Unit 4: Deploy and Configure Microsoft Entra Private Access

Private Access deployment also follows four structured steps.

Step 1 – Configure Private Network Connectors

Connectors are lightweight agents installed on Windows Servers in private networks. They create outbound-only connections, meaning no inbound firewall rules are required.

Requirements:

• Windows Server 2012 R2 or later.
• TLS 1.2 enabled.
• .NET Framework 4.7.1 or later.
• Outbound access on ports 80 and 443.

For high availability, multiple connectors should be deployed and grouped.

Step 2 – Configure Quick Access

Quick Access defines which private resources are accessible through Private Access.

Administrators configure:

• Fully qualified domain names.
• IP addresses.
• IP ranges and ports.

This allows precise control over which internal resources are exposed.

Step 3 – Enable Private Access Traffic Forwarding

Once Quick Access is configured and users are assigned, the Private Access traffic profile is enabled. This routes traffic from the client through Global Secure Access to private resources.

This step effectively replaces traditional VPN connectivity.

Step 4 – Deploy the Client

The same Global Secure Access client is used. Once installed, users can access private resources seamlessly, subject to Conditional Access policies.