Level up identity protection: building a modern ITDR practice

Hi Jeff, the current design pattern for this is to have one account that is synced to Entra to which we can apply MFA and a secondary account that is used for the actual privileged action on the end service. The first account is used to actual allow the network path to be opened and then second account is the priv account then used for performing whatever the necessary action is. With the enforcement options we are building on the DC side, what that would mean is that without first going through Entra Private Access and authenticating the network path would the connection would not be allowed mitigating any risks of going direct to the service.