Private Access (ZTNA)
Private Access publishes an internal web app on its own public hostname. Users reach it from any browser after signing in with your IdP — no VPN, no inbound firewall rule. The traffic goes out from a connector inside your network to DashX, never the other way round.
Open it at Secure Access → Private Access.
Before you start
- The add-on is enabled. Private Access is a paid module. Without it the page shows "Private Access (ZTNA) is a paid add-on" — it is available on the Starter plan and above.
- A connector exists. A connector is simply a DashX agent installed on a machine inside the target network. Install the agent (see Deploy Agent) and it appears in the Connector list automatically. Until one exists, the page shows: "No connectors found. Install a DashX agent inside the target network and it becomes available here as a connector."
- Identity is configured. End users sign in through Secure Access → Identity. Local users, LDAP and SAML (Entra ID, Okta, Google) all work — the same IdP config RADIUS and MFA use.
What the page shows
| Element | Meaning |
|---|---|
| + Publish app | Opens the Publish resource drawer — see Publish an app |
App name + ENABLED / DISABLED | Whether the app currently accepts traffic |
MFA badge (indigo) | The policy requires an MFA step-up |
DEVICE badge (cyan) | The policy requires a managed device (mTLS certificate) |
| Blue hostname link | The public address users open, e.g. https://acme-app-wiki.access.us.dashxtech.com |
| Grey arrow line | Where the connector forwards to: → https://10.0.0.20:443 · connector: WIN-DC01 |
unassigned (amber) | No connector picked — the app cannot work until you edit it and choose one |
Buttons on each card: Disable / Enable, Edit, Delete (confirms with "Delete "<name>"? Users will lose access immediately.").
Recent access
The Recent access table under the app list is your live audit trail — it refreshes every 15 seconds and has a Refresh button.
Columns: When, App, User, IP, Decision. A green decision means allow; a red one shows the reason next to it, for example deny · not_in_allowed_group or deny · device_not_managed.
Branding the sign-in page
The strip at the top of the page previews your organization logo. Users see it on the Private Access sign-in screen instead of the DashX mark. Upload it once in Settings → Branding — the same logo is reused across the help desk, guest portal and self-enrollment.
How a request actually flows
- The user opens
https://<org>-app-<name>.access.<region>.dashxtech.com. - DashX redirects to your IdP (or the username/password form) and, if the policy asks for it, to an MFA step-up.
- Policy is evaluated: org membership → allowed users/groups → MFA → managed device.
- On success DashX opens a tunnel through the connector to
internal_host:internal_portand proxies the session. The connector only permits the host and port you published — nothing else on that network is reachable.
Access is granted for a signed session cookie valid for 8 hours. Disabling an app cuts access immediately; removing a user from an allowed group takes effect on their next sign-in.