Appendix: Post-Migration TODOs

Evaluate: migrate ASA to FTD with Secure Client (AnyConnect successor) — separate project

Evaluate: ISE upgrade to 3.3+ for native SAML IdP proxy if Option B was used

Evaluate: Entra Private Access as eventual ASA VPN replacement (zero-trust)

Audit: remove any lingering Okta integrations across other services

Document: lessons learned for next Okta→Entra migration (other apps)