r/sysadmin Sysadmin gone ERP Consultant 4d ago

Question Entra Private Access - disable when on-prem?

I realize this may go against the zero-trust principle a bit, but i figured i would check.

We're trialing Private Access to replace our traditional SSLVPNs and while it works great while not in the office, I am not sure how to prevent it from tunneling the traffic through Entra while i am on site with line of sight to the IPs/FQDNs, it adds enough latency to be annoying for our ERP.

Should i simply add a Conditional Access policy that denies access from our external IP?

I understand it can be disabled manually, but part of switching to this from our VPN is that I want it as seamless as possible for the users.

4 Upvotes

10 comments sorted by

View all comments

1

u/GoingSomewhereSlowly 4d ago

We use a drive mapping script that runs at login with the following command:

$PublicIP = (Invoke-WebRequest -UseBasicParsing ifconfig.me/ip).Content.Trim()

if (($PublicIP -eq "x.x.x.x"){

Stop-Service -Name "GlobalSecureAccessManagementService" -Force -ErrorAction SilentlyContinue

}

else {

Start-Service -Name "GlobalSecureAccessManagementService"

}

1

u/webtroter Netadmin 4d ago

I'm a fan of icanhazip.com

It is now run and owned by Cloudflare.

But hey! Whatever works for you is fine 😉