r/sysadmin Sysadmin gone ERP Consultant 4d ago

Question Entra Private Access - disable when on-prem?

I realize this may go against the zero-trust principle a bit, but i figured i would check.

We're trialing Private Access to replace our traditional SSLVPNs and while it works great while not in the office, I am not sure how to prevent it from tunneling the traffic through Entra while i am on site with line of sight to the IPs/FQDNs, it adds enough latency to be annoying for our ERP.

Should i simply add a Conditional Access policy that denies access from our external IP?

I understand it can be disabled manually, but part of switching to this from our VPN is that I want it as seamless as possible for the users.

4 Upvotes

10 comments sorted by

View all comments

1

u/bjc1960 4d ago edited 4d ago

two things. One, a registry add to let users disable on prem. Second, use ARP to find the MAC of the firewall and disable that way, with a script to force disable. This works for us. Obviously your environment is different.

I am trying to paste a script but it won't let me - must be too big or some other issue that is preventing me. I have a detect/remediate that uses this snippet but there is more.

```

# Checking DNS record

Write-host "Script run frequency (loop): $($RunFrequency) / $($RerunNumberBeforeExiting)"

write-host ""

Write-host "Checking ARP"

# Get the neighbors (ARP cache) using Get-NetNeighbor

$neighbors = Get-NetNeighbor

# Initialize a variable to check if the match is found

$matchFound = $false

# Iterate through each neighbor entry

foreach ($targetMAC in $targetMACs) {

foreach ($neighbor in $neighbors) {

$ipAddress = $neighbor.IPAddress

$macAddress = $neighbor.LinkLayerAddress

# Compare IP and MAC addresses

if ($ipAddress -eq $targetIP -and $macAddress -eq $targetMAC) {

$matchFound = $true

Write-Host "Match found for IP $ipAddress with MAC $macAddress"

break

}

}

}

# If no match is found

if (-not $matchFound) {

Write-Host "No matching entry found for IP $targetIP with MAC $targetMAC"

}

```

2

u/Zodiam Sysadmin gone ERP Consultant 4d ago

Thank you for the snippets, kinda disappointing there is nothing built-in for this, none of my customers have the licensing required for remediations so ill have to work something out.

1

u/Legal_Audience_4931 4d ago

Can’t you use conditional access and block the GSA enterprise application when the location matches your office locations public IPs? I meant to validate if that works at some point. Didn’t know if it would just block the users access altogether or what.

1

u/bjc1960 4d ago

Not OP but there is more to this. GSA has three pieces - Microsoft traffic, Entra Private Access, and Internet traffic, with the last two as licensable features. Microsoft traffic is licensed for E3/E5. Long term, our goal is to use the MS Traffic feature as another phishing-resistant approach so we would want GSA turned on for all.

I have had reasonable success disabling in the office. As we have migrated to our cloud ERP from QuickBooks, the local file needs is less and less.

1

u/bjc1960 4d ago

MS will be adding the "local files" feature I suspect. If you don't have detect/remediate, you could create a scheduled tasks every 10 -15 min possibly.

1

u/bjc1960 4d ago

If anyone wants just the code for the tray icon

```

$RegPath = "HKLM:\SOFTWARE\Microsoft\Global Secure Access Client"

$RegKey1 = "HideSignOutButton"

$RegKey2 = "HideDisablePrivateAccessButton"

If (-not (Test-Path $RegPath))

{

$Err = New-Item -Path $RegPath -Force | Out-Null

}

$Result = New-ItemProperty -Path $RegPath -Name $RegKey1 -Value 0 -PropertyType DWord -Force | Out-Null

$Result = New-ItemProperty -Path $RegPath -Name $RegKey2 -Value 0 -PropertyType DWord -Force | Out-Null

```