Conceptual scenario
Plan private access for colleagues working from home, an office or the field. Computers, phones and tablets join as supported devices; approved gateway routes bring office resources into the same network.
Explore Networks ↗A worked planning example, not a customer case study or a released installation procedure.
People join with their devices
A hybrid colleague reaches private project resources from an approved computer. A field operator opens an internal business application from a supported phone or tablet. Their grants follow the work each person needs to do.
Private path
Work across locations
Private membership does not require changing the default internet route.
Start with the private resource the person needs.
Verify the native release and application protocol on each platform. Mobile background, sleep and VPN restrictions can change how the client reconnects. A running session may need to be reopened after cellular or Wi-Fi changes.
See how people and locations join →Worked resource plan
A field engineer needs the private ticketing tool from changing local networks. Assess an internet routing profile separately if their work also needs a controlled default internet path.
Each resource keeps its own owner and boundary. Scroll sideways to compare all columns. With a keyboard, focus the table region and use the arrow keys.
| Resource | Owner | Intended boundary |
|---|---|---|
| Field laptop | Named engineer | Supported enrolled endpoint |
| Internal ticketing tool | Business operations | Private resource grant |
| Chosen internet gateway | Workspace operator | Assessed default path |
| Local network | Local operator | Separate existing connectivity |
Two independent decisions
The same laptop can have a private resource requirement and an internet routing requirement. Decide and verify each one on its own terms.
Private job / Networks
Use the approved private resource grant. Check its private name where configured, the actual application connection and the application’s own login.
Backend policy defines the permitted path. Supported native executors validate and apply the local configuration.
Explore the private resource boundary →Optional internet job / Outbound
If required, assess Outbound for applicable default internet traffic on the supported endpoint. Record the intended gateway, observed source and DNS behaviour.
A known provider source for a workload may also fit Outbound. Check the supported mode and local or platform exceptions before use.
Read the default-path scope →If the worker only needs the internal tool, use the approved private path when it meets the job. A successful private connection does not establish the internet profile’s behaviour.
Follow the working day
First record a working baseline on the actual native release. Then observe each transition below. Keep the private application result separate from the optional internet profile result.
Before the assignment ends
Record the supported way back before changing the internet path.
Document how the authorised profile is disabled and how the previous route and DNS configuration are restored. Interruption and fallback behaviour must match the verified platform and configured mode.
When the assignment ends, remove the private grant or retire the laptop enrollment as appropriate. Inspect observed state after each change and keep diagnostics redacted. The application owner remains responsible for its accounts and sessions.
For a job centred on office files, work through the separate storage permissions and application checks.
Plan private storage access →If the result is different
Use the failing transition and the observed route, DNS or application result to narrow the investigation.
Check route and DNS reconvergence on the verified native release. Private-resource reachability and default-route behaviour are separate results.
Assess the actual supported failure behaviour before use. Pausing can interrupt internet access until delivery resumes or supported fallback routing is selected.
Use the approved private resource path if it meets the job. Do not make a default internet-route change a prerequisite for private access.
Acceptance criteria
Keep these results together, with the release, platform and transition tested. The planning example does not confirm a released installation procedure.
The work resource is reachable with its own application login.
The selected profile’s source and DNS are checked on the actual release.
Disabling the profile restores the intended path and reports its result.
