Private network connector firewall requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit f93bc40 · +30 −30 lines · also on GitHub
⋯ 9 unchanged lines
1010
---
1111
# How to configure private network connectors for Microsoft Entra Private Access and Microsoft Entra application proxy
1212
13
−Connectors are lightweight agents that sit on a server in a private network and facilitate the outbound connection to the Global Secure Access service. Connectors must be installed on a Windows Server that has access to the backend resources and applications. You can organize connectors into connector groups, with each group handling traffic to specific applications. To learn more about connectors, see [Understand Microsoft Entra private network connectors](concept-connectors.md).
13
+Connectors are lightweight agents that run on a server in a private network and facilitate outbound connections to the Global Secure Access service. Connectors must be installed on a Windows Server that has access to the backend resources and applications. You can organize connectors into connector groups, with each group handling traffic to specific applications. To learn more about connectors, see [Understand Microsoft Entra private network connectors](concept-connectors.md).
1414
1515
## Prerequisites
1616
17
−To add private resources and applications to Microsoft Entra ID you need:
17
+To add private resources and applications to Microsoft Entra ID, you need:
1818
19
−* The product requires a license. To learn more about licensing, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
19
+* The product requires a license. To learn more about licensing, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If needed, you can [purchase licenses or get trial licenses](https://aka.ms/azureadlicense).
2020
* An Application Administrator account.
2121
22
−User identities must be synchronized from an on-premises directory or created directly within your Microsoft Entra tenants. Identity synchronization allows Microsoft Entra ID to pre-authenticate users before granting them access to application proxy published applications and to have the necessary user identifier information to perform single sign-on (SSO).
22
+User identities must be synchronized from an on-premises directory or created directly within your Microsoft Entra tenant. Identity synchronization allows Microsoft Entra ID to pre-authenticate users before granting them access to application proxy published applications and to have the necessary user identifier information to perform single sign-on (SSO).
2323
2424
### Windows server
2525
2626
The Microsoft Entra private network connector requires a server running Windows Server 2016 or later. You'll install the private network connector on the server. This connector server needs to connect to the Microsoft Entra Private Access service or application proxy service and the private resources or applications that you plan to publish.
2727
28
−* For high availability in your environment, we recommend having more than one Windows server.
28
+* For high availability in your environment, consider having more than one Windows server.
2929
* The minimum .NET version required for the connector is v4.7.2+.
30
−* For more information, see [private network connectors](../identity/app-proxy/application-proxy-connectors.md#requirements-and-deployment)
30
+* For more information, see [private network connectors](../identity/app-proxy/application-proxy-connectors.md#requirements-and-deployment).
3131
* For more information, see [Determine which .NET framework versions are installed](/dotnet/framework/migration-guide/how-to-determine-which-versions-are-installed).
3232
3333
> [!IMPORTANT]
34
−> Note: When using the connector to access web applications published via Microsoft Entra application proxy, HTTP/2 must be disabled on the server hosting Microsoft Entra private network connector running on Windows Server 2019 or later. This configuration change is not required when using the Entra private network connector only with Global Secure Access Private Access.
34
+> When using the connector to access web applications published via Microsoft Entra application proxy, HTTP/2 must be disabled on the server hosting the Microsoft Entra private network connector running on Windows Server 2019 or later. This configuration change isn't required when using the connector only with Global Secure Access Private Access.
3535
>
36
−> Disable the `HTTP2` protocol support in the `WinHttp` to enable web application published via Microsoft Entra application proxy properly work. This is disabled by default in earlier versions of supported operating systems. Adding the following registry key and restarting the server disables it on Windows Server 2019 and later. This is a machine-wide registry key.
36
+> Disable `HTTP2` protocol support in `WinHttp` for web applications published via Microsoft Entra application proxy to work properly. HTTP/2 is disabled by default in earlier versions of supported operating systems. Adding the following registry key and restarting the server disables HTTP/2 on Windows Server 2019 and later. This is a machine-wide registry key.
3737
>
3838
> ```
3939
> Windows Registry Editor Version 5.00
⋯ 9 unchanged lines
4949
> ```
5050
5151
> [!WARNING]
52
−> If you've deployed Microsoft Entra Password Protection Proxy, do not install Microsoft Entra application proxy and Microsoft Entra Password Protection Proxy together on the same machine. Microsoft Entra application proxy and Microsoft Entra Password Protection Proxy install different versions of the Microsoft Entra Connect Agent Updater service. These different versions are incompatible when installed together on the same machine.
52
+> If you've deployed Microsoft Entra Password Protection Proxy, don't install Microsoft Entra application proxy and Microsoft Entra Password Protection Proxy together on the same machine. Microsoft Entra application proxy and Microsoft Entra Password Protection Proxy install different versions of the Microsoft Entra Connect Agent Updater service. These different versions are incompatible when installed together.
5353
5454
#### Transport Layer Security (TLS) requirements
5555
⋯ 51 unchanged lines
107107
#### Recommendations for the connector server
108108
109109
- Optimize performance between the connector and the application. Physically locate the connector server close to the application servers. For more information, see [Optimize traffic flow with Microsoft Entra application proxy](../identity/app-proxy/application-proxy-network-topology.md).
110
−- Make sure the connector server and the web application servers are in the same Active Directory domain or span trusting domains. Having the servers in the same domain or trusting domains is a requirement for using single sign-on (SSO) with integrated Windows authentication (IWA) and Kerberos Constrained Delegation (KCD). If the connector server and web application servers are in different Active Directory domains, use resource-based delegation for single sign-on.
110
+- Make sure the connector server and the web application servers are in the same Active Directory domain or span trusting domains. Having the servers in the same domain or trusting domains is required for single sign-on (SSO) with integrated Windows authentication (IWA) and Kerberos Constrained Delegation (KCD). If the connector server and web application servers are in different Active Directory domains, use resource-based delegation for single sign-on.
111111
- Consider [performance and scalability](concept-connectors.md#performance-and-scalability) of your connector deployment, including [extending the TCP and UDP ephemeral ports](concept-connectors.md#expanding-ephemeral-port-range) on your connector server. See [Understand the Microsoft Entra private network connector](concept-connectors.md) for more information.
112112
- Consider creating a [performance baseline](/troubleshoot/windows-server/performance/troubleshoot-performance-problems-in-windows) for your private network connectors.
113113
114114
### Prepare your on-premises environment
115115
116
−Start by enabling communication to Azure data centers to prepare your environment for Microsoft Entra application proxy. If there's a firewall in the path, make sure it's open. An open firewall allows the connector to make HTTPS (TCP) requests to the Application Proxy.
116
+To prepare your environment for Microsoft Entra application proxy, start by enabling communication to Azure data centers. If there's a firewall in the path, make sure it's open. An open firewall allows the connector to make HTTPS (TCP) requests to the Application Proxy.
117117
118118
> [!IMPORTANT]
119
−> If you are installing the connector for Azure Government cloud follow the [prerequisites](../identity/hybrid/connect/reference-connect-government-cloud.md#allow-access-to-urls) and [installation steps](/azure/active-directory/hybrid/connect/reference-connect-government-cloud). This requires enabling access to a different set of URLs and an additional parameter to run the installation.
119
+> If you're installing the connector for Azure Government cloud, follow the [prerequisites](../identity/hybrid/connect/reference-connect-government-cloud.md#allow-access-to-urls) and [installation steps](/azure/active-directory/hybrid/connect/reference-connect-government-cloud). This requires enabling access to a different set of URLs and an additional parameter to run the installation.
120120
121121
#### Open ports
122122
⋯ 27 unchanged lines
150150
To use Private Access, install a connector on each Windows server you're using for Microsoft Entra Private Access. The connector is an agent that manages the outbound connection from the on-premises application servers to Global Secure Access. You can install a connector on servers that also have other authentication agents installed such as Microsoft Entra Connect.
151151
152152
> [!NOTE]
153
−>The minimum version of connector required for Private Access is **1.5.3417.0**.
154
−>Starting from the version 1.5.3437.0, having the .NET version 4.7.1 or greater is required for successful installation (upgrade).
153
+> The minimum version of connector required for Private Access is **1.5.3417.0**.
154
+> Starting from version 1.5.3437.0, .NET version 4.7.1 or later is required for successful installation or upgrade.
155155
156156
> [!Note]
157
−>**Deploy Private Network Connector for Your Azure, AWS, and GCP Workloads from respective Marketplaces (Preview)**
157
+> **Deploy private network connector for your Azure, AWS, and GCP workloads from their respective marketplaces (Preview)**
158158
>
159
−> The Private Network Connector is now available on [Azure Marketplace](https://azuremarketplace.microsoft.com/marketplace/apps/microsoftcorporation1687208452115.entraprivatenetworkconnector?tab=overview), [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-cgpbjiaphamuc), and [GCP Marketplace](https://console.cloud.google.com/marketplace/product/ciem-entra/entraprivatenetworkconnector) (in preview), in addition to the [Microsoft Entra admin center](https://entra.microsoft.com). Marketplace offerings allow users to deploy a windows virtual machine with a pre-installed Private Network Connector through a simplified model. The process automates installation and registration, thus improving ease and efficiency.
159
+> The Private Network Connector is now available on [Azure Marketplace](https://azuremarketplace.microsoft.com/marketplace/apps/microsoftcorporation1687208452115.entraprivatenetworkconnector?tab=overview), [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-cgpbjiaphamuc), and [GCP Marketplace](https://console.cloud.google.com/marketplace/product/ciem-entra/entraprivatenetworkconnector) (in preview), in addition to the [Microsoft Entra admin center](https://entra.microsoft.com). Marketplace offerings allow users to deploy a Windows virtual machine with a pre-installed private network connector through a simplified deployment model. The process automates installation and registration.
160160
161
−**To install the connector from Microsoft Entra admin center**:
161
+**To install the connector from the Microsoft Entra admin center**:
162162
163163
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as an Application Administrator of the directory that uses Application Proxy.
164164
⋯ 6 unchanged lines
171171
1. Read the Terms of Service. When you're ready, select **Accept terms & Download**.
172172
1. At the bottom of the window, select **Run** to install the connector. An install wizard opens.
173173
1. Follow the instructions in the wizard to install the service. When you're prompted to register the connector with the Application Proxy for your Microsoft Entra tenant, provide your Application Administrator credentials.
174
− * For Internet Explorer (IE): If IE Enhanced Security Configuration is set to On, you may not see the registration screen. To get access, follow the instructions in the error message. Make sure that Internet Explorer Enhanced Security Configuration is set to Off.
174
+ * For Internet Explorer (IE): If IE Enhanced Security Configuration is set to On, you might not see the registration screen. To get access, follow the instructions in the error message. Make sure that Internet Explorer Enhanced Security Configuration is set to Off.
175175
176176
## Things to know
177177
⋯ 4 unchanged lines
182182
For information about connectors, capacity planning, and how they stay up-to-date, see [Understand Microsoft Entra private network connectors](concept-connectors.md).
183183
184184
> [!NOTE]
185
−> Microsoft Entra Private Access support for multi-geo connectors is currently in PREVIEW. By default, the cloud service instances for your connector are chosen in the same region as your Microsoft Entra tenant (or the closest region to it) even if you have connectors installed in regions different from your default region. Multi-Geo support lets customers optimize traffic flow by assigning connector groups according to their preferred geo locations instead of relying solely on the tenant's geo location.
185
+> Microsoft Entra Private Access support for multi-geo connectors is currently in PREVIEW. By default, the cloud service instances for your connector are chosen in the same region as your Microsoft Entra tenant (or the closest region to it), even if you have connectors installed in regions different from your default region. Multi-Geo support lets customers optimize traffic flow by assigning connector groups according to their preferred geo locations instead of relying solely on the tenant's geo location.
186186
187187
## Verify the installation and registration
188188
⋯ 6 unchanged lines
195195
To confirm the connector installed and registered correctly:
196196
197197
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as an Application Administrator of the directory that uses Application Proxy.
198
−1. Browse to **Global Secure Access** > **Connect** > **Connectors**
198
+1. Browse to **Global Secure Access** > **Connect** > **Connectors**.
199199
* All of your connectors and connector groups appear on this page.
200200
1. View a connector to verify its details.
201201
* Expand the connector to view the details if it's not already expanded.
⋯ 8 unchanged lines
210210
To confirm the connector installed and registered correctly:
211211
212212
1. Select the **Windows** key and enter `services.msc` to open the Windows Services Manager.
213
−1. Check to see if the status for the following services **Running**.
213
+1. Check to see if the status for the following services is **Running**.
214214
* *Microsoft Entra private network connector* enables connectivity.
215215
* *Microsoft Entra private network connector updater* is an automated update service.
216216
* The updater checks for new versions of the connector and updates the connector as needed.
⋯ 13 unchanged lines
230230
231231
To learn more about connector groups, see [Understand Microsoft Entra private network connector groups](concept-connector-groups.md).
232232
233
−## Minimizing impact during connector server maintenance
233
+## Minimize impact during connector server maintenance
234234
When performing maintenance (such as patching or reboots) on private network connector servers, you can minimize interruption to user connections by using a dedicated maintenance connector group. By temporarily moving a connector into this group, you ensure that no new traffic is routed to it while allowing existing sessions to complete gracefully.
235235
236236
Connectors in Microsoft Entra Private Access are stateless agents that the service routes traffic through based on group assignments and availability. If a connector is unavailable, the service automatically directs new requests to other healthy connectors in the group.
237237
238238
### Maintenance steps
239239
1. Create a maintenance connector group
240
− - In the Microsoft Entra admin center, create a new connector group that is **only** to Private Access test application.
240
+ - In the Microsoft Entra admin center, create a new connector group that is assigned **only** to a Private Access test application.
241241
- This group acts as a “parking spot” for maintenance.
242242
1. Move the connector into the maintenance connector group
243
− - When you are ready to service a connector server, edit its assignment and move it into the maintenance connector group with a test Private Access app where there is no active traffic.
244
− - Once moved to a maintenance connector group the connector no longer receives new user connections and any existing connections continue until they gracefully finish.
243
+ - When you're ready to service a connector server, edit its assignment and move it into the maintenance connector group with a test Private Access app where there's no active traffic.
244
+ - After the connector is moved to the maintenance group, it no longer receives new user connections. Existing connections continue until they finish gracefully.
245245
246246
1. Drain existing sessions
247247
- Wait an appropriate period to allow active connections to complete normally. The duration depends on your application workloads and session patterns.
248248
249249
1. Perform maintenance
250
− - Apply patches, reboots, or other updates required on the server.
251
− - Ensure that the Microsoft Entra Private Network Connector services restart and are healthy before reintroducing the connector into production.
252
− - Post-patching, requests can be sent to the test application to validate end to end connectivity.
250
+ - Apply patches and updates, and reboot the server as needed.
251
+ - Ensure that the Microsoft Entra private network connector services restart and are healthy before returning the connector to production.
252
+ - After patching, send requests to the test application to validate end-to-end connectivity.
253253
254254
1. Return the connector to its original group
255
− - Once maintenance is complete and services are running, move the connector back into its original connector group.
256
− - The connector will again start receiving traffic as part of that group’s high-availability pool.
255
+ - After maintenance is complete and services are running, move the connector back into its original connector group.
256
+ - The connector again receives traffic as part of that group’s high-availability pool.
257257
258258
259259
## Next steps
⋯ 5 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:51 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.