How Entra Private Access Can Stop Hotel Hackers

-

Checking-in to your hotel soon? You may have read recently that hackers have unleashed a campaign against various hotels, resulting in compromise of work accounts. In this attack, hackers take advantage of manipulating users into providing their credentials and hijacking their session. Albeit this is nothing new, it is a reminder that strong authentication and security throughout the pipeline is crucial to ensure a user's security. What is different however, is Microsoft Entra Private Access. In this article, I'll explain what happened, and how Entra Private Access could've protected these end users.

What Happened?

On July 24th, a report from BleepingComputer highlighted that various hotel chains have become victim of attackers compromising Microsoft 365 accounts through DNS Poisoning. Attackers first gained admin access to hotel or conference-center Wi-Fi appliances through exposed management interfaces, weak or reused credentials, and unpatched firmware. Once they were in, they could modify the DNS settings for every guest device. Next, attackers changed the gateway's DNS resolver so that legitimate Microsoft domains resolved to attacker-controlled domains. So for example, if a user typed login.microsoftonline.com they were silently redirected to the attackers server which had a like-for-like copy of the login screen. From here users were compromised through the following attack paths:

  • Standard credential harvesting - hackers steal the username and password, which can be dangerous for organizations that do not have Multifactor Authentication enabled.
  • Device Code flow abuse (more dangerous) - some victims were redirected to a fake Microsoft page prompting them to to approve a device-code login. Because of this, attackers were able to bypass MFA and were issued a legitimate OAuth token that could be used for further escalation.
  • For some lucky users (sarcasm) they were also victims of Web Proxy Auto-Discovery, which allowed for the interception of ALL web traffic through an attacker-controlled proxy. So not only did their M365 account become compromised, but so did everything they did during their use.

As I said, compromises of hotel and conference centres are nothing new. We all remember the AGM Hotel hack, the Marriott hack, and the list goes on. One thing that no one talks about is how we secure users in our organization from the outset so that when these things happen, they're already secure. If we keep pointing fingers at the hotel chains and expect them to fully protect us from compromise, are we actually providing defense in depth? I don't think so. That is where Microsoft Entra Private Access does great things for your users who are using public networks.

How Entra Private Access Could Have Prevented This

Microsoft Entra Private Access (EPA) introduces a Zero Trust network layer that fundamentally changes how devices connect to corporate and SaaS resources. Instead of trusting the local network, which is exactly what the attackers exploited- EPA brokers every connection through an identity‑anchored tunnel. This means the hotel’s DNS, proxy, or gateway never sees or influences your Microsoft 365 traffic.

Here’s how EPA breaks the attack chain:

In short, Entra Private Access removes the weakest link: trusting the network. Whether your users are in a hotel, airport, or coffee shop, their authentication and data flows remain inside a verified, encrypted channel tied to their identity and device posture.

How to Protect Your Users with Entra Private Access

Entra Private Access isn’t just another Zero Trust buzzword — it’s a practical control that directly breaks the attack chain used in these hotel Wi‑Fi compromises. Here’s how organizations can implement it effectively.

1. Deploy the Entra Private Access Connector

To begin, deploy the EPA connector inside your environment. This establishes the identity‑anchored broker that all traffic will route through.

  • Install the connector on a Windows Server host
  • Register it with your Entra tenant
  • Ensure outbound connectivity to the Entra edge
  • Validate that the connector is reachable from enrolled devices

This creates the foundation for private, brokered access.

2. Enroll Devices into Entra Internet Access and Private Access

EPA works best when paired with Entra Internet Access (EIA). Together, they provide:

  • Secure outbound internet access
  • Brokered access to SaaS apps
  • Private access to internal apps
  • Isolation from local DNS, proxies, and network manipulation

Enroll devices using:

  • Intune
  • Group Policy
  • Manual installer (for unmanaged devices)

Once enrolled, the device stops trusting the local network for DNS or routing.

3. Enable Private Access for Microsoft 365 Endpoints

This is the critical step that stops the hotel attack.

Configure EPA to broker traffic for:

When these endpoints are protected:

  • DNS is resolved inside the Entra fabric
  • Authentication traffic is isolated from public networks
  • Fake login pages become unreachable
  • Device‑code phishing fails due to token binding and CA policies

This is the exact control that would have prevented the attack.

4. Enforce Conditional Access and Token Protection

EPA integrates tightly with Conditional Access. Enable:

  • Phishing‑resistant MFA (FIDO2, Windows Hello)
  • Token Protection (binds tokens to device + session)
  • Compliant device requirement
  • Network location = Entra broker only

Even if credentials are stolen, attackers cannot satisfy these conditions.

5. Disable Legacy Device Code Flow

BleepingComputer's report highlights that attackers abused Device Code flow to bypass MFA.

Mitigate this by:

  • Disabling Device Code flow for all users
  • Allowing exceptions only for managed devices
  • Monitoring OAuth token issuance in Entra logs

This closes the second attack path entirely.

6. Test EPA on Untrusted Networks

Before rolling out broadly, validate EPA’s protections:

  • Connect a test device to a guest Wi‑Fi
  • Attempt to access Microsoft 365
  • Confirm traffic is brokered
  • Validate DNS is resolved through Entra
  • Attempt to reach known phishing domains (they should fail)

This ensures your users are protected in hotels, airports, cafés, and conferences.

Why This Matters

Organizations often focus on endpoint protection and MFA, but network trust is still a blind spot. The hotel DNS poisoning campaign proves that attackers don’t need to break encryption or bypass MFA; they just need to control what your device believes is “Microsoft.” Entra Private Access closes that gap by ensuring that only verified, brokered connections ever reach your cloud services.

Final Thoughts

This campaign is a reminder that Zero Trust isn’t just about identity, it’s about transport. By adopting Entra Private Access, enterprises can protect users wherever they connect, even on compromised networks. The next time someone logs in from a hotel Wi‑Fi, their session should be brokered, validated, and isolated- not left to chance.

Until next week admins!

 

Comments

Post a Comment

Popular posts from this blog

Using Custom Connectors and Microsoft Graph API's to Manage Licenses in Power Automate - Part One

-
Happy June folks! I come to you with another post, but this time I wanted to change it up and show you something else I have just finished working on. As a SysAdmin, one of the most common issues we run into is managing licenses. Working at a post-secondary institution makes this an even greater challenge, as you have both students, staff and faculty constantly coming as well as going. Managing to keep up with this constant change can introduce great administrative overhead which takes away time from important upkeep of other systems and initiatives. You may also notice this same issue in large corporations or in other government organizations. To help combat this, I wanted to create a flow that can do the following: Get the user and their licenses Determine their last sign-in and the date Conditional to determine if the user is past the "cutoff" date Remove the user from a group where the license is assigned The only problem with doing this is that Power Automate does not ha...
Read more

Using Power Automate to Update Contact Information

-
 We've all been there- you have a large organization who has out-of-date contact information. What do you do? You could go around to each department and ask them nicely to update their information, or send out an org-wide email prompting people to do so. However, this is tedious and oftentimes a pointless task. By the time you update one department, you're running to fix another. What if you could put the power back in the department's hands to do so? This is a struggle I faced recently as I was trying to find was I could conjure up some updated contact information for each department. As I did my research, I found that I was not alone in this endeavour as it seems that many IT professionals would love to make this process a little bit less painful. With this in mind, I introduce to you my latest flow! This flow will allow you to encourage users to update their contact information, without the overhead that comes with manual effort. In addition to this, this flow utilizes t...
Read more

Using Custom Connectors and Microsoft Graph API's to Manage Licenses in Power Automate - Part Two

-
Hello again! Didn't I promise you that I'd be back to wrap this up? Well, here I am to give you the second tidbit of information that you need to get this started. If you haven't already, take a look at my previous post where I go into depth about creating a custom connector in Power Automate to retrieve the latest sign-in and also gather the user's licenses. Now that we have the custom connector ready, we can now get into the meat n' potatoes of this series. In this post, I will show you the flow that makes this possible and how you can use the custom connector you have created to tie it all together! Hope you enjoy. Understanding the Logic Before we can begin creating the flow, we should first understand how the flow will work. I designed this to flow to be triggered manually, but you may want to schedule it or use another trigger. The trigger will depend on your organization's policies, so please adjust accordingly. Once triggered, the flow will use the Entra...
Read more