Microsoft Entra Private Access Step by Step Tutorial and Demo using Zero Trust

In this video we are going to give a step by step guide, deep dive and demo on Microsoft Entra Private Access and how to configure implement this solution. Entra Private Access is currently in public preview we can secure access to all private apps, resources and protocols from endpoints to secure all access using a zero trust model.

This video will cover a step by step by first setting up Entra Private Access and activating on your tenant, installing the app proxy connector.
Then create an azure enterprise app in the azure cloud for RDP, SMB, HTTP and then specify the ports that need opening on that app and the IP address of the server hosting those protocols in our private internal network. We then discuss conditional access policys targeting that enterprise app and secure it and apply security controls such as multifactor authentication, checking device compliance, identity protection and governance, group access, network access etc. We then install the global access client and give a demo on Microsoft Entra Private Access.

00:08 - Microsoft Entra SSE Private Access
03:10 - Global Secure Access Tenant Activation
03:38 - App Proxy Connector Download and Install
05:59 - Create an Enterprise Application
06:38 - Add Network Segment for RDP, HTTP and SMB
07:45 - Conditional Access Policy
11:33 - Enable Private Access Traffic Forward Profile
11:52 - Install Global Secure Access Client on Windows
13:00 - Global Secure Access signaling Conditional Access
14:07 - Microsoft Entra Private Access Demo to RDP, HTTP & SMB file shares
15:19 - Traffic logs

Cloud Inspired Video - Microsoft Entra Security Service Edge (SSE) Internet Access & Private Access Overview

Cloud Inspired Video - Azure AD Identity Protection & Conditional Access

#zerotrust
#microsoftentra
#azuread

[rapiddl]

Love the way you explained Zero trust.

[mosksky]

Amazing demo!!! so really this way i don't even need to provision azure bastion as i can remote in to my hosts! TY Ed, really awosome!

[RobFahndrich]

This is awesome. One thing that I am confused on is how does an FQDN work? What forces your DNS lookups to use one of your on prem DNS servers?
I set this up so that I could access one of my SQL servers and it works great if I have the IP address. If I try to use the FQDN it fails because the FQDN cannot be resolved. Thoughts on this one?

[hapskie]

Private access looks amazing. Still have some questions, hope you can answer:
- As it requires the same license (P1) and can also give users access to on-premise web based applications, is there still a valid use case for using Application Proxy? I guess you'd still need app proxy to give access to on-premise web based resources from non-azure joined devices, or devices without the GSA client?
- Does this also work from Azure joined devices that use WHfB, so passwordless login, giving SSO to on-premise applications without the use of WHfB Cloud Kerberos Trust?

[alexis]

Hi, thanks for the tutorial 👌

Everything ok except the global access clients, i have several warning such as disabled by your organization and breakglass mode disabled.

Could you help me ?thanks !

[MrMarcLaflamme]

So does ALL traffic end up flowing through the proxy? Or is this for authentication only? Don't really understand how the network flow works. Also, you added two different endpoints to the same Enterprise App (RDP to DC). Is this the recommended way of doing it?

[andersontapetti]

Did tested in our environment and this is awesome!
Just one question: with azure joined computers, there is a way to skip RDP from asking MFA? is this related to condition?

[mattcauthen]

We’ve had a lot of issues with authentication over private access preview - Specifically with file shares / SMB and Kerberos- any advice on this?

[vish]

Hi, A very informative demo. but unable to reach ADDS configured azure file share from private access, ... as users is unable to authicate with DC....pls suggest how we can resolve this? Thanks.

[fatihtozlu]

Great demo. Thanks 👍
Some remarks:
1.MDM such as Intune managed devices could be also included and not only domain joined ones.
2. MS Entra App Proxy connector requires Win 2012 or later, can it be used on any VM? Example in AWS or GCP? Should be great for example a “ready to use connector” available in marketplaces.

[giorgiomaiorano]

fantastic explanation. I would just like to ask if for Microsoft Enter Private Access I need some particular license. I have the Microsoft 365 E5, thanks in advance

[cyphernz]

Can the GSA client auto connect? Ie always on.

[ajithm]

hi thanks for your video could you post corporate users VPN connection though ms entra

[regipradeeswaran]

Brilliant demo. Looks like this may replace my Zscaler Private Access setup. Any Azure licencing requirements ? Will this work on domain joined laptops and not Azure joined ? Also support for Mac's in the future? I think with this I can replace the legacy VPN to HQ hopefully 👍🙏

[fbifido]

Setup concept:

We have Azure Entra-AD & 100 Microsoft 365 Business Premium:
- in Azure IaaS, we have 2 Windows Server 2022 Azure Entra-AD joined, running file server, and a Azure NAT-GW for them to get internet & windows update.
- on-prem we also have 2 Windows Server 2022 Azure Entra-AD joined, running print server, and a hardware firewall for internet access, DHCP, DNS.
- on-prem we have 80 Windows 10 Pro desktop, that is Azure Entra-AD joined.

note: we don't have Active Directory on-prem, nor Azure Entra Active Directory Domain Services in Azure.

Can we use Microsoft Entra Private Access to allow the 80 clients to access the 2 file server in Azure IaaS without a VPN?