Entra Private Access Licensing
You manage entra private access licensing by assigning per-user directory plans to your team. Every user who opens internal resources through the service needs an active license. Teams often assign broad group licenses to save time during initial rollouts. Broad assignments give too many people network paths to sensitive internal systems. How entra private access licensing works Microsoft ties this service to its cloud identity plans. Admins buy either a standalone add-on or a full suite plan
Microsoft Entra ID (Azure AD) + Virtual Private Database: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You manage entra private access licensing by assigning per-user directory plans to your team. Every user who opens internal resources through the service needs an active license. Teams often assign broad group licenses to save time during initial rollouts. Broad assignments give too many people network paths to sensitive internal systems.
How entra private access licensing works
Microsoft ties this service to its cloud identity plans. Admins buy either a standalone add-on or a full suite plan. You assign these licenses to individual users or specific security groups. The cloud directory checks license status when a user signs in.
A local software connector runs inside your private network. It makes an outbound link to the cloud service. Users install a client agent on their laptops and phones. That agent intercepts traffic meant for private IP addresses and internal hostnames.
The cloud service checks conditional rules before it opens the network tunnel. Admins can require multi-factor checks or compliant devices for each app. Once the check passes, the user gets a network path to the server. You can scope rules by IP range, port, and protocol.
Scoping user groups for license assignment
Good license management starts with tight group boundaries in your directory. Do not assign private network licenses to your entire company group. Split your staff into small groups based on their daily job needs. Developers need different internal network paths than finance or support staff.
Link each private app segment to a specific directory group. When an engineer leaves a project, remove them from that group right away. This step revokes both their network path and their assigned license seat. You save budget and shrink your internal attack surface at once.
Review your assigned seats every month to find inactive accounts. Contractors often keep active licenses long after their projects end. Automated group rules can remove users when their department attribute changes. Clean groups keep your license counts accurate and your network rules tight.
Microsoft Entra ID (Azure AD) + Virtual Private Database: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What network licensing solves and what it misses
This setup replaces legacy VPN tools with identity-based network routing. It verifies who can reach a private host or port. It also blocks unlicensed users from seeing internal network segments. Your team gets a single place to manage initial sign-in rules.
Still, network routing only controls who reaches the server port. Once the tunnel opens, the user still logs into the database or host. Teams often share static database passwords or root SSH keys behind the tunnel. The network tool cannot see what commands run inside that open session.
An engineer with a valid license can still run a destructive query. They can also pull sensitive data rows like emails, phone numbers, or card numbers. Network rules decide who connects, not what individual statements or commands do in flight. You still need controls that inspect queries, mask data, and approve risky commands.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Do service accounts need a user license for private network routing?
Licensing applies to human users who run the client agent on their devices. Automated server-to-server traffic usually uses different network peering paths rather than user licenses.
Can I assign licenses to external guest users in my directory?
Yes, you can assign licenses to external guests who need private app paths. You must allocate a valid seat to each guest account in your tenant.
Does a private network license hide sensitive data inside a database?
No, the license only enables the network tunnel to the database port. It does not inspect SQL queries or rewrite fields like national IDs in results.