Private network connector firewall requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit f514c51 · +8 −8 lines · also on GitHub
⋯ 1 unchanged line
22
title: How to configure connectors for Microsoft Entra Private Access
33
description: Learn how to configure Microsoft Entra private network connectors for Microsoft Entra Private Access.
44
ms.topic: how-to
5
−ms.date: 02/09/2026
5
+ms.date: 03/16/2026
66
ms.subservice: entra-private-access
77
ms.reviewer: katabish
88
ai-usage: ai-assisted
⋯ 8 unchanged lines
1717
To add private resources and applications to Microsoft Entra ID, you need:
1818
1919
* The product requires a license. To learn more about licensing, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
20
−* An Application Administrator account.
20
+* An account with the Application Administrator role.
2121
22
−User identities must be synchronized from an on-premises directory or created directly within your Microsoft Entra tenant. Identity synchronization allows Microsoft Entra ID to pre-authenticate users before granting them access to application proxy published applications and to have the necessary user identifier information to perform single sign-on (SSO).
22
+Synchronize user identities from an on-premises directory or create them directly within your Microsoft Entra tenant. Identity synchronization allows Microsoft Entra ID to pre-authenticate users before granting them access to application proxy published applications and to have the necessary user identifier information to perform single sign-on (SSO).
2323
24
−### Windows server
24
+### Windows Server
2525
2626
The Microsoft Entra private network connector requires a server running Windows Server 2016 or later. You'll install the private network connector on the server. This connector server needs to connect to the Microsoft Entra Private Access service or application proxy service and the private resources or applications that you plan to publish.
2727
⋯ 5 unchanged lines
3333
> [!IMPORTANT]
3434
> When using the connector to access web applications published via Microsoft Entra application proxy, `HTTP/2` must be disabled on the server hosting the Microsoft Entra private network connector running on Windows Server 2019 or later. This configuration change isn't required when using the connector only with Global Secure Access Private Access.
3535
>
36
−> Disable `HTTP2` protocol support in `WinHttp` for web applications published via Microsoft Entra application proxy to work properly. `HTTP/2` is disabled by default in earlier versions of supported operating systems. Adding the following registry key and restarting the server disables `HTTP/2` on Windows Server 2019 and later. This is a machine-wide registry key.
36
+> Disable `HTTP/2` protocol support in `WinHttp` for web applications published via Microsoft Entra application proxy to work properly. `HTTP/2` is disabled by default in earlier versions of supported operating systems. Adding the following registry key and restarting the server disables `HTTP/2` on Windows Server 2019 and later. This is a machine-wide registry key.
3737
>
3838
> ```
3939
> Windows Registry Editor Version 5.00
⋯ 62 unchanged lines
102102
1. Restart the server.
103103
104104
> [!NOTE]
105
−> Microsoft is updating Azure services to use TLS certificates from a different set of Root Certificate Authorities (CAs). This change is being made because the current CA certificates do not comply with one of the CA/Browser Forum Baseline requirements. For more information, see [Azure TLS certificate changes](/azure/security/fundamentals/tls-certificate-changes).
105
+> Microsoft is updating Azure services to use TLS certificates from a different set of Root Certificate Authorities (CAs). This change is being made because the current CA certificates don't comply with one of the CA/Browser Forum Baseline requirements. For more information, see [Azure TLS certificate changes](/azure/security/fundamentals/tls-certificate-changes).
106106
107107
#### Recommendations for the connector server
108108
⋯ 44 unchanged lines
153153
> The minimum version of connector required for Private Access is **1.5.3417.0**.
154154
> Starting from version 1.5.3437.0, .NET version 4.7.1 or later is required for successful installation or upgrade.
155155
156
−> [!Note]
157
−> **Deploy private network connector for your Azure, AWS, and GCP workloads from their respective marketplaces (Preview)**
156
+> [!NOTE]
157
+> **Deploy private network connectorfor your Azure, AWS, and GCP workloads from their respective marketplaces (Preview)**
158158
>
159159
> The Private Network Connector is now available on [Azure Marketplace](https://azuremarketplace.microsoft.com/marketplace/apps/microsoftcorporation1687208452115.entraprivatenetworkconnector?tab=overview), [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-cgpbjiaphamuc), and [GCP Marketplace](https://console.cloud.google.com/marketplace/product/ciem-entra/entraprivatenetworkconnector) (in preview), in addition to the [Microsoft Entra admin center](https://entra.microsoft.com). Marketplace offerings allow users to deploy a Windows virtual machine with a pre-installed private network connector through a simplified deployment model. The process automates installation and registration.
160160
⋯ 104 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:51 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.