Public Preview - GSA Private DNS Support

Entra Private Access, which is Generally Available, already supports the TCP Protocol (e.g., RSP, SSH, SMB, etc.) and the UDP protocol (e.g., DFS, SMB, RDP). Now, with Private DNS support, network administrators can publish DNS suffixes from their internal network and naming structure to allow machines with the GSA client to resolve those names. This latest addition allows you to access IP-based app segments across private apps using FQDNs.

This means that you can publish internal resources and connect with local names.

To enable Private DNS and publish internal names, follow the below guide.

1. Go to GSA Quick Access in the Entra Portal
   1. Use this Fast link to jump right to the section
2. Private DNS support for Microsoft Entra Private Access lets you query your resources FQDN, based on IP address published in the Application Segment. So in this example we have added our local IP subnet as application segment and published tcp port 3389 (RDP protocol)

Now Click on Private DNS tab, tick Enable Private DNS and add the DNS Suffix you want to publish.
It is important to note that the Connector you use, needs to be able to lookup FQDN of the resource it is trying to establish a connection to.

Normally it takes about 10-15 minutes to propagate.

To verify this is enabled and configured, open Advanced Diagnostics option from the GSA client

Click on Forwarding profile tab and expand Privat DNS Rules.
Here you will see the published domain suffix.

Now in this example, when you try to access the server on RDP by FQDN.
Private Access will recognize it should acquire the DNS query and send it to the connector to be resolved to an IP. The RDP client gets the IP and try to connect. Again Private Access recognizes that this is an IP and port combination where it should acquire traffic and send it to the connector.

Additionally, admins can now configure Kerberos Authentication to Domain Controllers, with Private DNS, allowing for a single sign on experience to access Kerberos resources. Detailed public documentation to configure Kerberos SSO authentication via Entra Private Access, linked below

Useful links:

Learn about Microsoft Entra Private Access - Global Secure Access

Learn about how Microsoft Entra Private Access secures access to your private corporate resources through the creation of Quick Access and Global Secure Access apps.

Microsoft Learnkenwith

How to configure Quick Access for Global Secure Access - Global Secure Access

Learn how to specify the internal resources to secure with Microsoft Entra Private Access using a Quick Access app.

Microsoft Learnkenwith

Use Kerberos for single sign-on (SSO) with Microsoft Entra Private Access. - Global Secure Access

Covers how to provide single sign-on using Kerberos with Microsoft Entra Private Access.

Microsoft Learnkenwith