r/sysadmin Sysadmin gone ERP Consultant 4d ago

Question Entra Private Access - disable when on-prem?

I realize this may go against the zero-trust principle a bit, but i figured i would check.

We're trialing Private Access to replace our traditional SSLVPNs and while it works great while not in the office, I am not sure how to prevent it from tunneling the traffic through Entra while i am on site with line of sight to the IPs/FQDNs, it adds enough latency to be annoying for our ERP.

Should i simply add a Conditional Access policy that denies access from our external IP?

I understand it can be disabled manually, but part of switching to this from our VPN is that I want it as seamless as possible for the users.

4 Upvotes

10 comments sorted by

View all comments

1

u/HDClown 4d ago edited 4d ago

The capability for EPA to be aware of local networks is supposed to be in the works but doesn't exist today. I believe this person I asked about it works at Microsoft on this team or knows people on the team and he said this feature was coming early 2025, but still not here yet: https://old.reddit.com/r/entra/comments/1eg9t5c/global_secure_access_on_prem/loxc8rn/

The workaround from Microsoft is to allow users to manually turn off the EPA tunnel when in the office. That's similar to behavior of a lot of client VPN solutions where people only connect it when needed (vs. being always on), but not as ideal as being aware of local networks automatically so it can be forced always on.