Third-party vendors and partners are essential, but granting them access to sensitive systems introduces significant risk. Traditional remote access solutions like VPNs are often cumbersome, over-permissive, and a management nightmare for IT teams.
Giving access to third-party vendors is both a necessity and a risk. Common scenarios of developers needing access and specialized tooling, third-party service providers/consultants, or external users often need access to sensitive systems and data, and traditional VPN is cumbersome to both use and manage. Providing that access comes the potential for misconfiguration, over-permissioning, and increased exposure to threats.
Here is the challenge:
How do you enable secure, scalable, and auditable access for vendors without compromising your organization’s security posture or operational efficiency?
Microsoft’s cloud ecosystem offers a suite of solutions purpose-built for this challenge. In this post, we’ll explore three key options: Azure Bastion, Azure Virtual Desktop, and Microsoft Entra Private Access. Will discuss how each can be used to build a modern, secure, vendor access strategy that is tailored to the users’ needs and is efficient to manage for your technology team.
Azure Bastion: Secure Remote — Managed Access Without Public Exposure
Traditional remote access often relies on exposing resources (virtual machines, networks & data) to the internet via public IPs and RDP/SSH ports. This approach is inherently risky, opening the door to a variety of threats and potential lateral movement once inside the environment. Azure Bastion offers a different approach by providing secure, seamless RDP and SSH connectivity to Virtual Machines directly through the Azure portal. Doing so without exposing those VMs to the public internet.
How this helps support secure vendor access:
- Agentless Access: Vendors don’t need to install clients or manage VPNs. They simply log into the Azure portal and connect securely.
- No Public IPs Required: Bastion eliminates the need for public IPs on VMs, reducing attack surface.
- Secure access with Microsoft Entra ID: Access can be tightly scoped to specific VMs and time windows using Entra ID.
- Segmentation: Leveraging just-in-time (JIT), we can dynamically allow/disallow network access to resources internally to just the times it is needed. Reducing the risk of lateral movement in the environment.
- Auditability: Bastion integrates with Entra ID, Defender, & Sentinel, enabling visibility into who accessed what, when, and how.
Primary Remote Use Case: A vendor needs occasional access to a production VM for troubleshooting. With Bastion, you can grant time-bound access to just that VM, without opening firewall ports or provisioning VPN credentials.
Azure Virtual Desktop: Flexible and Efficient Workspaces for External Users
Secure vendor access isn’t always as simple as providing access to a specific resource. Sometimes, a full desktop experience or access to multiple internal resources across development, production, secure networks, etc. are required. Azure Virtual Desktop (AVD) offers a secure, scalable solution. AVD provides a virtualized Windows experience that is hosted in Azure but allows vendors to work within a controlled environment that is suited to their needs– scoped only to access the resources they require, and can be fully managed by your IT team.
Why It Works for Vendor Access
- Granular Access Control: Assign access based on roles, groups, or specific tasks.
- Customization: Deliver desktops or applications that are tailored to meet the task at hand.
- Entra ID Conditional Access Secured: Enforce multi-factor authentication, device compliance, and location-based access.
- Data Protection: Enable data loss prevention with policies like clipboard restrictions, watermarking, and session recording.
- Scalability: Spin up environments for short-term projects or long-term engagements without provisioning physical hardware. Then pay only for what you use.
- Compliance: Meet strict compliance requirements from regulatory frameworks.
Primary Use Case: A partner needs access to work inside your environment to support building or modifying a variety of resources in the cloud or on-prem. AVD allows them to work in a secure space without exposing your environment to theirs or the outside world.
Microsoft Entra Private Access: Zero Trust for Internal Apps
VPNs have been a necessary evil for a long time in the secure remote access space, but they’re increasingly being seen as over-permissive against today’s threats. They tend to grant broad network access with limited visibility or control. Some of that is due to improper configuration (I’ll get to locking that down tomorrow), and some is a limitation of the technology. Microsoft Entra Private Access offers a modern alternative as part of the overall Secure Access Service Edge (SASE) strategy. It enables secure, identity-centric access to internal apps without requiring full network connectivity.
How does this help?
- Enables Zero Trust: Access is granted based on identity, device, and real-time risk signals.
- No VPN Required: Vendors access apps through a secure reverse proxy, reducing complexity and overhead. No more VPN clients and version mismatches to maintain.
- Integrated Security: Works with the broader landscape of security solutions like Microsoft Defender, Entra ID Conditional Access, and Identity Protection.
- Improved User Experience: Seamless access via browser or Microsoft 365 productivity apps, with no need for VPN clients and multi-step processes.
Use Case: A third-party service provider (or remote employee) needs access to an internal web app. Entra Private Access allows secure, browser-based access with full audit trails. Doing this without opening the network up for additional risks.
Final Thoughts
Each of these technologies presents a different value proposition depending on the use case. The right mix depends on your specific needs across the users themselves, alongside security, compliance, and management efficiency.
Looking for a place to start?
- Short-term access to VMs in the cloud and data center? Use Azure Bastion.
- More persistent, long-term, or specialized software required? Deploy Azure Virtual Desktops or Applications.
- Access to internal apps, but you don’t need a desktop. Leverage Entra Private Access.
The key is to move beyond one-size-fits-all solutions, put the users’ needs at the forefront, while ensuring the access itself is secured with Microsoft Entra ID Conditional Access, Privileged Identity Management, etc.
Next Steps: Let’s Build Your Plan
I’d love to hear more about your secure remote access use cases. From there, we can develop a plan with the right mix of technology and security to deliver modern, secure, and efficient access to your critical business partners.
Ready to Secure Your Vendor Access?
Implementing a modern, Zero Trust strategy for external partners requires careful planning and the right mix of Azure tools. Stop relying on outdated VPNs and start controlling access with identity-driven security.
