--- title: "Reimagining Secure Access: Microsoft Entra Private Access for Domain Controllers" description: Secure domain controllers with Microsoft Entra Private Access, replacing traditional VPNs with identity-driven, policy-based access. Discover how Velocity Technology Group can help implement this Zero Trust solution. image: https://blog.thevtg.com/hubfs/Entra%20DC-1.png --- [![Velocity](https://blog.thevtg.com/hs-fs/hubfs/raw_assets/public/VeloCityGroup_October2023/images/desktop-logo.png?width=249&height=166&name=desktop-logo.png "Velocity")](https://www.velocitygroup.global/) - [Services](https://thevtg.com/services/) - [Industry Expertise](https://thevtg.com/industry) - [Insights](https://blog.thevtg.com/) [contact](https://www.velocitygroup.global/contact) - [Services](https://thevtg.com/services/) - [Industry Expertise](https://thevtg.com/industry) - [Insights](https://blog.thevtg.com/) # Post Search [All Posts](https://blog.thevtg.com) Search [Graham Elston - CTO](https://blog.thevtg.com/author/graham-elston-technical-director) - 4 min read Share Post Share Post Share Link Cancel Copy Link # Reimagining Secure Access: Microsoft Entra Private Access for Domain Controllers [![Reimagining Secure Access: Microsoft Entra Private Access for Domain Controllers](https://blog.thevtg.com/hubfs/Entra%20DC-1.png)](https://blog.thevtg.com/hubfs/Entra%20DC-1.png) As hybrid work becomes the norm and legacy infrastructure continues to coexist with cloud-native services, organisations face a growing challenge: how to secure access to on-premises resources without compromising agility or user experience. Microsoft’s public preview of **Entra Private Access for Domain Controllers** is a game-changer. As a **Microsoft Solutions Partner in Azure Infrastructure, Modern Work, and Security**, Velocity Technology Group is ready to help our clients lead the way. **🔐 The Problem with Traditional VPNs** VPNs have long been the default method for remote access to internal resources. But they’re increasingly seen as a security liability: - **Overly broad access**: VPNs often expose entire networks rather than specific services. - **Lack of identity awareness**: Access is granted based on network location, not user identity. - **Poor segmentation**: Once inside, users can move laterally across systems. - **Limited visibility and control**: Security teams struggle to enforce granular policies or monitor access effectively. **🌐 Microsoft Entra Private Access: A Zero Trust Approach** Microsoft Entra Private Access replaces VPNs with **identity-driven, policy-based access** to private resources. The new capability for **Domain Controllers** adds a critical layer of protection to one of the most sensitive components of any IT environment. **Key Features and Benefits** - **Conditional Access for Legacy Authentication** By intercepting Kerberos traffic at the domain controller level, Entra Private Access applies **Conditional Access policies**—even for systems that don’t support modern authentication protocols. - **Granular Access Control** Define **service-level access policies** (e.g., RDP, SMB, LDAP), dramatically reducing the attack surface and aligning with **Zero Trust principles**. - **Privileged Identity Management Integration** Admin access to domain controllers can be tightly controlled using **Microsoft Entra PIM**, ensuring elevated privileges are only granted when needed. - **Break Glass Mode** Emergency access paths maintain security while ensuring operational continuity. - **Hybrid-Optimised Architecture** Authentication traffic is routed securely to Microsoft Entra ID, while application traffic remains local—ensuring **low latency** and **minimal disruption**. **🆚 How Microsoft Entra Compares to Zscaler & Fortinet** As organisations evaluate their SASE and ZTNA strategies, Microsoft Entra Private Access offers a compelling alternative to traditional providers like **Zscaler** and **Fortinet**. | **Feature** | **Microsoft Entra Private Access** | **Zscaler Private Access (ZPA)** | **Fortinet ZTNA** | | --- | --- | --- | --- | | **ZTNA Model** | Identity-first, integrated with Entra ID | App connector-based, identity-aware | Network-centric with identity integration | | **Conditional Access** | Native, deep integration with Entra policies | No native Conditional Access | Requires FortiAuthenticator or third-party IAM | | **Privileged Access Management** | Integrated with Entra PIM | Requires third-party tools | FortiPAM (separate product) | | **Microsoft 365 Optimisation** | Native, tenant restrictions, traffic steering | Limited | Requires custom config | | **Licensing** | Often bundled with M365 E5 or Entra ID P2 | Separate licensing for ZPA/ZIA | Separate licensing for ZTNA/SASE components | **Microsoft’s identity-first architecture** enables granular, policy-driven access without additional infrastructure, making it ideal for organisations already invested in Microsoft 365 and Azure. **🔄 Coexistence & Flexibility** Microsoft Entra Private Access supports **coexistence with existing SASE stacks**, allowing organisations to: - Route **private app traffic via Entra**, while maintaining **internet access via Zscaler or Fortinet**. - Phase in Zero Trust controls without disrupting existing workflows. - Optimise licensing and reduce complexity by leveraging existing Microsoft entitlements. This flexibility is ideal for enterprises transitioning from legacy VPNs or multi-vendor SASE stacks. **🏆 Why Velocity Technology Group?** As a Microsoft Solutions Partner in: - **Azure Infrastructure**: We ensure seamless integration with cloud identity services. - **Modern Work**: We empower distributed teams with secure, frictionless access. - **Security**: We design and implement Zero Trust frameworks tailored to your needs. Whether you're looking to modernise your identity infrastructure, secure privileged access, or reduce reliance on legacy VPNs, VTG can guide you through every step—from assessment and planning to deployment and optimisation. **🚀 Next Steps** The public preview of Microsoft Entra Private Access for Domain Controllers is your opportunity to test-drive the future of hybrid identity security. Let’s talk about how VTG can help you pilot this solution, align it with your broader security strategy, and unlock its full potential. [info@thevtg.com](mailto:info@thevtg.com)    Share Link Cancel Copy Link [All Posts](https://blog.thevtg.com) ### Recent Posts [See All](https://blog.thevtg.com) [![How to Choose a Co-Managed IT Model in 2026](https://blog.thevtg.com/hubfs/shutterstock_2767571951.jpg)](https://blog.thevtg.com/how-to-choose-a-co-managed-it-model-in-2026) ## [How to Choose a Co-Managed IT Model in 2026](https://blog.thevtg.com/how-to-choose-a-co-managed-it-model-in-2026) [Write a comment](https://blog.thevtg.com/how-to-choose-a-co-managed-it-model-in-2026#comments-listing) [![Is Multi-Cloud the Future of Disaster Recovery?](https://blog.thevtg.com/hubfs/shutterstock_526184059.jpg)](https://blog.thevtg.com/is-multi-cloud-the-future-of-disaster-recovery) ## [Is Multi-Cloud the Future of Disaster Recovery?](https://blog.thevtg.com/is-multi-cloud-the-future-of-disaster-recovery) [Write a comment](https://blog.thevtg.com/is-multi-cloud-the-future-of-disaster-recovery#comments-listing) [![How to Protect Azure Workloads from Ransomware](https://blog.thevtg.com/hubfs/Designer%20(4).png)](https://blog.thevtg.com/how-to-protect-azure-workloads-from-ransomware) ## [How to Protect Azure Workloads from Ransomware](https://blog.thevtg.com/how-to-protect-azure-workloads-from-ransomware) [Write a comment](https://blog.thevtg.com/how-to-protect-azure-workloads-from-ransomware#comments-listing) ![Velocity Logo](https://blog.thevtg.com/hs-fs/hubfs/raw_assets/public/VeloCityGroup_October2023/images/desktop-logo.png?width=359&name=desktop-logo.png "Velocity Logo") ![Velocity Logo](https://blog.thevtg.com/hs-fs/hubfs/raw_assets/public/VeloCityGroup_October2023/images/Velocity%20Logo%20Orange%20Medium%20tab.png?width=811&name=Velocity%20Logo%20Orange%20Medium%20tab.png "Velocity Logo") ##### COMPANY - [Home](https://www.thevtg.com) - [Infrastructure](https://www.thevtg.com/infrastructure) - [Services](https://www.thevtg.com/services) - [Cloud](https://www.thevtg.com/cloud) ##### CONTACT [info@thevtg.com](mailto:info@mysite.com) [SA Tel: +27 (0)11 018 1700](tel:123-456-7890) [UK Tel: +44 (0)20 3137 3550](tel:123-456-7890)   © 2023 by Velocity Technology Group ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Graham Elston - CTO", "url" : "https://blog.thevtg.com/author/graham-elston-technical-director" }, "dateModified" : "2025-08-28T17:21:17.555Z", "datePublished" : "2025-08-28T17:21:17.000Z", "headline" : "Reimagining Secure Access: Microsoft Entra Private Access for Domain Controllers", "image" : [ "https://blog.thevtg.com/hubfs/Entra%20DC-1.png" ], "mainEntityOfPage" : { "@id" : "https://blog.thevtg.com/reimagining-secure-access-microsoft-entra-private-access-for-domain-controllers", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.thevtg.com/hubfs/social-suggested-images/hs-7599694.f.hubspotemail.nethub7599694hubfsVelocity%20Logo%20Orange-1.png" }, "name" : "Velocity Technology Group" } } ```