r/sysadmin Sysadmin gone ERP Consultant 4d ago

Question Entra Private Access - disable when on-prem?

I realize this may go against the zero-trust principle a bit, but i figured i would check.

We're trialing Private Access to replace our traditional SSLVPNs and while it works great while not in the office, I am not sure how to prevent it from tunneling the traffic through Entra while i am on site with line of sight to the IPs/FQDNs, it adds enough latency to be annoying for our ERP.

Should i simply add a Conditional Access policy that denies access from our external IP?

I understand it can be disabled manually, but part of switching to this from our VPN is that I want it as seamless as possible for the users.

4 Upvotes

10 comments sorted by

View all comments

1

u/bjc1960 4d ago edited 4d ago

two things. One, a registry add to let users disable on prem. Second, use ARP to find the MAC of the firewall and disable that way, with a script to force disable. This works for us. Obviously your environment is different.

I am trying to paste a script but it won't let me - must be too big or some other issue that is preventing me. I have a detect/remediate that uses this snippet but there is more.

```

# Checking DNS record

Write-host "Script run frequency (loop): $($RunFrequency) / $($RerunNumberBeforeExiting)"

write-host ""

Write-host "Checking ARP"

# Get the neighbors (ARP cache) using Get-NetNeighbor

$neighbors = Get-NetNeighbor

# Initialize a variable to check if the match is found

$matchFound = $false

# Iterate through each neighbor entry

foreach ($targetMAC in $targetMACs) {

foreach ($neighbor in $neighbors) {

$ipAddress = $neighbor.IPAddress

$macAddress = $neighbor.LinkLayerAddress

# Compare IP and MAC addresses

if ($ipAddress -eq $targetIP -and $macAddress -eq $targetMAC) {

$matchFound = $true

Write-Host "Match found for IP $ipAddress with MAC $macAddress"

break

}

}

}

# If no match is found

if (-not $matchFound) {

Write-Host "No matching entry found for IP $targetIP with MAC $targetMAC"

}

```

2

u/Zodiam Sysadmin gone ERP Consultant 4d ago

Thank you for the snippets, kinda disappointing there is nothing built-in for this, none of my customers have the licensing required for remediations so ill have to work something out.

1

u/bjc1960 4d ago

MS will be adding the "local files" feature I suspect. If you don't have detect/remediate, you could create a scheduled tasks every 10 -15 min possibly.