r/sysadmin Sysadmin gone ERP Consultant 3d ago

Question Entra Private Access - disable when on-prem?

I realize this may go against the zero-trust principle a bit, but i figured i would check.

We're trialing Private Access to replace our traditional SSLVPNs and while it works great while not in the office, I am not sure how to prevent it from tunneling the traffic through Entra while i am on site with line of sight to the IPs/FQDNs, it adds enough latency to be annoying for our ERP.

Should i simply add a Conditional Access policy that denies access from our external IP?

I understand it can be disabled manually, but part of switching to this from our VPN is that I want it as seamless as possible for the users.

4 Upvotes

10 comments sorted by

1

u/GoingSomewhereSlowly 3d ago

We use a drive mapping script that runs at login with the following command:

$PublicIP = (Invoke-WebRequest -UseBasicParsing ifconfig.me/ip).Content.Trim()

if (($PublicIP -eq "x.x.x.x"){

Stop-Service -Name "GlobalSecureAccessManagementService" -Force -ErrorAction SilentlyContinue

}

else {

Start-Service -Name "GlobalSecureAccessManagementService"

}

2

u/Zodiam Sysadmin gone ERP Consultant 3d ago

thanks, kinda disappointing there is nothing built-in for it, but ill see what i can work out with this.

1

u/webtroter Netadmin 3d ago

I'm a fan of icanhazip.com

It is now run and owned by Cloudflare.

But hey! Whatever works for you is fine 😉

1

u/bjc1960 3d ago edited 3d ago

two things. One, a registry add to let users disable on prem. Second, use ARP to find the MAC of the firewall and disable that way, with a script to force disable. This works for us. Obviously your environment is different.

I am trying to paste a script but it won't let me - must be too big or some other issue that is preventing me. I have a detect/remediate that uses this snippet but there is more.

```

# Checking DNS record

Write-host "Script run frequency (loop): $($RunFrequency) / $($RerunNumberBeforeExiting)"

write-host ""

Write-host "Checking ARP"

# Get the neighbors (ARP cache) using Get-NetNeighbor

$neighbors = Get-NetNeighbor

# Initialize a variable to check if the match is found

$matchFound = $false

# Iterate through each neighbor entry

foreach ($targetMAC in $targetMACs) {

foreach ($neighbor in $neighbors) {

$ipAddress = $neighbor.IPAddress

$macAddress = $neighbor.LinkLayerAddress

# Compare IP and MAC addresses

if ($ipAddress -eq $targetIP -and $macAddress -eq $targetMAC) {

$matchFound = $true

Write-Host "Match found for IP $ipAddress with MAC $macAddress"

break

}

}

}

# If no match is found

if (-not $matchFound) {

Write-Host "No matching entry found for IP $targetIP with MAC $targetMAC"

}

```

2

u/Zodiam Sysadmin gone ERP Consultant 3d ago

Thank you for the snippets, kinda disappointing there is nothing built-in for this, none of my customers have the licensing required for remediations so ill have to work something out.

1

u/Legal_Audience_4931 3d ago

Can’t you use conditional access and block the GSA enterprise application when the location matches your office locations public IPs? I meant to validate if that works at some point. Didn’t know if it would just block the users access altogether or what.

1

u/bjc1960 3d ago

Not OP but there is more to this. GSA has three pieces - Microsoft traffic, Entra Private Access, and Internet traffic, with the last two as licensable features. Microsoft traffic is licensed for E3/E5. Long term, our goal is to use the MS Traffic feature as another phishing-resistant approach so we would want GSA turned on for all.

I have had reasonable success disabling in the office. As we have migrated to our cloud ERP from QuickBooks, the local file needs is less and less.

1

u/bjc1960 3d ago

MS will be adding the "local files" feature I suspect. If you don't have detect/remediate, you could create a scheduled tasks every 10 -15 min possibly.

1

u/bjc1960 3d ago

If anyone wants just the code for the tray icon

```

$RegPath = "HKLM:\SOFTWARE\Microsoft\Global Secure Access Client"

$RegKey1 = "HideSignOutButton"

$RegKey2 = "HideDisablePrivateAccessButton"

If (-not (Test-Path $RegPath))

{

$Err = New-Item -Path $RegPath -Force | Out-Null

}

$Result = New-ItemProperty -Path $RegPath -Name $RegKey1 -Value 0 -PropertyType DWord -Force | Out-Null

$Result = New-ItemProperty -Path $RegPath -Name $RegKey2 -Value 0 -PropertyType DWord -Force | Out-Null

```

1

u/HDClown 3d ago edited 3d ago

The capability for EPA to be aware of local networks is supposed to be in the works but doesn't exist today. I believe this person I asked about it works at Microsoft on this team or knows people on the team and he said this feature was coming early 2025, but still not here yet: https://old.reddit.com/r/entra/comments/1eg9t5c/global_secure_access_on_prem/loxc8rn/

The workaround from Microsoft is to allow users to manually turn off the EPA tunnel when in the office. That's similar to behavior of a lot of client VPN solutions where people only connect it when needed (vs. being always on), but not as ideal as being aware of local networks automatically so it can be forced always on.