Entra Private Access is a VPN-like service that gives employees secure access to some enterprise applications. Microsoft believes this service should be able to replace legacy VPNs.

Does anyone have any idea what exactly they mean by this? The term VPN is (also) used for many different applications and services.

For example, is it primarily about traffic encryption or is it about access control?
How is it different from the “old” VPN?

Using a VPN to encrypt your traffic seems like an increasingly useless application. All of your traffic should already be encrypted, even if you’re using a VPN. I also realize that reality is wild and a VPN provides an extra layer of security. Fortunately, this need is becoming less and less.

The same applies to access control. Make sure your application does this correctly. Using a VPN should be an additional tool, not the only or primary one.

To be clear, there is nothing against VPNs, but make sure you understand what they do and in what situation. Additionally, you should never rely solely on a VPN (or any other technology), but should always combine different resources, preferably overlapping them. Save the VPN for when you design it to add it as an additional security network later, and do not make it the foundation of your security.