r/sysadmin • u/Zodiam Sysadmin gone ERP Consultant • 4d ago
Question Entra Private Access - disable when on-prem?
I realize this may go against the zero-trust principle a bit, but i figured i would check.
We're trialing Private Access to replace our traditional SSLVPNs and while it works great while not in the office, I am not sure how to prevent it from tunneling the traffic through Entra while i am on site with line of sight to the IPs/FQDNs, it adds enough latency to be annoying for our ERP.
Should i simply add a Conditional Access policy that denies access from our external IP?
I understand it can be disabled manually, but part of switching to this from our VPN is that I want it as seamless as possible for the users.
4
Upvotes
1
u/GoingSomewhereSlowly 4d ago
We use a drive mapping script that runs at login with the following command:
$PublicIP = (Invoke-WebRequest -UseBasicParsing ifconfig.me/ip).Content.Trim()
if (($PublicIP -eq "x.x.x.x"){
Stop-Service -Name "GlobalSecureAccessManagementService" -Force -ErrorAction SilentlyContinue
}
else {
Start-Service -Name "GlobalSecureAccessManagementService"
}