Entra Connect Health agent requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit e3ffe05 · +2 −1 lines · also on GitHub
⋯ 4 unchanged lines
55
ms.author: jomondi
66
ms.subservice: hybrid-connect
77
ms.tgt_pltfrm: na
8
−ms.date: 05/15/2026
8
+ms.date: 05/26/2026
99
ms.topic: how-to
1010
ms.custom: sfi-ga-nochange, msecd-doc-authoring-1012
1111
#customer intent: As an identity administrator, I want to install the Microsoft Entra Connect Health agents on my on-premises servers so that I can monitor the health of my hybrid identity infrastructure (AD FS, sync, and AD DS) from the Microsoft Entra admin center.
⋯ 16 unchanged lines
2828
| You have a Microsoft Entra ID P1 or P2 subscription. |Microsoft Entra Connect Health is a feature of Microsoft Entra ID P1 or P2. For more information, see [Sign up for Microsoft Entra ID P1 or P2](~/fundamentals/get-started-premium.md). <br /><br />To start a free 30-day trial, see [Start a trial](https://azure.microsoft.com/trial/get-started-active-directory/). |
2929
| You're either a [Global Administrator](../../role-based-access-control/permissions-reference.md#global-administrator) or a [Hybrid Identity Administrator](../../role-based-access-control/permissions-reference.md#hybrid-identity-administrator) in Microsoft Entra ID. | By using Azure role-based access control (Azure RBAC), you can allow other users in your organization to access Microsoft Entra Connect Health. For more information, see [Azure RBAC for Microsoft Entra Connect Health](how-to-connect-health-operations.md#manage-access-with-azure-rbac). <br /><br />**Important**: Use a work or school account to install the agents. You can't use a Microsoft account to install the agents. For more information, see [Sign up for Azure as an organization](~/fundamentals/sign-up-organization.md). |
3030
| The Microsoft Entra Connect Health agent is installed on each targeted server. | Health agents must be installed and configured on targeted servers so that they can receive data and provide monitoring and analytics capabilities. <br /><br />For example, to get data from your Active Directory Federation Services (AD FS) infrastructure, you must install the agent on the AD FS server and on the Web Application Proxy server. Similarly, to get data from your on-premises AD Domain Services infrastructure, you must install the agent on the domain controllers. |
31
+| The agent is installed on a supported Windows Server version. | The Microsoft Entra Connect Health agent is supported on Windows Server 2016, 2019, 2022, and 2025. |
3132
| The Azure service endpoints have outbound connectivity. | During installation and runtime, the agent requires connectivity to Microsoft Entra Connect Health service endpoints. If firewalls block outbound connectivity, add the [outbound connectivity endpoints](#outbound-connectivity-to-azure-service-endpoints) to an allowlist. |
3233
|Outbound connectivity is based on IP addresses. | For information about firewall filtering based on IP addresses, see [Azure IP ranges](https://www.microsoft.com/download/details.aspx?id=56519).|
3334
| TLS inspection for outbound traffic is filtered or disabled. | The agent registration step or data upload operations might fail if there's TLS inspection or termination for outbound traffic at the network layer. For more information, see [Set up TLS inspection](/previous-versions/tn-archive/ee796230(v=technet.10)). |
⋯ 269 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:20 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.