Application Proxy requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 0dfc504 · +30 −28 lines · also on GitHub
11
---
22
title: Add an on-premises application for remote access through application proxy in Microsoft Entra ID
3
−description: Microsoft Entra ID has an application proxy service that enables users to access on-premises applications by signing in with their Microsoft Entra account. This tutorial shows you how to prepare your environment for use with application proxy. Then, it uses the Microsoft Entra admin center to add an on-premises application to your Microsoft Entra tenant.
3
+description: Learn how to prepare your environment for application proxy and add an on-premises application to your Microsoft Entra tenant.
44
ms.topic: tutorial
5
−ms.date: 02/25/2026
5
+ms.date: 03/10/2026
66
ms.author: ashishj
77
ms.reviewer: ashishj
88
ai-usage: ai-assisted
⋯ 1 unchanged line
1010
1111
# Add an on-premises application for remote access through application proxy in Microsoft Entra ID
1212
13
−Microsoft Entra ID has an application proxy service that enables users to access on-premises applications by signing in with their Microsoft Entra account. To learn more about application proxy, see [What is application proxy?](overview-what-is-app-proxy.md). This tutorial prepares your environment for use with application proxy. Once your environment is ready, use the Microsoft Entra admin center to add an on-premises application to your tenant.
13
+Microsoft Entra ID has an application proxy service that enables users to access on-premises applications by signing in with their Microsoft Entra account. To learn more about application proxy, see [What is application proxy?](overview-what-is-app-proxy.md). This tutorial prepares your environment for use with application proxy. After your environment is ready, use the Microsoft Entra admin center to add an on-premises application to your tenant.
1414
15
−:::image type="content" source="./media/application-proxy-add-on-premises-application/app-proxy-diagram.png" alt-text="Application proxy Overview Diagram" lightbox="./media/application-proxy-add-on-premises-application/app-proxy-diagram.png":::
15
+:::image type="content" source="./media/application-proxy-add-on-premises-application/app-proxy-diagram.png" alt-text="Application proxy overview diagram" lightbox="./media/application-proxy-add-on-premises-application/app-proxy-diagram.png":::
1616
1717
In this tutorial, you:
18
−- Install and verify the connector on your Windows server, and registers it with application proxy.
18
+- Install and verify the connector on your Windows server, and register it with application proxy.
1919
- Add an on-premises application to your Microsoft Entra tenant.
20
−- Verify a test user can sign on to the application by using a Microsoft Entra account.
20
+- Verify a test user can sign in to the application by using a Microsoft Entra account.
2121
2222
2323
## Prerequisites
2424
2525
To add an on-premises application to Microsoft Entra ID, you need:
26
−- An [Microsoft Entra ID P1 or P2 subscription](https://azure.microsoft.com/pricing/details/active-directory).
26
+- A [Microsoft Entra ID P1 or P2 subscription](https://azure.microsoft.com/pricing/details/active-directory).
2727
- An Application Administrator account.
28
−- A synchronized set of user identities with an on-premises directory. Or create them directly in your Microsoft Entra tenants. Identity synchronization allows Microsoft Entra ID to preauthenticate users before granting them access to application proxy published applications. Synchronization also provides the necessary user identifier information to perform single sign-on (SSO).
29
−- An understanding of application management in Microsoft Entra, see [View enterprise applications in Microsoft Entra](~/identity/enterprise-apps/view-applications-portal.md).
30
−- An understanding of single sign-on (SSO), see [Understand single sign-on](~/identity/enterprise-apps/what-is-single-sign-on.md).
28
+- A synchronized set of user identities with an on-premises directory, or identities created directly in your Microsoft Entra tenant. Identity synchronization allows Microsoft Entra ID to preauthenticate users before granting them access to application proxy published applications. Synchronization also provides the necessary user identifier information to perform single sign-on (SSO).
29
+- An understanding of application management in Microsoft Entra. For more information, see [View enterprise applications in Microsoft Entra](~/identity/enterprise-apps/view-applications-portal.md).
30
+- An understanding of single sign-on (SSO). For more information, see [Understand single sign-on](~/identity/enterprise-apps/what-is-single-sign-on.md).
3131
3232
## Install and verify the Microsoft Entra private network connector
33
+
3334
Application proxy uses the same connector as Microsoft Entra Private Access. The connector is called Microsoft Entra private network connector. To learn how to install and verify a connector, see [How to configure connectors](../../global-secure-access/how-to-configure-connectors.md).
3435
3536
## General remarks
3637
37
−Public Domain Name System (DNS) records for Microsoft Entra application proxy endpoints are chained CNAME records pointing to an A record. Setting up the records this way ensures fault tolerance and flexibility. The Microsoft Entra private network connector always accesses host names with the domain suffixes `*.msappproxy.net` or `*.servicebus.windows.net`. However, during the name resolution the CNAME records might contain DNS records with different host names and suffixes. Due to the difference, you must ensure that the device (depending on your setup - connector server, firewall, outbound proxy) can resolve all the records in the chain and allows connection to the resolved IP addresses. Since the DNS records in the chain might be changed from time to time, we can't provide you with any list DNS records.
38
+Public Domain Name System (DNS) records for Microsoft Entra application proxy endpoints are chained CNAME records pointing to an A record. Setting up the records this way ensures fault tolerance and flexibility. The Microsoft Entra private network connector always accesses host names with the domain suffixes `*.msappproxy.net` or `*.servicebus.windows.net`. However, during the name resolution the CNAME records might contain DNS records with different host names and suffixes.
3839
40
+Due to the difference, you must ensure that the device — connector server, firewall, or outbound proxy depending on your setup — can resolve all the records in the chain and allows connection to the resolved IP addresses. Since the DNS records in the chain might change from time to time, there's no fixed list of DNS records available.
41
+
3942
If you install connectors in different regions, you should optimize traffic by selecting the closest application proxy cloud service region with each connector group. To learn more, see [Optimize traffic flow with Microsoft Entra application proxy](application-proxy-network-topology.md).
4043
4144
If your organization uses proxy servers to connect to the internet, you need to configure them for application proxy. For more information, see [Work with existing on-premises proxy servers](application-proxy-configure-connectors-with-proxy-servers.md).
⋯ 24 unchanged lines
6669
| **Backend Application Timeout** | Set this value to **Long** only if your application is slow to authenticate and connect. At default, the backend application time-out has a length of 85 seconds. When set too long, the backend time out is increased to 180 seconds. |
6770
| **Use HTTP-Only Cookie** | Select to have application proxy cookies include the HTTPOnly flag in the HTTP response header. If using Remote Desktop Services, keep the option unselected. |
6871
| **Use Persistent Cookie**| Keep the option unselected. Only use this setting for applications that can't share cookies between processes. For more information about cookie settings, see [Cookie settings for accessing on-premises applications in Microsoft Entra ID](./application-proxy-configure-cookie-settings.md). |
69
− | **Translate URLs in Headers** | Keep the option selected unless your application required the original host header in the authentication request. |
72
+ | **Translate URLs in Headers** | Keep the option selected unless your application requires the original host header in the authentication request. |
7073
| **Translate URLs in Application Body** | Keep the option unselected unless HTML links are hardcoded to other on-premises applications and don't use custom domains. For more information, see [Link translation with application proxy](./application-proxy-configure-hard-coded-link-translation.md).<br><br>Select if you plan to monitor this application with Microsoft Defender for Cloud Apps. For more information, see [Configure real-time application access monitoring with Microsoft Defender for Cloud Apps and Microsoft Entra ID](./application-proxy-integrate-with-microsoft-cloud-application-security.md). |
7174
| **Validate Backend TLS Certificate** | Select to enable backend Transport Layer Security (TLS) certificate validation for the application. |
7275
⋯ 1 unchanged line
7477
7578
## Test the application
7679
77
−You're ready to test the application is added correctly. In the following steps, you add a user account to the application, and try signing in.
80
+You're ready to test that the application was added correctly. In the following steps, you add a user account to the application, and try signing in.
7881
7982
### Add a user for testing
8083
⋯ 2 unchanged lines
8386
To add a test user:
8487
8588
1. Select **Enterprise applications**, and then select the application you want to test.
86
−2. Select **Getting started**, and then select **Assign a user for testing**.
87
−3. Under **Users and groups**, select **Add user**.
88
−4. Under **Add assignment**, select **Users and groups**. The **User and groups** section appears.
89
−5. Choose the account you want to add.
90
−6. Choose **Select**, and then select **Assign**.
89
+1. Select **Getting started**, and then select **Assign a user for testing**.
90
+1. Under **Users and groups**, select **Add user**.
91
+1. Under **Add assignment**, select **Users and groups**. The **Users and groups** section appears.
92
+1. Choose the account you want to add.
93
+1. Choose **Select**, and then select **Assign**.
9194
9295
### Test the sign-on
9396
9497
To test authentication to the application:
9598
96
−1. From the application you want to test, select **application proxy**.
97
−2. At the top of the page, select **Test Application** to run a test on the application and check for any configuration issues.
98
−3. Make sure to first launch the application to test signing into the application, then download the diagnostic report to review the resolution guidance for any detected issues.
99
+1. From the application you want to test, select **Application Proxy**.
100
+1. At the top of the page, select **Test Application** to run a test on the application and check for any configuration issues.
101
+1. First, launch the application to test signing in to it. Then download the diagnostic report to review the resolution guidance for any detected issues.
99102
100103
For troubleshooting, see [Troubleshoot application proxy problems and error messages](./application-proxy-troubleshoot.md).
101104
102105
## Clean up resources
103106
104
−Don't forget to delete any of the resources you created in this tutorial when you're done.
107
+Delete any resources you created in this tutorial when you're done.
105108
106109
## Troubleshooting
107110
108111
Learn about common issues and how to troubleshoot them.
109112
110
−### Create the Application/Setting the URLs
113
+### Create the application/set the URLs
111114
Check the error details for information and suggestions for how to fix the application. Most error messages include a suggested fix. To avoid common errors, verify:
112115
113116
- You're an administrator with permission to create an application proxy application
⋯ 4 unchanged lines
118121
119122
The error message should display in the top-right corner when you create the application. You can also select the notification icon to see the error messages.
120123
121
−
122124
### Upload certificates for custom domains
123125
124
−Custom Domains allow you to specify the domain of your external URLs. To use custom domains, you need to upload the certificate for that domain. For information on using custom domains and certificates, see [Working with custom domains in Microsoft Entra application proxy](how-to-configure-custom-domain.md).
126
+Custom domains let you specify the domain of your external URLs. To use custom domains, you need to upload the certificate for that domain. For information on using custom domains and certificates, see [Working with custom domains in Microsoft Entra application proxy](how-to-configure-custom-domain.md).
125127
126128
If you're encountering issues uploading your certificate, look for the error messages in the portal for additional information on the problem with the certificate. Common certificate problems include:
127129
⋯ 1 unchanged line
129131
- Certificate is self-signed
130132
- Certificate is missing the private key
131133
132
−The error message display in the top-right corner as you try to upload the certificate. You can also select the notification icon to see the error messages.
134
+The error message displays in the top-right corner as you try to upload the certificate. You can also select the notification icon to see the error messages.
133135
134136
## Related content
135137
136138
- [What is Global Secure Access?](../../global-secure-access/overview-what-is-global-secure-access.md)
137
−- [Plan a Microsoft Entra application proxy deployment](/entra/identity/app-proxy/conceptual-deployment-plan)
138
−- [Security considerations for accessing apps remotely with Microsoft Entra application proxy](/entra/identity/app-proxy/application-proxy-security)
139
+- [Plan a Microsoft Entra application proxy deployment](~/identity/app-proxy/conceptual-deployment-plan.md)
140
+- [Security considerations for accessing apps remotely with Microsoft Entra application proxy](~/identity/app-proxy/application-proxy-security.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:15 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.