For years, network security was often discussed in terms of perimeter controls. Users were inside or outside the network. Applications lived in known locations. Traffic moved through predictable paths. Firewalls, VPNs, and segmented networks created boundaries that security teams could understand and manage.
That model has been changing for a long time, but AI is accelerating the shift.
Organizations are adding more cloud applications, more remote users, more connected devices, more AI services, and now more AI agents capable of interacting with systems and data on behalf of people. The result is an environment where access decisions have to account for much more than a user's location or whether traffic originated from inside the corporate network.
As Microsoft expands its AI, cloud, identity, and security strategy heading into Ignite 2026, the network is becoming an increasingly important security control point. It is where identities, endpoints, applications, agents, cloud platforms, and data intersect.
For IT leaders, that means network modernization and cybersecurity strategy can no longer be treated as separate initiatives.
The Network Has Become Part of the Identity Strategy
Modern access decisions increasingly begin with identity.
Who is requesting access? What device are they using? Is that device compliant? What application are they trying to reach? What data could they access? What is the current risk level of the user or session?
Microsoft's Zero Trust approach reflects this shift by bringing identity, endpoint posture, application context, and network controls together. Microsoft Entra Conditional Access can evaluate identity and device signals before access is granted, while Microsoft Entra Internet Access and Microsoft Entra Private Access extend identity-aware policy into web, SaaS, Microsoft 365, and private application traffic.
That changes the role of the network.
Instead of functioning only as a path between a user and a resource, the network can become part of the decision-making layer that determines whether access should be allowed, restricted, monitored, or blocked.
For organizations, this creates an opportunity to move away from broad access based on network location and toward access that is more closely aligned with the user, device, application, and risk involved in the request.
AI Agents Add Another Type of Network Participant
AI agents make this shift even more important.
An agent may need to communicate with Microsoft 365, a cloud application, an API, an internal system, another agent, or an external service. Some agents may operate inside a user's Microsoft environment. Others may run on endpoints or within cloud platforms.
Those connections create new questions for security teams.
Where is the agent allowed to connect? Which applications and services can it reach? Can it send sensitive information to an external destination? What happens if the agent is manipulated by malicious content? Can the organization see what the agent is doing on the network?
Microsoft has been extending network controls into its agent security strategy, including the ability to apply access and traffic policies to AI agents. The underlying principle is straightforward: agents should not have unrestricted network access simply because they are operating on behalf of an authorized user or business process.
The same least-privilege concepts that apply to people should increasingly apply to machine-driven activity.
That makes network visibility and access control part of AI governance.
Secure Access Has to Follow the User
Remote and hybrid work already challenged the idea that security controls could depend on a user being physically connected to the corporate network.
AI expands that challenge.
A user may work from an office, home, hotel, customer site, or mobile device. They may connect to Microsoft 365, Azure, a SaaS application, a private business system, and several AI services during the same workday.
The security policy needs to follow the user across those environments.
Microsoft's Global Secure Access strategy is built around this idea. Microsoft Entra Internet Access can apply identity-centric security controls to internet and SaaS traffic, while Microsoft Entra Private Access can provide Zero Trust Network Access to private resources without relying on a traditional broad-access VPN model.
The strategic takeaway is bigger than any individual Microsoft product.
Organizations should be designing access around identity and context instead of location alone. The network should help enforce the same security principles regardless of where the employee, device, application, or agent happens to be operating.
Endpoint Posture Becomes Part of Network Security
A trusted identity is not enough if the device behind that identity is compromised or unmanaged.
This is where endpoint management and network access increasingly converge.
Microsoft Intune and Entra can work together to evaluate whether a device meets organizational requirements before granting access to applications and data. Compliance policies can consider factors such as encryption, operating system version, security configuration, and device management status.
Conditional Access can then use that information when deciding whether access should be granted.
That creates a more dynamic security model.
Instead of assuming every authenticated user should receive the same level of access, organizations can require both a trusted identity and a healthy device. A user connecting from a managed, compliant endpoint may receive normal access. The same user connecting from an unknown or noncompliant device may receive limited access or be blocked entirely.
For organizations preparing for more AI-driven workflows, this matters because AI applications and agents can increase the amount of sensitive information that users can discover and act on. Strong endpoint controls help make sure those capabilities are being accessed from devices the organization actually understands and manages.
Segmentation Still Matters
Zero Trust does not eliminate the need for network segmentation.
In fact, more connected environments can make segmentation more important.
AI services, cloud applications, branch locations, endpoints, servers, operational systems, development environments, and private applications should not automatically have unrestricted access to one another.
Organizations need to understand which systems should communicate and which should remain isolated.
Segmentation can reduce the blast radius of a compromised account, endpoint, application, or agent. It can prevent one security event from becoming a pathway into unrelated systems.
This becomes particularly important in hybrid environments where workloads may span Azure, private infrastructure, SaaS platforms, and distributed locations.
Network architecture should define intentional communication paths rather than allowing connectivity simply because the underlying technology makes it possible.
DNS and Traffic Visibility Are Becoming More Valuable
Many security incidents leave evidence at the network layer before they create obvious operational impact.
A compromised endpoint may begin connecting to suspicious domains. An unauthorized AI tool may communicate with an external service. A user may upload data to an unsanctioned SaaS application. An agent may begin interacting with destinations outside its expected workflow.
DNS and traffic visibility can help security teams identify that behavior.
This does not mean every organization needs to inspect every packet moving across the environment. It means organizations need enough visibility to understand where users, devices, applications, and agents are connecting and to identify behavior that falls outside expected patterns.
As Microsoft connects identity and network controls more closely, traffic data can become another signal in broader security decisions.
The network can help answer questions that identity systems alone cannot.
Where did the request go? What destination was contacted? Was the connection expected? Was sensitive data involved? Did the activity originate from a managed endpoint? Was the traffic routed through approved security controls?
Those questions become increasingly important as AI generates more automated activity.
Cloud Connectivity Is Also a Security Decision
Cloud architecture and network architecture are deeply connected.
Organizations may use public internet connectivity, private connections, virtual networks, cloud firewalls, private endpoints, secure access services, and hybrid routing to connect users and workloads to Azure and Microsoft 365.
Each of those design decisions affects security as well as performance.
A cloud workload that is configured securely at the application level can still be exposed by weak network architecture. A private application can still create risk if remote users reach it through overly broad access. A well-managed Microsoft 365 tenant can still be affected by unmanaged devices or unsanctioned network paths.
IT leaders should evaluate cloud connectivity as part of the security architecture rather than treating it as a separate infrastructure concern.
This is especially important as organizations deploy AI services that depend on large volumes of data or connections between multiple systems. The pathways between those systems need to be resilient, observable, and appropriately controlled.
Monitoring Has to Connect the Layers
The modern environment produces signals everywhere.
Identity platforms generate authentication and risk data. Endpoints generate device and threat telemetry. Firewalls generate network activity. DNS systems record domain requests. Cloud platforms generate operational logs. Microsoft 365 records user and application activity. AI systems and agents create additional interaction data.
The challenge is turning those signals into usable context.
Security teams should be able to correlate activity across identity, endpoints, networks, applications, and cloud services rather than investigating each layer independently.
This is one reason Microsoft's broader security platform continues to bring Defender, Sentinel, Entra, Purview, endpoint controls, and network security capabilities closer together.
The more connected the environment becomes, the more valuable that shared context becomes.
A suspicious login means more when the security team also knows the device is unmanaged, the network connection originated from an unusual location, and the account immediately accessed sensitive data. Each signal becomes more useful when it can be understood alongside the others.
Network Modernization and Cybersecurity Are Becoming the Same Conversation
For many organizations, network and security teams have historically operated as separate disciplines.
That separation is becoming harder to maintain.
Identity-aware access depends on network enforcement. Endpoint compliance influences application access. Cloud connectivity affects the security boundary. Segmentation limits attack movement. DNS visibility supports threat detection. AI governance increasingly requires controlling where agents and applications can connect.
Network architecture is now part of cybersecurity architecture.
That is why L3 approaches secure networking through both its Cybersecurity & Risk and Infrastructure & Modern Workplace practices. The goal is not simply to deploy a firewall, configure Intune, or turn on another Microsoft feature. The goal is to make sure identity, endpoints, connectivity, segmentation, monitoring, and policy work together.
What L3 Is Watching Heading Into Microsoft Ignite
Microsoft Ignite 2026 is expected to put significant attention on AI, cloud, security, and the infrastructure needed to connect them. Microsoft's current security direction already points toward stronger integration between identity, network access, endpoint posture, and agent security.
For customers, the important question is not which individual feature Microsoft announces next.
The bigger question is whether their environment is ready for a model where access decisions are increasingly dynamic, identity-aware, device-aware, data-aware, and AI-aware.
Organizations can prepare by reviewing endpoint compliance, Conditional Access, remote access, network segmentation, DNS visibility, cloud connectivity, traffic monitoring, and the consistency of security policy across users and locations.
AI may be raising the bar for what technology environments can do. It is also raising the bar for the security architecture underneath them.
Take the Next Step: Modern Endpoint Management Review
Identity-aware access works best when the organization has confidence in the devices connecting to its applications and data. L3's Modern Endpoint Management Review helps identify enrollment, compliance, policy, and access-control gaps across Intune and Entra ID so organizations can build a stronger foundation for Zero Trust, secure access, and AI-enabled work.
