Private Access sensor network requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit bd30994 · +16 −2 lines · also on GitHub
⋯ 1 unchanged line
22
title: Configure Microsoft Entra Private Access for Active Directory Domain Controllers
33
description: "Enforce Conditional Access and multifactor authentication for Kerberos authentication to Active Directory Domain Controllers through Microsoft Entra Private Access."
44
ms.topic: how-to
5
−ms.date: 03/25/2026
5
+ms.date: 06/04/2026
66
ms.subservice: entra-private-access
77
ms.reviewer: shkhalid
88
ai-usage: ai-assisted
⋯ 13 unchanged lines
2222
- A client machine that runs at least Windows 10 and is a Microsoft Entra joined or hybrid joined device. The client machine must also have line of sight to the private resources and DC (user is in a corporate network and accessing on-premises resources). The user identity used for joining the device and accessing these resources must be created in Active Directory (AD) and synced to Microsoft Entra ID using Microsoft Entra Connect.
2323
- The latest Microsoft Entra Private network connector is installed and has a line of sight to the DC.
2424
- Open inbound Transmission Control Protocol (TCP) port `1337` in the Windows Firewall on the DCs.
25
−- Ensure your firewall or proxy allows outbound connections to the wildcard domain suffix `*.msappproxy.net:443`. Private Access Sensor uses this secure channel to register and fetch policies from the Microsoft Entra cloud service.
25
+- Allow the required outbound network connectivity for the Private Access Sensor. Outbound access to `*.msappproxy.net:443` alone isn't sufficient. For the full set of URLs and ports, see [Network requirements](#network-requirements).
2626
- The Service Principal Names (SPNs) of the private apps you want to protect. You add these SPNs in the policy for Private Access Sensors that are installed on the DCs.
2727
> [!NOTE]
2828
> The SPNs are *case insensitive* and should be an *exact match* or a wildcard in the format `<serviceclass>/*` such as `cifs/*`.
⋯ 8 unchanged lines
3737
> [Auditing and restricting NTLM usage guide | Microsoft Learn](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/jj865674(v=ws.10))
3838
> [Using security policies to restrict NTLM traffic | Microsoft Learn](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/jj865668(v=ws.10))
3939
40
+
41
+## Network requirements
42
+
43
+The Private Access Sensor communicates with the same Microsoft Entra cloud service as the Microsoft Entra private network connector, so it requires the same outbound network connectivity. Allowing outbound access to `*.msappproxy.net:443` alone isn't sufficient. Configure the sensor's outbound connectivity by using the same network requirements documented for the connector, including:
44
+
45
+- The service communication channel: `*.msappproxy.net` and `*.servicebus.windows.net` on 443/HTTPS.
46
+- Authentication and registration endpoints, such as `login.windows.net`, `*.microsoftonline.com`, `*.msauth.net`, and `*.msftauth.net` on 443/HTTPS.
47
+- Certificate-validation endpoints (Certificate Revocation List and Online Certificate Status Protocol), such as `crl3.digicert.com`, `ocsp.digicert.com`, and `oneocsp.microsoft.com` on 80/HTTP.
48
+
49
+For the complete, authoritative list of URLs and ports, see [Allow access to URLs](how-to-configure-connectors.md#allow-access-to-urls) and [Open ports](how-to-configure-connectors.md#open-ports).
50
+
51
+### Outbound proxy support
52
+
53
+If your environment routes outbound traffic through a proxy server, the Private Access Sensor supports communicating with the Microsoft Entra cloud service through an outbound proxy, the same as the Microsoft Entra private network connector. Proxy authentication isn't supported, so allow the sensor anonymous access to the required destinations. For the connector proxy scenarios and the network requirements that also apply to the sensor, see [Work with existing on-premises proxy servers](~/identity/app-proxy/application-proxy-configure-connectors-with-proxy-servers.md).
4054
4155
## Configuration steps
4256
⋯ 231 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:01 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.