Microsoft Entra Private Access, part of Microsoft Entra Internet Access and Private Access, uses the Global Secure Access client to establish a secure, encrypted tunnel from the user's device to the Microsoft Global Secure Access service.

 Microsoft Entra Private Access, part of Microsoft Entra Internet Access and Private Access, uses the Global Secure Access client to establish a secure, encrypted tunnel from the user's device to the Microsoft Global Secure Access service. This service then provides access to private resources. The communication between the client and the service is essential for the functionality.

To implement Microsoft Entra Private Access, the required ports focus on outbound connectivity from your on-premises environment to Microsoft's cloud services. Specifically:

• Outbound port 443 (HTTPS): This is essential for secure communication between the Entra Private Access Connector (deployed on-premises) and Microsoft Entra services. It handles authentication, policy updates, and encrypted traffic.

• Outbound port 80 (HTTP): While less critical, port 80 may be used for initial connectivity checks, certificate revocation checks (OCSP/CRL), or redirection to port 443. It is recommended to allow this for reliability.

Inbound ports are not required for Entra Private Access, as the connector initiates outbound connections to Microsoft.

Thus, the correct ports to enable are Outbound ports 80 and 443 only.

Explanation of options:

• ❌ Inbound port 443 only: Not required (inbound traffic is not initiated by Microsoft).

• ❌ Inbound ports 80 and 443 only: Incorrect (inbound is unnecessary).

• ❌ Outbound port 443 only: Incomplete (port 80 is recommended for auxiliary functions).

• ✅ Outbound ports 80 and 443 only: Correct (covers all outbound requirements).

To ensure that Global Secure Access is used by all devices connected to the on-premises network without installing the Global Secure Access client, you must create a: ✅ Remote network

 Why?

A Remote network in Microsoft Entra Internet Access allows traffic from on-premises networks to be routed through Global Secure Access.

This setup enables secure access to internet resources without requiring the client to be installed on each device.

❌ Incorrect Options:

Access package: Used for identity governance and access management, not network routing.

Conditional access policy: Controls access based on conditions but doesn’t route traffic.

Connected organization: Used for external collaboration scenarios.

Named location: Helps define geographic locations for conditional access but doesn’t route traffic.

The Highest PCI change list view in Microsoft Entra Permissions Management displays changes in the Permission Creep Index (PCI) over the past 7 days

 The Highest PCI change list view in Microsoft Entra Permissions Management displays changes in the Permission Creep Index (PCI) over the past 7 days 

To view the list of accounts assigned to highly privileged roles in your Azure subscription using Microsoft Entra Permissions Management, you should use the Microsoft Entra Insights tab.

 Here's how to access it:

Go to the Permissions Management home page.

Select the Microsoft Entra Insights tab.

Choose:

Review Global Administrators to see users assigned the Global Administrator role.

Review highly privileged roles to view assignments for roles such as:

Application Administrator

Cloud Application Administrator

Exchange Administrator

Intune Administrator

Privileged Role Administrator

SharePoint Administrator

Security Administrator

User Administrator 1.

🔒 Note: You must have the Permissions Management Administrator role to access this information.

Alternatively, if you're using Privileged Identity Management (PIM) in Microsoft Entra ID, you can use the Discovery and Insights (Preview) page under:

ID Governance > Privileged Identity Management > Microsoft Entra roles > Discovery and insights (Preview)

To ensure Continuous Access Evaluation (CAE) has insight into a user's location for real-time access control, configure: ✅ Named Locations in Microsoft Entra ID.

 Why Named Locations?

Purpose:

Named Locations define trusted IP ranges (e.g., corporate networks) or countries/regions.

CAE uses this data to:

Detect user location changes (e.g., sudden move from trusted to untrusted IP).

Trigger immediate session revocation if risk is detected (e.g., sign-in from a blocked country).

Impact on CAE:

Without Named Locations, CAE cannot evaluate location-based risks in real-time.

Enables CAE to enforce policies like:

Blocking access from untrusted regions.

Requiring reauthentication for location changes.

Steps to Configure:

Access Entra admin center:

Go to Protection → Conditional Access → Named Locations.

Create a Named Location:

Select IP ranges (for trusted networks) or Countries/regions (for geo-based rules).

Example: Define your office IPs as a trusted location.

Link to CAE-Supported Apps:

Ensure apps support CAE (e.g., Exchange Online, SharePoint Online, Teams).

CAE automatically uses Named Locations for real-time decisions.

Based on Microsoft's documentation for Microsoft Entra ID Protection, the roles that receive "Users at risk detected" alerts by default are: Global Administrator and Security Administrator.

 Based on Microsoft's documentation for **Microsoft Entra ID Protection**, the roles that receive **"Users at risk detected" alerts** by default are:  

**Global Administrator** and **Security Administrator**.  

### Alert Recipients Breakdown:

| Administrator | Role | Receives "Users at risk detected" alerts? |

|---------------|------|-------------------------------------------|

| **Admin1**    | Global Administrator | ✅ **Yes** (default recipient) |

| **Admin2**    | Security Administrator | ✅ **Yes** (default recipient) |

| **Admin3**    | Security Reader | ❌ No (read-only access, no alerts) |

| **Admin4**    | User Administrator | ❌ No (not a default recipient) |

### Key Details:

1. **Default Alert Configuration**:  

   - Alerts are automatically sent to **Global Administrators** and **Security Administrators**.  

   - This is not configurable at the role level; it’s enforced by the service.  

   - [Official Reference](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-notifications#configure-notifications).

2. **Customization Options**:  

   - You can **add additional email addresses** (e.g., a SOC team inbox) to receive alerts, but role assignments alone won’t trigger alerts for:  

     - Security Readers  

     - User Administrators  

     - Conditional Access Administrators (not listed here).  

3. **Security Reader & User Administrator Roles**:  

   - **Security Reader**: Can *view* risk reports but won’t receive proactive alerts.  

   - **User Administrator**: Manages users/groups but isn’t included in risk alerting by design.  

### Summary:

Only **Admin1 (Global Administrator)** and **Admin2 (Security Administrator)** will receive "Users at risk detected" alerts.  

> ⚠️ **Note**: To extend alerts to Admin3 or Admin4, manually add their email addresses in:  

> **Entra ID Protection → Notifications → Users at risk detected alerts → Additional email recipients**.

The Risky sign-ins report in Microsoft Entra ID Protection retains data for 30 days. This is the maximum period available for reviewing risky sign-in events directly in the Azure portal.

 he Risky sign-ins report in Microsoft Entra ID Protection retains data for 30 days. This is the maximum period available for reviewing risky sign-in events directly in the Azure portal.

Key Details:

Report Retention:

Risky sign-ins: 30 days of data.

Risky users: Also retained for 30 days.

Why 30 Days?

This is a fixed retention period defined by Microsoft’s service design.

It aligns with typical security investigation cycles for recent threats.