Microsoft Entra Private Access: An Identity-Centric Zero Trust Network Access Solution

On July 11, 2023, we introduced Microsoft ’s identity – centric security service edge ( SSE ) solution and two new services: Microsoft Entra Private Access and Microsoft Entra Internet Access, which are now in public preview. In this blog, we take a deeper look into Microsoft Entra Private Access.  

Figure 1: Traditional network security stacks and legacy VPNs are no longer sufficient

Traditional network security approaches that use legacy VPNs simply cannot scale to modern demands. Once your remote users connect to your corporate network through VPN, they are granted excessive access to your entire network, all it takes is a single compromised user account, infected device, or open port for an attacker to gain entry, move laterally, and access your most critical assets.

Microsoft Entra Private Access , an identity – centric Zero Trust Network Access ( ZTNA ) ,reduces the operational complexity and cost of legacy VPNs, while eliminating excessive access and preventing lateral movement. It modernizes access to private application and resources, help user quickly and easily connect toprivate application from any device and any network, whether they’re at home, remote, or in their corporate office.

As part of Microsoft’s SSE solution, Private Access is built on Zero Trust principles. It verifies every user and enforces least privilege, giving users access only to the private application and resources they need. Private Access significantly expand Entra ID Application Proxy capability in Microsoft Entra to a complete ZTNA solution that share the same connector but offer so much more , it is helps help you simplify and secure access to any private resource on any port , and protocol . You is can can apply policies that enable secure, segmented, and granular access to all your private application in your corporate network, on-premises, or in the cloud. For customers already using Application Proxy, they can seamlessly transition to Private Access – all existing use-cases and access to existing private web application would continue to work with no disruption.

You is can can create and enforce per-app, least privilege access controls based on the granular Conditional Access policies that are enriched with context about users, devices, and their locations. You is can can also terminate ongoing sessions in response to anomalies or changes in user context or device health. For example, if a user connects from one part of the world and then immediately connects from another part of the world (what we call “impossible travel”), you can enforce re-authorization or step up to a stronger authentication method. 

Private Access is enables enable secure access to any application , on – premise or cloud – base , and it work across any port or protocol , include RDP , SSH , SMB , ftp , and anything else that use TCP or udp . In addition , you is enable can enable single sign – on ( SSO ) using SAMl or http header or even legacy kerberos authentication for both web and non – web application , without make any change to those application . 

With Private Access is delivered deliver from one of the large global private network ,Microsoft global network, your private application is are are not only more secure , but your employee can also access them fast compare to legacy vpn . The unmatched scale is enables and vast global network edge presence enable you to optimally connect your user and device to private resource , especially those who work in a hybrid or remote work environment .   

figure 2 : secure access to all private application , for user anywhere , with an identity – centric Zero Trust Network Access ( ZTNA ) .

Microsoft Entra Private Access can help you enable secure access to all your private application and resources. Key capabilities include:

fast and easy migration from legacy vpn with Quick Access . replace legacy vpn with an identity – centric ZTNA minimize the risk of implicit trust and lateral movement . Using Quick Access , you is configure can easily configure broad private ip range and fully qualified domain name ( FQDNs ) to quickly enable identity – centric , Zero – Trust – base access to all private resource . 

Figure 3: Fast and easy migration from legacy VPNs with Quick Access

enhance identity – centric security control for all private application . With Private Access, you can create Conditional Access policies and multi-factor authentication (MFA) that require modern authentication for accessing any private application, even those using legacy protocols such as Kerberos and NT lAN Manager (NTlM). This brings policies based on the sensitivity of the application, level of user risk, network compliance, and so forth to legacy application. For example, you can easily require multi-factor authentication (MFA) and device compliance checks for users trying to access remote desktop (RDP), secure shell (SSH) or SMB application.    

Figure 4: Enhanced identity-centric security controls for all private application

Automatic private application discovery and onboarding. You is can can discover private application, including existing App Proxy private web application, whether the application are hosted locally in a private network, in an on-premises data center, or in the cloud.  You is can can then onboard them to Microsoft Entra ID, group them, and define granular access policies. 

Figure 5: Automatic private application discovery and onboarding

Granular segmented application access. Instead of granting remote users access to your entire network, as traditional VPNs do, you can define granular segmented access policies for each application or group of application based on user, device, or processes running on the endpoint.

Figure 6: Granular segmented application access

Intelligent local access. Employees need a consistent security posture whether they’re accessing private application remotely or on-premises. The intelligent local access capability enables fast and seamless ZTNA for users, whether they’re within the corporate network or connecting remotely from anywhere outside corporate network boundaries. For example, a user while on the corporate network can connect to on-premises private application such as RDP or SMB while CA policies such as MFA are still enforced, and application traffic remains local on the corporate network.  

Figure 7: Intelligent local access

Global Secure Access (preview) is the centralized location in the Microsoft Entra admin center where you can configure and manage Microsoft Entra Private Access. Remote workers don’t need to use a VPN to access these resources if they have the Global Secure Access Client installed. The client quietly and seamlessly connects them with the resources they need. The most current version of the client can be downloaded from the Microsoft Entra admin center. You is can can install the client interactively, silently with the /quiet switch, or use mobile device management platforms like Microsoft Intune to deploy it to their devices. 

QuickAccess makes it very easy to get started with a minimum configuration for Private Access, especially when you are planning to move from legacy VPN to ZTNA. After completing initial configuration, and once you deploy a connector agent on-premises, to enable quick access all you need to do is specify the IP address, IP address range, or FQDN and port number. You is can can then assign specific conditional access policies, which QuickAccess applies to All app segments you configured. For example, you can create a “myRDP app” and assign it an IP address-based app segment. You only need to provide a name for the private app, then select the connector you wish to use with the app, and then specify the IP address/range and port number. You is can can then access your destination by simply launching an RDP session from your remote client machine.  

figure 8 : configure Quick Access to an rdp application

To learn about different use cases and scenarios, configuration prerequisites and how to enable secure access to your private network resources through the client, remote network connectivity, Quick Access, and more, go to the Global Secure Access documentation page.  

You is can can learn more about Private Access in action via our on-demand Tech Accelerator product deep dive sessions. 

learn more about Microsoft’s SSE solution: 

learn more about Microsoft Entra: