Protection for Public IPs
Implementation Effort: Low
Simulate DDoS Attacks to ensure readiness
Implementation Effort: Low
Automate Governance, Monitoring, and Response for Azure DDoS Protection
Implementation Effort: Medium
Evaluate Network Traffic Flows
Implementation Effort: Medium
Deploy Azure Firewall and route all outbound and inbound traffic through it
Implementation Effort: High
Enable and use Azure Firewall Network rules to explicitly allow traffic from specific sources/to specific destinations.
Implementation Effort: Medium
Enable and use Azure Firewall Application Rules to manage outbound and east-west application-layer traffic
Implementation Effort: Medium
Automate Azure Firewall Governance, Monitoring, and Response
Implementation Effort: Medium
Evaluate Network Segmentation Strategy
Implementation Effort: Medium
Centralize Azure Firewall deployment for inter-VNet traffic inspection.
Implementation Effort: Medium
Enable and use Azure Firewall Network Rules to segment internal Azure or On-Prem sources and destinations
Implementation Effort: Medium
Enable and use Azure Firewall Application Rules to segment internal Azure or On-Prem sources and destinations
Implementation Effort: Medium
Automate Segmentation Policy Enforcement and Compliance
Implementation Effort: Medium
Evaluate Network Threat Protection Strategy
Implementation Effort: Medium
Deploy Azure Firewall for Network Threat Protection
Implementation Effort: Medium
Enable Threat Intelligence based filtering in Azure Firewall Policy
Implementation Effort: Medium
Enable IDPS to inspect all inbound and outbound traffic on Azure Firewall
Implementation Effort: Medium
Enable IDPS to inspect all east-west traffic on Azure Firewall
Implementation Effort: Medium
Automate Governance and Response for Firewall Threat Protection
Implementation Effort: Medium
Discover and evaluate encrypted network traffic
Implementation Effort: High
Deploy and enable Azure Firewall for TLS Inspection
Implementation Effort: High
Enable and configure TLS inspection on Azure Firewall policy to Inspect all east-west TLS traffic to allow/deny with IDPS and Application rules
Implementation Effort: High
Enable and configure TLS inspection on Azure Firewall policy to Inspect all outbound TLS traffic to allow/deny with IDPS and Application rules
Implementation Effort: High
Enable TLS inspection to Inspect inbound TLS traffic from Azure Application Gateway to allow/deny with IDPS and Application rules
Implementation Effort: High
Automate TLS Inspection Governance and Compliance
Implementation Effort: Medium
Assess and Discover Global, Regional, and Internal Web Applications
Implementation Effort: Medium
Enable Azure WAF on Azure Front Door to protect global applications
Implementation Effort: Medium
Azure WAF on Azure Application Gateway to protect regional and internal applications
Implementation Effort: Medium
Enable and use the latest Default Ruleset and Bot Manager Ruleset
Implementation Effort: Medium
Enable and configure Custom Rules for Rate Limit
Implementation Effort: Medium
Enable and use the latest HTTP DDoS Ruleset
Implementation Effort: Low
Automate Governance and Response for Azure Web Application Firewall
Implementation Effort: Medium
Leverage and monitor Traffic Logging
Implementation Effort: Medium
Enable and configure DDoS Alerting, Logging and Metrics
Implementation Effort: Medium
Enable and configure diagnostic logging and metrics for the Azure Firewall
Implementation Effort: Medium
Enable and configure diagnostic logging and metrics for WAF on Azure Front Door and Azure Application Gateway
Implementation Effort: Medium
Leverage Workbooks for visibility and tracking - DDoS Workbook, WAF Workbook, Firewall Workbook
Implementation Effort: Medium
Integrate and export diagnostic logs into SIEM
Implementation Effort: Medium
Automate response to alerts and leverage AI for investigations
Implementation Effort: Medium
Configure Secure Web and AI Gateway for Copilot Studio agents (Preview)
Implementation Effort: Medium
Protect enterprise generative AI applications with Prompt Shield (Preview)
Implementation Effort: Medium
Configure cloud firewall for remote networks (Preview)
Implementation Effort: Medium
Enable and configure JavaScript Challenge
Implementation Effort: Low
Enable and configure CAPTCHA Challenge
Implementation Effort: Low
Enable and Configure Explicit Forward Proxy
Implementation Effort: Medium
Protect Microsoft Copilot Studio agents
Implementation Effort: Medium
Review Generative AI Insights
Implementation Effort: Low
Review MCP traffic logs
Implementation Effort: Low