Private Access sensor network requirements

This page's changes and edits · All guidance changes

Microsoft's edit · 4 Jun 22:49 UTC

Address review: full URL table and concrete sensor proxy config

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 90cae92 · +32 −7 lines · also on GitHub

⋯ 21 unchanged lines

2222 - A client machine that runs at least Windows 10 and is a Microsoft Entra joined or hybrid joined device. The client machine must also have line of sight to the private resources and DC (user is in a corporate network and accessing on-premises resources). The user identity used for joining the device and accessing these resources must be created in Active Directory (AD) and synced to Microsoft Entra ID using Microsoft Entra Connect.

2323 - The latest Microsoft Entra Private network connector is installed and has a line of sight to the DC.

2424 - Open inbound Transmission Control Protocol (TCP) port `1337` in the Windows Firewall on the DCs.

25 −- Allow the required outbound network connectivity for the Private Access Sensor. Outbound access to `*.msappproxy.net:443` alone isn't sufficient. For the full set of URLs and ports, see [Network requirements](#network-requirements).

25 +- Allow the outbound network connectivity required by the Private Access Sensor. For the required URLs and ports, see [Network requirements](#network-requirements).

2626 - The Service Principal Names (SPNs) of the private apps you want to protect. You add these SPNs in the policy for Private Access Sensors that are installed on the DCs.

2727 > [!NOTE]

2828 > The SPNs are *case insensitive* and should be an *exact match* or a wildcard in the format `<serviceclass>/*` such as `cifs/*`.

⋯ 11 unchanged lines

4040

4141 ## Network requirements

4242

43 −The Private Access Sensor communicates with the same Microsoft Entra cloud service as the Microsoft Entra private network connector, so it requires the same outbound network connectivity. Allowing outbound access to `*.msappproxy.net:443` alone isn't sufficient. Configure the sensor's outbound connectivity by using the same network requirements documented for the connector, including:

43 +The Private Access Sensor communicates with the same Microsoft Entra cloud service as the Microsoft Entra private network connector, so it requires the same outbound network connectivity. Allow outbound access to the following URLs:

4444

45 −- The service communication channel: `*.msappproxy.net` and `*.servicebus.windows.net` on 443/HTTPS.

46 −- Authentication and registration endpoints, such as `login.windows.net`, `*.microsoftonline.com`, `*.msauth.net`, and `*.msftauth.net` on 443/HTTPS.

47 −- Certificate-validation endpoints (Certificate Revocation List and Online Certificate Status Protocol), such as `crl3.digicert.com`, `ocsp.digicert.com`, and `oneocsp.microsoft.com` on 80/HTTP.

45 +| URL | Port | How it's used |

46 +| --- | --- | --- |

47 +| `*.msappproxy.net` `*.servicebus.windows.net` | 443/HTTPS | Communication between the sensor and the Microsoft Entra cloud service. |

48 +| `crl3.digicert.com` `crl4.digicert.com` `ocsp.digicert.com` `crl.microsoft.com` `oneocsp.microsoft.com` `ocsp.msocsp.com` | 80/HTTP | The sensor uses these URLs to verify certificates. |

49 +| `login.windows.net` `secure.aadcdn.microsoftonline-p.com` `*.microsoftonline.com` `*.microsoftonline-p.com` `*.msauth.net` `*.msauthimages.net` `*.msecnd.net` `*.msftauth.net` `*.msftauthimages.net` `*.phonefactor.net` `enterpriseregistration.windows.net` `management.azure.com` `ctldl.windowsupdate.com` `www.microsoft.com/pkiops` | 443/HTTPS | The sensor uses these URLs during and beyond the registration process. |

50 +| `ctldl.windowsupdate.com` `www.microsoft.com/pkiops` | 80/HTTP | The sensor uses these URLs during and beyond the registration process. |

4851

49 −For the complete, authoritative list of URLs and ports, see [Allow access to URLs](how-to-configure-connectors.md#allow-access-to-urls) and [Open ports](how-to-configure-connectors.md#open-ports).

52 +If your firewall or proxy lets you configure access rules based on domain suffixes, you can allow connections to `*.msappproxy.net`, `*.servicebus.windows.net`, and the other URLs in the table. If not, allow access to the [Azure IP ranges and Service Tags - Public Cloud](https://www.microsoft.com/download/details.aspx?id=56519), which are updated weekly.

5053

54 +These requirements match the Microsoft Entra private network connector. For the source tables, see [Allow access to URLs](how-to-configure-connectors.md#allow-access-to-urls) and [Open ports](how-to-configure-connectors.md#open-ports).

55 +

56 +> [!IMPORTANT]

57 +> Avoid all forms of inline inspection and termination on outbound TLS communications between the Private Access Sensor and the Microsoft Entra cloud service.

58 +

5159 ### Outbound proxy support

5260

53 −If your environment routes outbound traffic through a proxy server, the Private Access Sensor supports communicating with the Microsoft Entra cloud service through an outbound proxy, the same as the Microsoft Entra private network connector. Proxy authentication isn't supported, so allow the sensor anonymous access to the required destinations. For the connector proxy scenarios and the network requirements that also apply to the sensor, see [Work with existing on-premises proxy servers](~/identity/app-proxy/application-proxy-configure-connectors-with-proxy-servers.md).

61 +If your environment routes outbound traffic through a proxy server, the Private Access Sensor can communicate with the Microsoft Entra cloud service through an outbound proxy, the same as the Microsoft Entra private network connector.

62 +

63 +To route the sensor's traffic through an outbound proxy:

64 +

65 +1. On the domain controller, open the `C:\Program Files\Private Access Sensor\bin\PaSensorServices.exe.config` file.

66 +1. Inside the `<configuration>` element, add the following `system.net` section. Replace `proxyserver:8080` with your proxy server name or IP address and port. Include the `http://` prefix even when you use an IP address.

67 +

68 + ```xml

69 + <system.net>

70 + <defaultProxy>

71 + <proxy proxyaddress="http://proxyserver:8080" bypassonlocal="True" usesystemdefault="True" />

72 + </defaultProxy>

73 + </system.net>

74 + ```

75 +

76 +1. Save the file, and then restart the Private Access Sensor service.

77 +

78 +Proxy authentication isn't supported, so allow the sensor anonymous access to the required destinations. For more about the outbound proxy scenarios, see [Work with existing on-premises proxy servers](~/identity/app-proxy/application-proxy-configure-connectors-with-proxy-servers.md).

5479

5580 ## Configuration steps

5681

⋯ 231 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:01 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.