I have to be logged in to azure vpn to access the development environment of the web application I work on because heavens forbid if our users stumble upon a non-production version of the application on the Internet and yet these people just put everything out there for everyone to see. At least I think it should require a CAC card or a PIV card to access sensitive data like this, shutting down immediately if the card presence is not detected somehow.