Microsoft Entra Private Access brings conditional access to on-prem Active Directory

Source: 7 signs it’s time for a managed security service provider | CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4041752/microsoft-entra-private-access-brings-conditional-access-to-on-prem-active-directory.html

ONE SENTENCE SUMMARY:

Microsoft Entra enhances security for on-premises Active Directory by integrating with its Zero Trust framework and removing NTLM dependency.

MAIN POINTS:

1. Attackers still target on-premises Active Directory installations for network access.
2. Microsoft Entra provides conditional access and MFA for on-premises systems.
3. Entra Private Access aims to replace VPNs and internal Active Directory resources.
4. Requires Kerberos authentication; NTLM must be removed from the network.
5. Global Secure Access Administrator role needed for Entra ID setup.
6. Requires Windows 10 or higher, and devices must be Entra or hybrid joined.
7. Firewall rules include opening TCP port 1337 on domain controllers.
8. Test with private apps first to avoid admin lockout issues.
9. Audit NTLM usage to enable secure transitions to NTLMv2 and Kerberos.
10. Transition involves blocking NTLM and updating affected applications.

TAKEAWAYS:

1. Entra integration enhances security for traditional Active Directory setups.
2. Eliminating NTLM increases network resilience against ransomware.
3. Proper role and licensing are essential for deployment.
4. Testing and auditing are critical for a smooth transition process.
5. Removing NTLM is challenging but crucial for modern security.