Microsoft Entra Private Access
GeneralPrivate Access Sensor Release History
In brief
Version 2.2.79, released September 29, 2026, adds over-the-air sensor updates, enhanced Kerberos security and diagnostics, SID-based service matching, and corrected wildcard matching.
What Entra admins need to know
Upgrading from version 2.2.42 requires a one-time full-installer deployment to enable OTA updates. Allow inbound TCP and UDP on port 1337; IPv6 Kerberos traffic is blocked, so use IPv4.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- Browse to Global Secure Access > Connect > Connectors and sensors > Private access sensors.
- Select Download private access sensor.
Version 2.2.4279
Released for download on June 16,September 29, 2026.
Over-the-air automatic updates
- Adds automatic downloads and installation of future sensor updates.
Security enhancements
- Extends Kerberos policy enforcement to UDP alongside TCP.
- Hardens network packet validation and removes the local registry break-glass override in favor of cloud policy.
Access enforcement
- Matches non-wildcard SPNs and requested Kerberos service names (
sname) by their owning Active Directory account SID, rather than relying only on exact service-name strings. This extends protection to aliases of the same account. Existing name-based matching is retained when account resolution is unavailable. - Corrects wildcard SPN matching. Wildcard rules remain name-based.
Diagnostics and telemetry
- Improves Kerberos transport, service-name resolution, and firewall diagnostics.
Bug fixes
- Includes bug fixes and minor improvements.
Upgrade considerations
- Allow inbound TCP and UDP on port 1337.
- IPv6 Kerberos traffic is unsupported and blocked; use IPv4.
Version 2.2.42
Released for download on June 16, 2026.
@@ -20,6 +20,40 @@ You can download the current version of the Private Access Sensor from the Micro 1. Browse to **Global Secure Access** > **Connect** > **Connectors and sensors** > **Private access sensors**. 1. Select **Download private access sensor**. +## Version 2.2.79+ +Released for download on September 29, 2026.+ +### Over-the-air automatic updates+ +- Adds automatic downloads and installation of future sensor updates.+ +> [!NOTE]+> Upgrading from version 2.2.42 requires a one-time installation of the full sensor installer from the Microsoft Entra admin center to enable OTA updates.+ +### Security enhancements+ +- Extends Kerberos policy enforcement to UDP alongside TCP.+- Hardens network packet validation and removes the local registry break-glass override in favor of cloud policy.+ +### Access enforcement+ +- Matches non-wildcard SPNs and requested Kerberos service names (`sname`) by their owning Active Directory account SID, rather than relying only on exact service-name strings. This extends protection to aliases of the same account. Existing name-based matching is retained when account resolution is unavailable.+- Corrects wildcard SPN matching. Wildcard rules remain name-based.+ +### Diagnostics and telemetry+ +- Improves Kerberos transport, service-name resolution, and firewall diagnostics.+ +### Bug fixes+ +- Includes bug fixes and minor improvements.+ +### Upgrade considerations+ +- Allow inbound TCP and UDP on port 1337.+- IPv6 Kerberos traffic is unsupported and blocked; use IPv4.+ ## Version 2.2.42 Released for download on June 16, 2026.