What changed in the Private Access Sensor
Microsoft has released version 2.2.79 of the Microsoft Entra Private Access Sensor, available for download on September 29, 2026, according to the official release notes. The Private Access Sensor is the connector component that organizations deploy on-premises to extend Microsoft Entra Global Secure Access to private resources such as internal applications, file shares, and servers that aren’t directly reachable from the internet.
If your organization uses Global Secure Access with the Private Access feature, this release introduces several changes worth understanding before you upgrade, including a new automatic update mechanism, stricter network and authentication requirements, and the removal of a previously available manual override.
Automatic updates are now built in
One of the more significant changes in 2.2.79 is the introduction of over-the-air (OTA) automatic updates. According to Microsoft’s documentation, this version adds automatic downloading and installation of future sensor updates, meaning administrators will no longer need to manually download and install every subsequent release through the Microsoft Entra admin center.
A one-time manual step if you’re upgrading from 2.2.42
There’s an important caveat for environments currently running sensor version 2.2.42. Microsoft’s release notes specify that upgrading from 2.2.42 requires a one-time installation of the full sensor installer, downloaded directly from the Microsoft Entra admin center, in order to enable OTA updates going forward.
Practical recommendation: If you’re running 2.2.42 or an earlier version, plan a maintenance window to manually install the full 2.2.79 installer rather than assuming the sensor will update itself. Once that one-time installation is complete, future updates should be handled automatically according to the documented behavior, reducing ongoing manual maintenance.
Security and authentication changes
Version 2.2.79 includes several changes that affect how the sensor handles Kerberos authentication traffic and local configuration overrides.
Kerberos policy now applies to UDP as well as TCP
Previously, Kerberos policy enforcement by the sensor applied to TCP traffic. In this release, Microsoft has extended that enforcement to UDP as well, alongside hardened network packet validation. For administrators, this means any network paths, firewall rules, or monitoring tools tuned specifically around TCP-based Kerberos traffic should be reviewed to confirm UDP traffic is accounted for too.
IPv6 Kerberos traffic is blocked
The release notes state that IPv6 Kerberos traffic is unsupported and is now blocked by the sensor, with the guidance to use IPv4 instead. If your private network segments rely on IPv6 for Kerberos authentication to resources published through Global Secure Access, this is a behavior change that could affect connectivity after upgrading, and it’s worth testing in a non-production environment first.
The local registry break-glass override has been removed
Earlier sensor versions reportedly allowed a local registry-based “break-glass” override, a fallback mechanism administrators could use at the machine level to bypass enforcement in specific circumstances. Microsoft’s documentation confirms that 2.2.79 removes this local override in favor of cloud-based policy control.
What this means in practice: Organizations that previously relied on the local registry override as an emergency fallback will no longer have that option after upgrading. Any exceptions or emergency access scenarios now need to be managed through cloud policy rather than a local configuration change on the sensor host.
Network requirement: inbound TCP and UDP on port 1337
The release notes list an upgrade consideration that administrators should not overlook: inbound TCP and UDP traffic on port 1337 must be allowed. This is listed as a requirement tied to the 2.2.79 upgrade, and SMB administrators should confirm that any on-premises firewalls, network security groups, or host-based firewall rules protecting the sensor’s host machine permit this traffic in both protocols before or during the upgrade.
Other improvements in this release
Beyond the headline changes, Microsoft’s release notes describe several additional refinements in 2.2.79:
- Access enforcement improvements: The sensor now matches non-wildcard service principal names (SPNs) and requested Kerberos service names by the owning Active Directory account’s security identifier (SID), rather than relying solely on exact service-name string matching. This extends protection to aliases of the same account, while existing name-based matching is retained when account resolution isn’t available. Wildcard SPN matching has also been corrected, and wildcard rules continue to be name-based.
- Diagnostics and telemetry: Microsoft reports improvements to Kerberos transport, service-name resolution, and firewall diagnostics, which should help administrators troubleshoot connectivity and authentication issues more effectively.
- Bug fixes: The release also includes general bug fixes and minor improvements, though the notes don’t itemize specific defects addressed.
Context: what changed in the prior version, 2.2.42
For administrators tracking the upgrade path, it’s useful to know that version 2.2.42, released June 16, 2026, introduced its own set of changes, including file and Event Tracing for Windows (ETW) channel hardening, fail-close enforcement for policy failures, expanded Kerberos ticket hash computation and event logging, a configurable cap on trace and log file sizes, and a preview capability for privileged user access enforcement based on UPN or SID. Understanding this baseline helps explain why Microsoft specifically calls out the 2.2.42-to-2.2.79 upgrade path as requiring a one-time manual installer step.
Does this apply to typical SMB Global Secure Access deployments?
The Microsoft release notes describe these changes as applying to the Private Access Sensor generally, without carving out separate behavior for small or midsize organizations versus larger enterprises. The documentation doesn’t specifically address SMB-scale deployments as a distinct category, so there’s no documented basis to assume reduced impact for smaller environments.
In practical terms, if your organization has deployed the Private Access Sensor as part of Global Secure Access to publish private resources, these changes are relevant to you regardless of organization size. The port 1337 requirement, the UDP Kerberos enforcement, the IPv6 block, and the removal of the local override all affect the sensor’s core functionality rather than being tied to deployment scale.
Practical recommendation: Before upgrading, SMB administrators should inventory which on-premises servers run the Private Access Sensor, confirm firewall rules allow the required port 1337 traffic in both TCP and UDP, and verify whether any internal processes depend on IPv6 Kerberos traffic or the now-removed local registry override. Testing the upgrade in a limited pilot group before a broader rollout is a reasonable precaution, though this is a general operational recommendation rather than a documented Microsoft requirement.
Conclusion
The 2.2.79 release of the Microsoft Entra Private Access Sensor brings meaningful operational and security changes: a shift toward automatic over-the-air updates, stricter Kerberos enforcement across both TCP and UDP, an end to IPv6 Kerberos support, removal of the local break-glass override, and a firm networking requirement around port 1337. For organizations currently on version 2.2.42, the one-time full installer step is a change that deserves a planned maintenance window rather than being left to chance.
Because Microsoft’s documentation doesn’t single out small or midsize deployments for different treatment, SMB administrators should treat these changes as broadly applicable and review their current sensor version, network rules, and any dependency on the removed local override before upgrading. As always with infrastructure changes affecting authentication, a controlled rollout and verification step is a sound practical approach even though it isn’t a documented Microsoft mandate.
This article is a draft based on currently available Microsoft documentation and is subject to human review before publication.