Private network connector firewall requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit c200041 · +24 −1 lines · also on GitHub
⋯ 1 unchanged line
22
title: How to configure connectors for Microsoft Entra Private Access
33
description: Learn how to configure Microsoft Entra private network connectors for Microsoft Entra Private Access.
44
ms.topic: how-to
5
−ms.date: 02/04/2026
5
+ms.date: 02/09/2026
66
ms.subservice: entra-private-access
77
ms.reviewer: katabish
88
ai-usage: ai-assisted
⋯ 221 unchanged lines
230230
231231
To learn more about connector groups, see [Understand Microsoft Entra private network connector groups](concept-connector-groups.md).
232232
233
+## Minimizing impact during connector server maintenance
234
+When performing maintenance (such as patching or reboots) on private network connector servers, you can minimize interruption to user connections by using a dedicated maintenance connector group. By temporarily moving a connector into this group, you ensure that no new traffic is routed to it while allowing existing sessions to complete gracefully.
235
+
236
+Connectors in Microsoft Entra Private Access are stateless agents that the service routes traffic through based on group assignments and availability. If a connector is unavailable, the service automatically directs new requests to other healthy connectors in the group.
237
+
238
+### Maintenance steps
239
+1. Create a maintenance connector group
240
+ - In the Microsoft Entra admin center, create a new connector group that is not assigned to any Private Access application.
241
+ - This group acts as a “parking spot” for maintenance.
242
+1. Move the connector into the maintenance connector group
243
+ - When you are ready to service a connector server, edit its assignment and move it into the maintenance connector group with a test private access app where there is no active traffic. Requests can be sent to validate end to end connectivity post-patching before moving back to production connector group.
244
+ - Once moved to a maintenance connector group the connector no longer receives new user connections and any existing connections continue until they gracefully finish.
245
+
246
+1. Drain existing sessions
247
+ - Wait an appropriate period to allow active connections to complete normally. The duration depends on your application workloads and session patterns.
248
+
249
+1. Perform maintenance
250
+ - Apply patches, reboots, or other updates required on the server.
251
+ - Ensure that the Microsoft Entra Private Network Connector services restart and are healthy before reintroducing the connector into production.
252
+
253
+1. Return the connector to its original group
254
+ - Once maintenance is complete and services are running, move the connector back into its original connector group.
255
+ - The connector will again start receiving traffic as part of that group’s high-availability pool.
233256
234257
235258
## Next steps
⋯ 5 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:51 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.