ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 17:50 UTC Customize Public modeDiscuss ChangeIntel on Discord

Private Access sensor network requirements

This page's changes and edits · All guidance changes

Microsoft's edit ·

Editorial pass: Configure Private Access for domain controllers (22 fixes)

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 8da39b4 · +20 −21 lines · also on GitHub

⋯ 1 unchanged line
22 title: Configure Microsoft Entra Private Access for Active Directory Domain Controllers
33 description: Learn how to configure Microsoft Entra Private Access for Active Directory Domain Controllers.
44 ms.topic: how-to
5 −ms.date: 01/21/2026
5 +ms.date: 03/16/2026
66 ms.subservice: entra-private-access
77 ms.reviewer: shkhalid
88 ai-usage: ai-assisted
⋯ 8 unchanged lines
1717
1818 - The **Global Secure Access Administrator** role in Microsoft Entra ID.
1919 - The product requires licensing. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
20 −- A client machine that runs at least Windows 10 and is Microsoft Entra joined or hybrid joined device. The client machine must also have line of sight to the private resources and DC (user is in a corporate network and accessing on-premises resources). User identity used for joining the device and accessing these resources was created in Active Directory (AD) and synced to Microsoft Entra ID using Microsoft Entra Connect.
20 +- A client machine that runs at least Windows 10 and is a Microsoft Entra joined or hybrid joined device. The client machine must also have line of sight to the private resources and DC (user is in a corporate network and accessing on-premises resources). The user identity used for joining the device and accessing these resources must be created in Active Directory (AD) and synced to Microsoft Entra ID using Microsoft Entra Connect.
2121 - The latest Microsoft Entra Private network connector is installed and has a line of sight to the DC.
2222 - Open inbound Transmission Control Protocol (TCP) port `1337` in the Windows Firewall on the DCs.
23 −- Ensure your firewall or proxy allows outbound connections to the wildcard domain suffix `*.msappproxy.net:443`. Private Access Sensor uses this secure channel to register and fetch policies from Microsoft's Entra cloud service.
23 +- Ensure your firewall or proxy allows outbound connections to the wildcard domain suffix `*.msappproxy.net:443`. Private Access Sensor uses this secure channel to register and fetch policies from the Microsoft Entra cloud service.
2424 - The Service Principal Names (SPNs) of the private apps you want to protect. You add these SPNs in the policy for Private Access Sensors that are installed on the DCs.
2525 > [!NOTE]
2626 > The SPNs are *case insensitive* and should be an *exact match* or a wildcard in the format `<serviceclass>/*` such as `cifs/*`.
2727 - Install the latest Private Access Sensor on the DC. Understand that one Private Access Sensor can be installed on a DC. Silent installation is supported with Private Access Sensor version 2.2.0 or higher, and PowerShell version 5.x.
2828 - To test this functionality, you can install sensors on a few DCs in a site that issue Kerberos tickets for the SPNs you want to protect. A sensor is installed in `Audit` mode by default and you need to change it to `enforce` mode.
29 −- As a best practice, we recommend testing this functionality with the private apps first. You can enforce MFA to the DC itself by using its SPN, however, we recommend that you test that at a later stage to avoid any issues of admin lockout.
29 +- As a best practice, test this functionality with the private apps first. You can enforce MFA to the DC itself by using its SPN. However, consider testing that at a later stage to avoid any issues of admin lockout.
3030 - If you use NT LAN Manager (NTLM) v1/v2 in your environment, you might need to restrict NTLM and use Kerberos auth in the domain.
31 −-
3231
33 −> [!Note]
32 +> [!NOTE]
3433 > Setting the policy Restrict NTLM: NTLM authentication in this domain without performing an impact assessment first might cause service outage for those applications and users still using NTLM authentication.
3534 >
3635 > [Auditing and restricting NTLM usage guide | Microsoft Learn](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/jj865674(v=ws.10))
⋯ 17 unchanged lines
5453
5554 ### 2. Create a Global Secure Access application
5655
57 −Create a new Enterprise Application or use Quick Access to publish the domain controllers using their IP addresses or Fully Qualified Domain Name (FQDN). Publishing the DCs lets the Global Secure Access clients obtain Kerberos tickets. In addition, use Quick Access to configure SPNs. In this example, Quick Access is used to configure both.
56 +Create a new Enterprise Application or use Quick Access to publish the domain controllers using their IP addresses or Fully Qualified Domain Name (FQDN). Publishing the DCs lets the Global Secure Access clients obtain Kerberos tickets. In addition, use Quick Access to configure SPNs. In this example, you use Quick Access to configure both.
5857
5958 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
60 −1. Go to **Global Secure Access** > **Applications** > **Quick Access** > **Application segment** then select **Add Quick Access application segment**. Use port `88` and select **TCP**.
61 −1. Next go to **Service principal name** and then select **Add Service principal name** to add the SPNs for the resources you want to secure. The system automatically delivers these SPNs to the Private Access Sensors installed on your domain controllers.
59 +1. Go to **Global Secure Access** > **Applications** > **Quick Access** > **Application segment**, then select **Add Quick Access application segment**. Use port `88` and select **TCP**.
60 +1. Next, go to **Service principal name** and then select **Add Service principal name** to add the SPNs for the resources you want to secure. The system automatically delivers these SPNs to the Private Access Sensors installed on your domain controllers.
6261
6362 [![Diagram showing Quick Access settings when configuring Microsoft Entra Private Access integration with Active Directory Domain Controllers.](media/how-to-configure-domain-controllers/quick-access-settings.png)](media/how-to-configure-domain-controllers/quick-access-settings.png#lightbox)
6463
⋯ 20 unchanged lines
8584
8685 ### 6. Install the Private Access Sensor on the domain controller
8786
88 −1. Download the Private Access Sensor for DC from Microsoft Entra admin center at **Global Secure Access** > **Connect** > **Connectors and sensors** > **Private access sensors** > **Download private access sensor**.
87 +1. Download the Private Access Sensor for the DC from the Microsoft Entra admin center at **Global Secure Access** > **Connect** > **Connectors and sensors** > **Private access sensors** > **Download private access sensor**.
8988 1. Install the sensor by selecting the Private Access Sensor Installer and following the steps.
9089 1. During installation, sign in with a Microsoft Entra ID user when prompted.
9190 1. After installation, in the Microsoft Entra admin center, go to **Global Secure Access** > **Connect** > **Connectors and sensors** > **Private access sensors** and verify the sensor status is **Active**.
⋯ 1 unchanged line
9392 [![Screenshot showing the Private Access sensor as activated in the Microsoft Entra admin center.](media/how-to-configure-domain-controllers/connectors-and-sensors.png)](media/how-to-configure-domain-controllers/connectors-and-sensors.png#lightbox)
9493
9594 > [!IMPORTANT]
96 −> To upgrade to the Private Access Sensor version 2.1.31, it's recommended to uninstall the previous sensor and then installing the new sensor. You can in-place upgrade from the sensor versions 2.1.31 and later.
95 +> To upgrade to the Private Access Sensor version 2.1.31, uninstall the previous sensor and then install the new sensor. You can in-place upgrade from the sensor versions 2.1.31 and later.
9796
9897 ### 7. Install sensor silently (no interactive authentication)
9998
10099 For enterprise environments deploying sensors across multiple domain controllers, silent installation enables automated deployment without requiring interactive sign-in on each DC. This approach is useful when deploying to servers that don't have a GUI, are in remote locations, or when using deployment automation tools like Group Policy, Microsoft Endpoint Configuration Manager, or scripts. By generating an offline token on a workstation with browser access, you can then register sensors on multiple DCs without needing to authenticate interactively on each server. Silent installation is supported with Private Access Sensor version 2.2.0 or higher, and PowerShell version 5.x.
101100
102 −1. Download sensor to Domain Controller (DC) server and run this cmd in a PowerShell or command window with admin privileges to install quietly.
101 +1. Download sensor to Domain Controller (DC) server and run this command in a PowerShell or command window with admin privileges to install quietly.
103102
104103 ```cmd
105104 .\PrivateAccessSensor.exe /quiet SKIPREGISTRATION="true"
106105 ```
107 −2. Register Sensor
106 +1. Register Sensor
108107
109108 a. Generate offline token using this PowerShell script. This script should open an interactive browser pop-up to authenticate with your credentials, so it's recommended to do this on a machine with a GUI, internet access, and a browser.
110109
⋯ 60 unchanged lines
171170 $SecureToken = $Token | ConvertTo-SecureString -AsPlainText -Force
172171 ```
173172
174 − c. Register sensor using the `$SecureToken` created in the last step and the `$tenantId`. The `RegisterConnector.ps1` script should be in `C:\Program Files\Private Access Sensor\bin`.
173 + c. Register the sensor using the `$SecureToken` created in the last step and the `$tenantId`. The `RegisterConnector.ps1` script should be in `C:\Program Files\Private Access Sensor\bin`.
175174
176175 ```PowerShell
177176 .\RegisterConnector.ps1 -modulePath "C:\Program Files\Private Access Sensor\bin" -moduleName "MicrosoftEntraPrivateNetworkConnectorPSModule" -Authenticationmode Token -Token $SecureToken -TenantId $tenantId -Feature PrivateAccess
⋯ 9 unchanged lines
187186 1. If you add or update SPNs and/or Connector IPs, it can take a few minutes for changes to take effect. You don't need to restart the sensors.
188187
189188 > [!IMPORTANT]
190 −> The Private Access Sensor is installed in Audit (report-only) mode by default. To enforce MFA, set the `SensorMode` for `PrivateAccessSensor` to `EnforceMode` in **Global Secure Access** > **Connect** > **Connectors and sensors** > **Private access sensors**. It might take a few minutes to update the sensor mode. For Private Access Sensor versions 2.1.31 and later, you can only update this mode from Microsoft Entra Admin Center and not the registry key from the Private Access Sensor.
189 +> The Private Access Sensor is installed in Audit (report-only) mode by default. To enforce MFA, set the `SensorMode` for `PrivateAccessSensor` to `EnforceMode` in **Global Secure Access** > **Connect** > **Connectors and sensors** > **Private access sensors**. It might take a few minutes to update the sensor mode. For Private Access Sensor versions 2.1.31 and later, you can only update this mode from the Microsoft Entra admin center and not the registry key from the Private Access Sensor.
191190
192191
193192 ## Exclusions and inclusions for SPNs
194193
195 −When configuring Service Principal Names (SPNs) in the Private Access Sensor policy, you might have users or machines in your environment that don't have the Global Secure Access client installed. To allow these users or machines to access the specified SPNs after the Private Access Sensor is deployed, you can configure exclusions or inclusions for each SPN from Microsoft Entra Admin Center or in the `localpolicy` file. Any exclusions or inclusions configured from Microsoft Entra Admin Center are present in the `cloudpolicy` file.
194 +When configuring Service Principal Names (SPNs) in the Private Access Sensor policy, you might have users or machines in your environment that don't have the Global Secure Access client installed. To allow these users or machines to access the specified SPNs after the Private Access Sensor is deployed, you can configure exclusions or inclusions for each SPN from the Microsoft Entra admin center or in the `localpolicy` file. Any exclusions or inclusions configured from the Microsoft Entra admin center are present in the `cloudpolicy` file.
196195
197196 > [!NOTE]
198197 > Both `cloudpolicy` and `localpolicy` are evaluated for access.
⋯ 6 unchanged lines
205204
206205 - Client IP address
207206 - IP address ranges
208 −- On-premises User Principal Name (UPN) such as `username@domain`. UPN is supported with Private Access Sensor version 2.1.31 or higher and is case insensitive. Username, which is the first part of the UPN, is supported with the earlier sensor versions and can be added in the `localpolicy`file only. We highly recommend using the UPNs instead of usernames. UPNs for on-premises users can be added from Microsoft Entra admin center. These can be UPNs for on-premises users that are synced to Entra or local to Active Directory and not synced to Entra.
207 +- On-premises User Principal Name (UPN) such as `username@domain`. UPN is supported with Private Access Sensor version 2.1.31 or higher and is case insensitive. Username, which is the first part of the UPN, is supported with the earlier sensor versions and can be added in the `localpolicy` file only. Use UPNs instead of usernames. UPNs for on-premises users can be added from the Microsoft Entra admin center. These can be UPNs for on-premises users that are synced to Microsoft Entra ID or local to Active Directory and not synced to Microsoft Entra ID.
209208
210209 > [!NOTE]
211 −> UPNs for on-premises users that are local to Active Directory and not synced to Entra can only be added to the `localpolicy` file in Private Access Sensor versions earlier than 2.2.0.
210 +> UPNs for on-premises users that are local to Active Directory and not synced to Microsoft Entra ID can only be added to the `localpolicy` file in Private Access Sensor versions earlier than 2.2.0.
212211
213212 You can configure multiple IP addresses, multiple IP ranges, or both for a single SPN. Similarly, you can exclude multiple usernames for an SPN.
214213
⋯ 14 unchanged lines
229228 > [!TIP]
230229 > Use exclusions and inclusions to fine-tune access for users and devices that don't have the Global Secure Access client, ensuring business continuity while maintaining security controls.
231230
232 −Example of how to configure SPN username exclusions and inclusions from Microsoft Entra Admin Center:
231 +Example of how to configure SPN username exclusions and inclusions from the Microsoft Entra admin center:
233232 >
234233 [![Screenshot of the localpolicy file showing how to configure the file for SPN username exclusions and inclusions.](media/how-to-configure-domain-controllers/exclusions-and-inclusions.png)](media/how-to-configure-domain-controllers/exclusions-and-inclusions.png#lightbox)
235234
⋯ 25 unchanged lines
261260 - To collect Private Access Sensor logs, run `PrivateAccessSensorLogsCollector` from the sensor installation path and share the generated zip file with Microsoft support.
262261 - For Global Secure Access client logs:
263262 1. Right-click the Global Secure Access tray icon.
264 − 2. Select **Advanced Diagnostics** > **Advanced log collection** > **Collect advanced logs**.
265 − 3. Reproduce your issue, then stop log collection and submit the logs to Microsoft support.
263 + 1. Select **Advanced Diagnostics** > **Advanced log collection** > **Collect advanced logs**.
264 + 1. Reproduce your issue, then stop log collection and submit the logs to Microsoft support.
266265
267266 > [!TIP]
268267 > If you encounter issues, provide screenshots, command outputs, and collected logs to Microsoft support for further assistance.
⋯ 4 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:01 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 17:50 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.