Secure remote access for a healthcare organization

This was a lab build for my master's capstone at WGU (D490). I want that said first. It is a focused design I implemented and tested, not a production rollout, and not a finished Zero Trust transformation. The report says so. The supporting evidence is the screenshots.

The scenario was a healthcare organization, called Northwest Health Center in the write-up. Staff could use internal systems only from inside the building. The network was flat and on-premises: Active Directory, a Windows Server domain controller and file server, and a Linux host running OpenEMR, Docmost, Zammad, OrangeHRM, and Invoice Ninja. There was no controlled way to reach any of it from outside. You were on the LAN, or you were locked out.

I implemented Microsoft Entra Private Access through Global Secure Access, so selected internal resources could be reached remotely without a traditional VPN, and without exposing the whole network.

What I built

• Hybrid identity: Entra Connect synchronization with password hash sync, plus hybrid Entra join, so on-premises identities and devices carried context into the cloud.
• A Private Access connector on the domain controller, and the Global Secure Access client on endpoints, brokering access only to the resources I configured.
• Microsoft Authenticator for multi-factor authentication, enforced through a custom Conditional Access policy.
• Intune enrollment and device compliance (BitLocker, Secure Boot, and password requirements), with a Conditional Access policy that required a compliant device.
• Role-based access through departmental groups (Billing, Scheduling, Clinical, Admin, and IT Admins), mapped to specific applications and file shares. Least privilege stayed in place, and each application kept its own authentication.

What I tested

I validated the design with six acceptance tests. All six produced the expected outcome. An authorized user on a compliant device reached her resources from an external network. A noncompliant device, an unmanaged device, an incomplete MFA flow, and a user without the right role were each blocked.

The write-up maps the implementation to NIST CSF 2.0 and the HIPAA Security Rule's technical safeguards. It documents joiner, mover, and leaver steps for the new access model, and helpdesk procedures to match. The remaining work is listed on purpose: VLAN segmentation, connector redundancy, production licensing, and centralized monitoring.

Those joiner, mover, and leaver steps are the same question behind JML: access you can explain later, with an owner and a time. I rehearsed the environment in the home lab.