Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Gauge your current knowledge
Gauge your current knowledge
Microsoft Entra Private Access provides secure, zero-trust remote access to on-premises and private cloud resources without requiring a traditional VPN. When a user attempts to access an internal resource, the connection request travels from the client device to the Microsoft Global Secure Access cloud service. From there, the traffic is routed securely to a local private network connector installed on-premises, which forwards the traffic to the destination application. This design creates an outbound-only connection, meaning your internal network remains protected behind your firewall without exposing open inbound ports to the public internet.
To support this secure outbound flow, your local network must be configured to allow specific outbound traffic. Your firewall must permit communication on port 80 to download certificate revocation lists and port 443 to connect to the Global Secure Access service. Any systems performing inline traffic decryption or security inspection on these paths must be configured to bypass this traffic, as altering the certificates will break the secure tunnel. If you are operating in specialized environments like the Azure Government cloud, you must configure additional specific URLs and parameters to align with their independent cloud boundaries.
The connection between your local environment and the cloud relies on the private network connector software installed on a local Windows Server. This server must run at least .NET version 4.7.1 and use connector version 1.5.3417.0 or greater to ensure compatibility. Organizations can deploy these connectors manually or leverage pre-built templates available in the Azure Marketplace, AWS Marketplace, or GCP Marketplace to speed up deployment across hybrid environments. Once the installation is complete, the local service must register itself with your Entra tenant to establish a trusted relationship.
To ensure high availability and balance traffic loads, you can organize individual connectors into connector groups. If one connector server fails or goes offline, other connectors in the same group automatically take over the traffic load so users experience no downtime. You manage these groups directly within the Microsoft Entra admin center under the Global Secure Access settings page. Grouping allows you to dedicate specific connectors to high-performance applications or isolate traffic to particular geographic regions.
Administrators can verify that the connectors are functioning properly by checking their operational state in two places. Within the Microsoft Entra admin center, a working connector will display an active green status label next to its name. On the local Windows Server, you can open the Services Manager to confirm that the Microsoft Entra private network connector service is in a running state. Finally, you can enforce security boundaries by linking these validated connectors to Conditional Access policies, which evaluate user identity and device compliance before granting access to private applications.
StudyCerts
StudyCerts