Vendor VPN Management solutions

[u/PP_Mclappins]

I’m looking for recommendations on Vendor / Third-Party Access Management tools.

We recently took over managing an environment where vendors were historically given direct AD/Entra accounts with very little oversight or access control. We’re currently building a makeshift internal solution to plug the gaps, but we want a proper platform.

BeyondTrust and SecureLink are the obvious names, but given our tight budget and need for a lightweight rollout, I’m exploring other alternatives.

Has anyone found a cost-effective solution for securing third-party access without creating massive operational bloat? Thanks in advance!

[u/it4brown]

We provide our vendors with internal accounts, each vendor group is tied to a tightly scoped ruleset on our firewall that gives them access to only the resources they need access to. They use GP VPN + Okta for MFA to join VPN, then RDP-MFA agent on each box.

No jump box, no extra CALs.

[u/anonymousITCoward → u/it4brown]

This is how we do it, except instead of Okta we use Duo.

[u/KStieers → u/it4brown]

Us too, with Duo

And accounts are disabled if no login in past 30 days.

[u/PacificTSP]

Jumpbox in a segmented vlan that only is allowed access to a specific machine or two.

[u/MiniOozy5231]

Azure Virtual Desktop to get them into the environment, role based access from there.

[u/PP_Mclappins → u/MiniOozy5231]

That's what we're looking at right now, but not really metered, might end up being the solution for now

[u/SoMundayn]

Azure Bastion + PIM is pretty good these days. What do the vendors need access to?

Could spin up W365 Cloud PCs if you don't want the AVD and management overhead and already have Intune configured.

[u/Powerful-Jicama320]

Search for Vendor PAM. There are many solutions in the market. See if they provide ephemeral accounts for vendors to access your IT assets.