MICROSOFT ENTRA PRIVATE ACCESS BRINGS CONDITIONAL ACCESS TO ON-PREM ACTIVE DIRECTORY

Summary from the TLDR InfoSec newsletter

Microsoft's Entra Private Access now allows organizations to apply cloud-based conditional access and MFA to on-premises Active Directory domain controllers, replacing legacy VPNs with Zero Trust Network Access. It requires networks to be NTLM-free and Kerberos-only, Windows 10+ devices that are Entra or hybrid joined, opening TCP port 1337 on domain controllers, and extensive NTLM auditing and removal. Organizations must audit NTLM usage via Group Policy, transition to NTLMv2 or Kerberos, and possibly retire legacy apps before implementing this security framework.