Is a VPN client still recommended for Office 365 access over public WiFi connections?

[OneTechBeyond]

To mitigate the risk of data exposure, is it recommend to still use a VPN connection, even if you are using Office 365's native desktop client apps on Windows 10? 

[#2]

Was it ever recommended? 🙂 To mitigate data slippage scenarios, use DLP or AIP.

[#3]

Here is Microsoft guidance

For VPN users, enable Office 365 connections to connect directly from the user's network rather than over the VPN tunnel by implementing split tunneling.

This has the benefit of minimising latency, improving reliable connectivity to the closest Office 365 entry point.

https://docs.microsoft.com/en-us/office365/enterprise/office-365-network-connectivity-principles#inc...

In other words connect directly via the local network is preferred rather than the overhead of using a VPN, which Microsoft say should be bypassed if using a VPN. Don’t think public WiFi would change any of this guidance.

[#4]

My bigger concern is how do I have absolute certainty that all traffic being passed from my clients (Azure AD Joined Windows 10 Pro clients, with BitLocker on, or iOS and Android devices) to the Office 365 cloud is done completely encrypted, from at rest to in transit, even when connected to a public WiFi hotspot (i.e. captive portals at coffee shops/airports) or an untrusted network (i.e. Verizon or Comcast's public WiFi, etc.)?

[#5]

@OneTechBeyond I get where you are coming from, I just don't see a VPN being the answer.  Typically you'd use things like Conditional Access to manage the risk accordingly when accessing resources from untrusted networks or devices.  Then the is Microsoft Information Protection to apply protection if needed, like with Windows Information Protection or Azure Information Protection.  

WIthout having to do anything, traffic is encrypted and other steps taken to protect Office 365 as mentioned here https://docs.microsoft.com/en-us/microsoft-365/compliance/office-365-encryption-risks-and-protection....