A university sends Microsoft 365 traffic from each campus to a cloud security provider for inspection, and only then on to Microsoft. Users do not break out directly. Which SaaS connectivity model is this?
Select an answer to reveal the explanation.
Short Explanation
The application is not the first stop. You send Microsoft 365 to the cloud security provider, they inspect it, and only then does it go on to Microsoft, which is indirect SaaS access. Walking straight out to Microsoft would be direct, and you are not doing that.
Full Explanation
Indirect access inserts a cloud security provider between the user and the SaaS application. Each campus forwards Microsoft 365 to that provider, the provider inspects it, and the provider completes the connection to Microsoft. The user does not break out directly, so this is not the direct-internet model. Direct internet access would send the campus to Microsoft without that security cloud in the path. A centralized internet gateway backhauls everyone to one campus exit. The stem does not describe that, and it specifically puts a cloud security provider in the path, which a plain centralized gateway does not. A dedicated private circuit for the tenant's mail flow is the dedicated-connectivity model. Nothing here says Microsoft has given this university a private peering for mail. Exam caveat: the security provider can sit as a secure internet gateway in an SD-WAN design or as an explicit proxy. Either way the model is indirect if the SaaS flow is inspected there before it reaches Microsoft. Operational check: a campus trace toward Microsoft 365 should hit the cloud security provider's tunnel or proxy address first, and that provider's log should show the session.