Only a private IP address and is not accessible from the Internet
Published through secure Cloudflare Tunnel outbound connection
By default accessible to anyone in your company with WARP client
Access can be limited to certain groups, users, countries, etc through Zero Trust application policies
No VPN concentrator or static NAT or IP address anymore
Device posture and conditional access comes at no extra cost
Please have it in mind around hardware or subscription renewal :)