Microsoft Entra Private Access

Microsoft Entra Private Access is a zero trust network access (ZTNA) service. It gives users access to private apps and resources without a VPN. It works for users in the office or remote, and for apps on-premises, in data centers or in any cloud. Access is tied to the user's identity in Microsoft Entra ID, and Conditional Access policies decide who gets in. Admins can start with Quick Access, which tunnels broad IP ranges and FQDNs, much like a VPN. They can then move to per-app access, where each private TCP or UDP app gets its own users, groups and Conditional Access policy. Application discovery shows which app segments people use, so admins can split Quick Access into tighter per-app rules. Private Access can add MFA in front of legacy protocols such as Kerberos and NTLM. It also gives Kerberos single sign-on to private apps, resolves private DNS names and helps protect domain controllers. Contractors, guests and BYOD users can get least-privilege access too. Private network connectors run on Windows Server 2016 or later near the apps and make only outbound connections. Connectors can be grouped for high availability, and a preview lets teams deploy them from the Azure, AWS and GCP marketplaces. The Global Secure Access client runs on Windows, macOS, iOS and Android. Private Access is managed in the Microsoft Entra admin center. It is sold standalone or in the Microsoft Entra Suite, and users also need a Microsoft Entra ID P1 or P2 license.