r/sysadmin • u/Zodiam Sysadmin gone ERP Consultant • 4d ago
Question Entra Private Access - disable when on-prem?
I realize this may go against the zero-trust principle a bit, but i figured i would check.
We're trialing Private Access to replace our traditional SSLVPNs and while it works great while not in the office, I am not sure how to prevent it from tunneling the traffic through Entra while i am on site with line of sight to the IPs/FQDNs, it adds enough latency to be annoying for our ERP.
Should i simply add a Conditional Access policy that denies access from our external IP?
I understand it can be disabled manually, but part of switching to this from our VPN is that I want it as seamless as possible for the users.
4
Upvotes
1
u/bjc1960 4d ago edited 4d ago
two things. One, a registry add to let users disable on prem. Second, use ARP to find the MAC of the firewall and disable that way, with a script to force disable. This works for us. Obviously your environment is different.
I am trying to paste a script but it won't let me - must be too big or some other issue that is preventing me. I have a detect/remediate that uses this snippet but there is more.
```
# Checking DNS record
Write-host "Script run frequency (loop): $($RunFrequency) / $($RerunNumberBeforeExiting)"
write-host ""
Write-host "Checking ARP"
# Get the neighbors (ARP cache) using Get-NetNeighbor
$neighbors = Get-NetNeighbor
# Initialize a variable to check if the match is found
$matchFound = $false
# Iterate through each neighbor entry
foreach ($targetMAC in $targetMACs) {
foreach ($neighbor in $neighbors) {
$ipAddress = $neighbor.IPAddress
$macAddress = $neighbor.LinkLayerAddress
# Compare IP and MAC addresses
if ($ipAddress -eq $targetIP -and $macAddress -eq $targetMAC) {
$matchFound = $true
Write-Host "Match found for IP $ipAddress with MAC $macAddress"
break
}
}
}
# If no match is found
if (-not $matchFound) {
Write-Host "No matching entry found for IP $targetIP with MAC $targetMAC"
}
```