Private network connectors

This page's changes and edits · All guidance changes

Microsoft's edit · 21 Oct 2025 00:03 UTC

edit pass: private-network-connectors

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 30f69a7 · +9 −9 lines · also on GitHub

⋯ 90 unchanged lines

9191

9292 ## Connector updates

9393

94 −Microsoft Entra ID occasionally provides automatic updates for all the connectors that you deploy. Connectors poll the updater service for updates. When a newer version is available, they update themselves.

94 +Microsoft Entra ID occasionally provides automatic updates for all the connectors that you deploy. Connectors poll the updater service for updates. When a newer version is available, the connectors update themselves.

9595

9696 As long as the updater service is running, your connectors can update to the latest major connector release automatically. If you don't see the updater service on your server, you need to reinstall your connector to get updates.

9797

9898 If you don't want to wait for an automatic update, do a manual update. On the server that hosts your connector, go to the [connector download page](https://download.msappproxy.net/subscription/d3c8b69d-6bf7-42be-a529-3fe9c2e70c90/connector/download) and select **Download**. This action starts an update for the local connector.

9999

100 −Not all releases are scheduled for automatic update. Monitor the [version history page](reference-version-history.md) to see whether an update is deployed automatically or requires a manual deployment in the Microsoft Entra portal.

100 +Not all releases are scheduled for automatic updates. Monitor the [version history page](reference-version-history.md) to see whether an update is deployed automatically or requires a manual deployment in the Microsoft Entra portal.

101101

102102 In tenants that have multiple connectors, automatic updates target one connector at a time in each group to prevent downtime. You might experience downtime during an update if:

103103

⋯ 26 unchanged lines

130130

131131 - **Online service**: Slow or high-latency connections to the Microsoft Entra service influence the connector performance. For the best performance, connect your organization to Microsoft through Azure ExpressRoute. Otherwise, have your networking team ensure that connections to Microsoft are handled as efficiently as possible.

132132 - **Back-end applications**: In some cases, there are extra proxies between the connector and the back-end resources and applications that can slow or prevent connections. To troubleshoot this scenario, open a browser from the connector server and try to access the application or resource. If you run the connectors in cloud but the applications are on-premises, the experience might not be what your users expect.

133 −- **Domain controllers**: If the connectors perform single sign-on (SSO) by using Kerberos constrained delegation, they contact the domain controllers before sending the request to the back end. The connectors have a cache of Kerberos tickets, but the responsiveness of the domain controllers can affect performance in a busy environment. This issue is more common for connectors that run in Azure but communicate with domain controllers that are on-premises.

133 +- **Domain controllers**: If the connectors perform single sign-on (SSO) by using [Kerberos](https://web.mit.edu/kerberos) constrained delegation (KCD), they contact the domain controllers before sending the request to the back end. The connectors have a cache of Kerberos tickets, but the responsiveness of the domain controllers can affect performance in a busy environment. This issue is more common for connectors that run in Azure but communicate with domain controllers that are on-premises.

134134

135135 For guidance on where to install connectors and how to optimize your network, see [Optimize traffic flow with Microsoft Entra application proxy](../identity/app-proxy/application-proxy-network-topology.md).

136136

137 −## Expanding ephemeral port range

137 +## Expanding the ephemeral port range

138138

139139 Private network connectors initiate TCP and UDP connections to designated destination endpoints. These connections require available source ports on the connector host machine. Expanding the ephemeral port range can improve the availability of source ports, particularly when you're managing a high volume of concurrent connections.

140140

⋯ 22 unchanged lines

163163

164164 Keep peak CPU and memory utilization per connector under 70%. If sustained utilization exceeds 70%, add connectors to the group or scale up host capacity to distribute load. Monitor with Windows performance counters to validate that utilization returns to an acceptable range.

165165

166 −You can expect up to about 1.5-Gbps aggregate TCP throughput (combined inbound and outbound) per connector on an Azure VM sized at four vCPUs and 8 GiB of RAM with standard networking. You can achieve higher throughput by using larger VM sizes (more vCPUs, more memory, and accelerated or high-bandwidth NICs), or by adding more connectors in the same group to scale out.

166 +You can expect up to 1.5-Gbps aggregate TCP throughput (combined inbound and outbound) per connector on an Azure VM sized at four vCPUs and 8 GiB of RAM with standard networking. You can achieve higher throughput by using larger VM sizes (more vCPUs, more memory, and accelerated or high-bandwidth NICs), or by adding more connectors in the same group to scale out.

167167

168168 We derived this performance guidance from controlled lab tests that used iPerf3 TCP data streams in a dedicated test tenant. Actual throughput can vary based on:

169169

⋯ 16 unchanged lines

186186

187187 ## Domain joining

188188

189 −Connectors can run on a machine that isn't domain joined. However, if you want SSO to applications that use integrated Windows authentication, you need a domain-joined machine. In this case, the connector machines must be joined to a domain that can perform [Kerberos](https://web.mit.edu/kerberos) constrained delegation on behalf of the users for the published applications.

189 +Connectors can run on a machine that isn't domain joined. However, if you want SSO to applications that use integrated Windows authentication, you need a domain-joined machine. In this case, the connector machines must be joined to a domain that can perform KCD on behalf of the users for the published applications.

190190

191 −You can also joint connectors to:

191 +You can also join connectors to:

192192

193193 - Domains in forests that have a partial trust.

194194 - Read-only domain controllers.

⋯ 37 unchanged lines

232232

233233 ## Related content

234234

235 −- [Understand Microsoft Entra private network connector groups](concept-connector-groups.md)

235 +- [Microsoft Entra private network connector groups](concept-connector-groups.md)

236236 - [Troubleshoot application proxy and connector errors](../identity/app-proxy/application-proxy-troubleshoot.md)

237 −- [How to silently install the Microsoft Entra private network connector](how-to-register-connector-powershell.md)

237 +- [Create an unattended installation script for the Microsoft Entra private network connector](how-to-register-connector-powershell.md)

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:51 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.