Identity-bound private access

A device is enrolled against your directory, granted named applications with their ports at the hub, re-checked on a deadline, and judged on what your Intune or CrowdStrike says about the machine.