Private Access sensor network requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 7b57a4f · +1 −1 lines · also on GitHub
⋯ 25 unchanged lines
2626
- The Service Principal Names (SPNs) of the private apps you want to protect. You add these SPNs in the policy for Private Access Sensors that are installed on the DCs.
2727
> [!NOTE]
2828
> The SPNs are *case insensitive* and should be an *exact match* or a wildcard in the format `<serviceclass>/*` such as `cifs/*`.
29
−- Install the latest Private Access Sensor on the DC. You can install only one Private Access Sensor on a DC. Silent installation is supported with Private Access Sensor version 2.2.0 or higher, and PowerShell version 5.x.
29
+- Install the latest Private Access Sensor on the DC. For version details, see [Private Access Sensor release notes](reference-private-access-sensor-release-history.md). You can install only one Private Access Sensor on a DC. Silent installation is supported with Private Access Sensor version 2.2.0 or higher, and PowerShell version 5.x.
3030
- To test this functionality, you can install sensors on a few DCs in a site that issue Kerberos tickets for the SPNs you want to protect. A sensor is installed in `Audit` mode by default and you need to change it to `enforce` mode.
3131
- As a best practice, test this functionality with the private apps first. You can enforce MFA to the DC itself by using its SPN. However, consider testing that at a later stage to avoid any issues of admin lockout.
3232
- If you use NT LAN Manager (NTLM) v1/v2 in your environment, you might need to restrict NTLM and use Kerberos auth in the domain.
⋯ 280 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:01 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.