8.1 Microsoft Entra Private Access

Why Private Access Matters on SC-500

Under Secure storage, databases, and networking (25–30%), Microsoft explicitly measures Implement and configure Microsoft Entra Private Access. SC-500 expects you to place Private Access correctly in a Zero Trust design: identity-aware, per-app access to private resources—not a traditional full-tunnel VPN that dumps remote users onto the entire corporate network.

Microsoft Entra Private Access is part of Microsoft’s Security Service Edge (SSE) solution. In the admin center and docs you will see the umbrella name Global Secure Access, which unifies:

Private Access is the piece that modernizes remote and hybrid access to internal apps—on-premises, hybrid, or private IP resources in cloud VNets—using Entra identity and Conditional Access instead of flat VPN connectivity.

---

Global Secure Access Overview

Global Secure Access is the control plane in the Microsoft Entra admin center where you:

1. Deploy and manage private network connectors (broker traffic to internal resources).
2. Define application segments (FQDNs, IPs, ports, protocols) that represent private resources.
3. Create enterprise applications that act as policy containers (Quick Access or per-app Global Secure Access apps).
4. Assign users and groups to those apps.
5. Enable the Private Access traffic forwarding profile so enrolled clients send private-app traffic through the service.
6. Install the Global Secure Access client on user devices so connectivity is seamless without a classic VPN client stack.

Private Access builds on the lineage of Microsoft Entra application proxy connectors and extends them: you are not limited to HTTP/S reverse-proxy web apps. You can publish any private resource, port, and protocol (TCP and UDP) that the connector can reach on the private network.

---

Zero Trust Network Access vs Traditional VPN

Exam phrasing: When a scenario says remote users must reach internal apps without a VPN, with per-app Conditional Access and least privilege, choose Microsoft Entra Private Access / Global Secure Access—not “open RDP to the internet” or “always-on full-tunnel VPN only.”

ZTNA still needs healthy connectors and correct DNS/app segment design. It is not “security by renaming VPN.”

---

Quick Access vs Per-App Access

Private Access offers two complementary configuration patterns. Both create an enterprise application in Entra that you can assign users to and protect with Conditional Access.

Quick Access

Quick Access is the primary bag of private destinations you always want tunneled through the service—bulk FQDNs, IP addresses, and IP ranges that represent core private network resources. Use it when you are modernizing off VPN and need a broad private-access path quickly.

Security guidance from Microsoft is explicit: bind Quick Access to Conditional Access. If Quick Access exists without CA, a stolen password can become broad private-network reach. Treat Quick Access as a high-value app that must require MFA (often phishing-resistant), compliant devices, and risk-based controls.

Global Secure Access app (per-app access)

Create separate Global Secure Access apps when you need:

• Different Conditional Access policies for a subset of resources (for example, domain controllers vs general file shares).
• Time-bound or project-scoped private apps.
• Stronger segmentation for privileged destinations (pair with PIM-eligible users and stronger auth contexts).

Both still use connectors to reach the private network; the difference is policy and assignment boundaries.

---

Connectors and Connector Groups

Private network connectors (the evolved App Proxy connector model) run on Windows servers in networks that can reach the private apps (on-premises, Azure VNet, multicloud). They broker connections from the Global Secure Access service to internal resources.

Connector groups

• A connector group is the unit that apps are associated with for path selection.
• Each group should have at least two healthy, active connectors for high availability. A single connector is a single point of failure for every app assigned to that group.
• Keep connectors updated; older connector versions can block Private Access capabilities.
• Scale out connectors when concurrent private sessions or new app segments grow.

Exam trap: Connectors must be able to reach the private resource IPs/FQDNs on the internal network. Publishing an FQDN in Quick Access does nothing if DNS inside the connector network cannot resolve it or if firewalls block the path from connector host to app.

---

Relationship to Conditional Access

Private Access is deliberately identity-first:

1. User signs in with Microsoft Entra ID.
2. User (or device with GSA client) attempts a private resource that matches a published segment.
3. Access is mediated through the enterprise app (Quick Access or per-app).
4. Conditional Access evaluates grant controls (MFA, device compliance, location, sign-in risk, authentication strength, session controls).
5. Only after CA succeeds does traffic flow via connectors to the private resource.

This is why Private Access is stronger than IP-only VPN ACLs for Zero Trust: the same risk engine that protects SaaS can protect internal RDP, SMB, SQL, custom TCP services, and more.

Deployment checklist (exam + production)

1. Deploy connector group with ≥2 healthy connectors near the apps.
2. Configure Quick Access and/or per-app segments (FQDN/IP/port/protocol).
3. Assign users/groups to the enterprise apps (no assignment ⇒ no least-privilege CA path).
4. Create Conditional Access policies targeting those apps (MFA minimum; stronger for privileged apps).
5. Enable Private Access traffic forwarding profile.
6. Deploy Global Secure Access client to managed devices (waves of pilot users).
7. Add private DNS suffixes where needed so short names and internal zones resolve correctly through the service.
8. Pilot, monitor, then expand—do not flip the entire company off VPN on day one without support readiness.

---

How It Differs from Adjacent Controls

SC-500 often stacks them: Private Link locks storage/SQL to private IPs; Private Access lets remote identities reach internal apps with CA; Azure Firewall inspects hub egress. Know which layer answers which requirement.

SC-500 Exam Traps (Private Access)

• Private Access replaces or reduces VPN for app access—it is not “just another VPN brand.”
• Quick Access without Conditional Access is a documented anti-pattern.
• One connector per group is a resilience fail.
• Assigning users/groups is required for Zero Trust enforcement—not optional hygiene.
• Connectors extend App Proxy concepts to any private port/protocol, not only HTTP.
• GSA client + traffic forwarding profile are part of the access path, not optional cosmetics.

Scenario Walkthroughs

Scenario A: Remote finance users need SAP GUI (non-HTTP) without full VPN.
Answer path: Entra Private Access app segment for SAP host/port; connector group in datacenter; CA requiring MFA + compliant device; GSA client.

Scenario B: Privileged admins need domain controller ports; regular users must not.
Answer path: Separate per-app GSA application for DC segments; assign only PAM/admin groups; phishing-resistant MFA Conditional Access; keep Quick Access free of DC ranges.

Scenario C: Leadership says “we already have always-on VPN.” Requirement is Zero Trust microsegmentation.
Answer path: Migrate to Private Access segments + CA; shrink VPN surface; do not rely on flat VPN alone.