A lot of places are skipping that because they dont have self hosted servers but is allready hosting everything in "the cloud". Like for a simplified example, i

A lot of places are skipping that because they dont have self hosted servers but is allready hosting everything in "the cloud". Like for a simplified example, if you are using google docs + gmail it does not really make sense to force the employees throught a VPN first. The companies that do it well implement something like google's beyondcorp, the bad just uses direct authentication.