Private network connectors

This page's changes and edits · All guidance changes

Microsoft's edit · 20 Oct 2025 19:10 UTC

edit pass: private-network-connectors

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 8af1f97 · +21 ~~−22~~ lines · also on GitHub

⋯ 42 unchanged lines

4343 - Application segmentation and isolation.

4444 - Publishing web apps running in the cloud or on-premises.

4545

46 −Connector groups simplify management of large deployments. They can reduce latency for tenants with resources and applications in different regions. Create location-based connector groups to serve only local applications.

46 +Connector groups simplify management of large deployments. They can reduce latency for tenants that have resources and applications in different regions. Create location-based connector groups to serve only local applications.

4747

4848 Learn more in [Microsoft Entra private network connector groups](concept-connector-groups.md).

4949

⋯ 5 unchanged lines

5555

5656 ### Connector status

5757

58 −You can view status of connectors in the Microsoft Entra admin center:

58 +You can view the status of connectors in the Microsoft Entra admin center:

5959

6060 - For Private Access: Go to **Global Secure Access** > **Connect** > **Connectors**.

6161 - For application proxy: Go to **Identity** > **Applications** > **Enterprise applications**, and then select the application. On the application page, select **Application proxy**.

⋯ 29 unchanged lines

9191

9292 ## Connector updates

9393

94 −Microsoft Entra ID occasionally provides automatic updates for all the connectors that you deploy. Connectors poll the connector updater service for updates. When a newer version is available, they update themselves.

94 +Microsoft Entra ID occasionally provides automatic updates for all the connectors that you deploy. Connectors poll the updater service for updates. When a newer version is available, they update themselves.

9595

96 −As long as the private network connector updater service is running, your connectors can update to the latest major connector release automatically. If you don't see the updater service on your server, you need to reinstall your connector to get updates.

96 +As long as the updater service is running, your connectors can update to the latest major connector release automatically. If you don't see the updater service on your server, you need to reinstall your connector to get updates.

9797

9898 If you don't want to wait for an automatic update, do a manual update. On the server that hosts your connector, go to the [connector download page](https://download.msappproxy.net/subscription/d3c8b69d-6bf7-42be-a529-3fe9c2e70c90/connector/download) and select **Download**. This action starts an update for the local connector.

9999

100100 Not all releases are scheduled for automatic update. Monitor the [version history page](reference-version-history.md) to see whether an update is deployed automatically or requires a manual deployment in the Microsoft Entra portal.

101101

102 −In tenants with multiple connectors, automatic updates target one connector at a time in each group to prevent downtime. You might experience downtime during an update if:

102 +In tenants that have multiple connectors, automatic updates target one connector at a time in each group to prevent downtime. You might experience downtime during an update if:

103103

104104 - You have only one connector. To avoid downtime and provide higher availability, add a second connector and a connector group.

105 −- The update starts while a connector processes a transaction. The initial transaction is lost, but the browser automatically retries the operation or you can refresh the page. The re-sent request is routed to a backup connector.

105 +- The update starts while a connector processes a transaction. The initial transaction is lost, but the browser automatically retries the operation, or you can refresh the page. The re-sent request is routed to a backup connector.

106106

107107 For details about previous versions and their changes, see [Microsoft Entra private network connector: Version release history](reference-version-history.md).

108108

⋯ 9 unchanged lines

118118

119119 Scale for the Private Access and application proxy services is transparent, but scale is a factor for connectors. You need to have enough connectors to handle peak traffic.

120120

121 −Connectors are stateless, and the number of users or sessions don't affect them. Instead, they respond to the number of requests and their payload size. With standard web traffic, an average machine can handle 2,000 requests per second. The specific capacity depends on the exact machine characteristics.

121 +Connectors are stateless, and the number of users or sessions doesn't affect them. Instead, they respond to the number of requests and the payload size. With standard web traffic, an average machine can handle 2,000 requests per second. The specific capacity depends on the exact machine characteristics.

122122

123123 CPU and the network define connector performance. CPU performance is needed for TLS encryption and decryption, whereas networking is important to get fast connectivity to the applications and the online service.

124124

⋯ 33 unchanged lines

158158

159159 We recommend the following specifications for each Microsoft Entra private network connector:

160160

161 −- **Memory**: 8 GiB or more

162 −- **CPU**: 4 CPU cores or more

161 +- **Memory**: 8 GiB or more.

162 +- **CPU**: 4 CPU cores or more.

163163

164164 Keep peak CPU and memory utilization per connector under 70%. If sustained utilization exceeds 70%, add connectors to the group or scale up host capacity to distribute load. Monitor with Windows performance counters to validate that utilization returns to an acceptable range.

165165

⋯ 1 unchanged line

167167

168168 We derived this performance guidance from controlled lab tests that used iPerf3 TCP data streams in a dedicated test tenant. Actual throughput can vary based on:

169169

170 −- CPU generation

171 −- NIC capabilities (accelerated networking, offloads)

172 −- TLS cipher suites

173 −- Network latency and jitter

174 −- Packet loss

175 −- Concurrent protocol mix (HTTPS, SMB, RDP)

176 −- Intermediate devices (firewalls, IDS/IPS, SSL inspection)

177 −- Back-end application responsiveness

170 +- CPU generation.

171 +- NIC capabilities (accelerated networking, offloads).

172 +- TLS cipher suites.

173 +- Network latency and jitter.

174 +- Packet loss.

175 +- Concurrent protocol mix (HTTPS, SMB, RDP).

176 +- Intermediate devices (firewalls, IDS/IPS, SSL inspection).

177 +- Back-end application responsiveness.

178178

179179 Scenario-based benchmark data (mixed workloads, high-connection concurrency, latency-sensitive applications) will be added to this documentation as it becomes available.

180180

⋯ 5 unchanged lines

186186

187187 ## Domain joining

188188

189 −Connectors can run on a machine that isn't domain joined. However, if you want single sign-on (SSO) to applications that use integrated Windows authentication, you need a domain-joined machine. In this case, the connector machines must be joined to a domain that can perform [Kerberos](https://web.mit.edu/kerberos) constrained delegation on behalf of the users for the published applications.

189 +Connectors can run on a machine that isn't domain joined. However, if you want SSO to applications that use integrated Windows authentication, you need a domain-joined machine. In this case, the connector machines must be joined to a domain that can perform [Kerberos](https://web.mit.edu/kerberos) constrained delegation on behalf of the users for the published applications.

190190

191191 You can also joint connectors to:

192192

193193 - Domains in forests that have a partial trust.

194194 - Read-only domain controllers.

195195

196 −## Connector deployments on hardened environments

196 +## Connector deployments in hardened environments

197197

198198 Usually, connector deployment is straightforward and requires no special configuration. But consider these unique conditions:

199199

⋯ 7 unchanged lines

207207

208208 The certificates are specific to the service. They're created during the initial registration and automatically renewed every couple of months.

209209

210 −After the first successful certificate renewal, the Microsoft Entra private network connector service has no permission to remove the old certificate from the local machine store. If the certificate expires or the service doesn't use it, you can delete it safely.

210 +After the first successful certificate renewal, the connector service has no permission to remove the old certificate from the local machine store. If the certificate expires or the service doesn't use it, you can delete it safely.

211211

212212 To avoid problems with certificate renewal, ensure that the network communication from the connector toward the documented destinations is enabled.

213213

⋯ 4 unchanged lines

218218 Register-MicrosoftEntraPrivateNetworkConnector -EnvironmentName "AzureCloud"

219219 ```

220220

221 −For government, use `-EnvironmentName "AzureUSGovernment"`. For more information, see [Install the agent for the Azure Government cloud](../identity/hybrid/connect/reference-connect-government-cloud.md#install-the-agent-for-the-azure-government-cloud).

221 +For Azure Government, use `-EnvironmentName "AzureUSGovernment"`. For more information, see [Install the agent for the Azure Government cloud](../identity/hybrid/connect/reference-connect-government-cloud.md#install-the-agent-for-the-azure-government-cloud).

222222

223223 To learn how to verify the certificate and troubleshoot problems, see [Troubleshoot problems installing the private network connector](../identity/app-proxy/application-proxy-connector-installation-problem.md).

224224

⋯ 8 unchanged lines

233233 ## Related content

234234

235235 - [Understand Microsoft Entra private network connector groups](concept-connector-groups.md)

236 −- [Work with existing on-premises proxy servers](../identity/app-proxy/application-proxy-configure-connectors-with-proxy-servers.md)

237236 - [Troubleshoot application proxy and connector errors](../identity/app-proxy/application-proxy-troubleshoot.md)

238237 - [How to silently install the Microsoft Entra private network connector](how-to-register-connector-powershell.md)

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:51 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.