SASE for midsize businesses: architecture and pilot

Break SASE into functions: SD-WAN, ZTNA, SWG and cloud-app controls. Pilot required features, IdP integration and licence scope rather than comparing invented all-in prices.

SASE is a model that merges network functions (SD-WAN/connectivity) with security functions (SSE) into a cloud-delivered platform hosted across distributed Points of Presence (PoPs). Instead of building a "hub" to your own data center and routing traffic through a centralized inspection point, SASE offers a user-proximate cloud perimeter applying the same policies across the board—whether users are in offices, branches, clouds, or data centers.

Practical checks

Start with an inventory of users, applications, branches and data flows. Assign access ownership and responsibility for revoking privileges. A VPN supplies a network channel; it does not replace device management, identity, resilience or an assessment of applicable requirements. Do not promise legal compliance based only on a protocol or server country.

Verify compatibility of the exact gateway, client and identity-provider versions before rollout. Allow only required routes and roles; successful authentication must not open the entire network. Use supported MFA, certificate verification and protected secrets storage. Confirm integrations in product documentation rather than assuming support from a technology name.

Pilot with a limited group and test resources. Check normal login, denied access, device changes, user revocation, node failure and recovery. Agree acceptance criteria first: recovery time, permitted loss, application availability and log completeness. Keep the original configuration and a step-by-step rollback. Define the minimum log fields, retention and viewer permissions; avoid unnecessary collection of user traffic content.

Official documentation

• Microsoft Entra
• Keycloak