Private network connectors
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit b1c0eab · +32 −37 lines · also on GitHub
⋯ 4 unchanged lines
55
ms.author: kenwith
66
manager: dougeby
77
ms.topic: how-to
8
−ms.date: 02/21/2025
8
+ms.date: 09/25/2025
99
ms.service: global-secure-access
1010
ai-usage: ai-assisted
1111
---
1212
13
−# Understand the Microsoft Entra private network connector
13
+# Understand Microsoft Entra private network connector
1414
15
−Connectors are what make Microsoft Entra Private Access and application proxy possible. They're simple, easy to deploy and maintain, and super powerful. This article discusses what connectors are, how they work, and some suggestions for how to optimize your deployment.
15
+Connectors make Microsoft Entra Private Access and Application Proxy possible. They're simple to deploy and maintain, and powerful. This article explains what connectors are, how they work, and how to optimize your deployment.
1616
1717
## What is a private network connector?
1818
19
−Connectors are lightweight agents that sit in a private network and facilitate the outbound connection to the Microsoft Entra Private Access and application proxy services. Connectors must be installed on a Windows Server that has access to the backend resources. You can organize connectors into connector groups, with each group handling traffic to specific resources. For more information on application proxy and a diagrammatic representation of application proxy architecture, see [Using Microsoft Entra application proxy to publish on-premises apps for remote users](../identity/app-proxy/overview-what-is-app-proxy.md).
20
−
21
−
22
−To learn how to configure the Microsoft Entra private network connector, see [How to configure private network connectors for Microsoft Entra Private Access](how-to-configure-connectors.md).
23
−
24
−Private network connectors are lightweight agents deployed on-premises that facilitate the outbound connection to the application proxy service in the cloud. The connectors must be installed on a Windows Server that has access to the backend application. Users connect to the application proxy cloud service that routes their traffic to the apps via the connectors.
19
+Private network connectors are lightweight agents you install on a Windows Server inside your network. They create outbound connections to Microsoft Entra Private Access and the application proxy service to reach backend resources. Organize connectors into connector groups that handle traffic for specific resources. For an architecture overview, see [Using Microsoft Entra application proxy to publish on-premises apps for remote users](../identity/app-proxy/overview-what-is-app-proxy.md). To set them up, see [How to configure private network connectors for Microsoft Entra Private Access](how-to-configure-connectors.md). Users connect to the cloud service, which routes traffic to apps through the connectors.
2520
26
−Setup and registration between a connector and the application proxy service is accomplished as follows:
21
+Set up and register a connector with the application proxy service:
22
+1. Open outbound ports 80 and 443 and allow access to the required service and Microsoft Entra ID URLs.
23
+1. Sign in to the Microsoft Entra admin center and run the installer on an on-premises Windows Server.
24
+1. Start the connector so it listens to the application proxy service.
25
+1. Add the on-premises application to Microsoft Entra ID and set the user-facing URLs.
2726
28
−1. The IT administrator opens ports 80 and 443 to outbound traffic and allows access to several URLs that are needed by the connector, the application proxy service, and Microsoft Entra ID.
29
−2. The admin signs into the Microsoft Entra admin center and runs an executable to install the connector on an on-premises Windows server.
30
−3. The connector starts to "listen" to the application proxy service.
31
−4. The admin adds the on-premises application to Microsoft Entra ID and configures settings such as the URLs users need to connect to their apps.
27
+Deploy at least two connectors for redundancy and scale. The service and connectors handle high availability, and you can add or remove connectors at any time. Each request routes to an available connector. If a connector is unavailable, it doesn't handle traffic. The service tags unused connectors as inactive and removes them after 10 days of inactivity.
3228
33
−It's recommended that you always deploy multiple connectors for redundancy and scale. The connectors, in conjunction with the service, take care of all the high availability tasks and can be added or removed dynamically. Each time a new request arrives it's routed to one of the connectors that is available. When a connector is running, it remains active as it connects to the service. If a connector is temporarily unavailable, it doesn't respond to this traffic. Unused connectors are tagged as inactive and removed after 10 days of inactivity.
3429
3530
> [!NOTE]
3631
> You can monitor the [version history page](reference-version-history.md) to stay informed on the latest updates so that you can schedule appropriate connector upgrades.
3732
38
−Each private network connector is assigned to a [connector group](concept-connector-groups.md). Connectors in the same connector group act as a single unit for high availability and load balancing. You can create new groups, assign connectors to them in the Microsoft Entra admin center, then assign specific connectors to serve specific applications. It's recommended to have at least two connectors in each connector group for high availability.
33
+Each private network connector belongs to a [connector group](concept-connector-groups.md). Connectors in the same group act as a single unit for high availability and load balancing. Create groups and assign connectors in the Microsoft Entra admin center, then map groups to specific applications. Use at least two connectors in each group for high availability.
3934
40
−Connector groups are useful when you need to support the following scenarios:
35
+Use connector groups for:
4136
4237
* Geographical app publishing
4338
* Application segmentation/isolation
4439
* Publishing web apps running in the cloud or on-premises
4540
46
−For more information about choosing where to install your connectors and optimizing your network, see [Network topology considerations when using Microsoft Entra application proxy](../identity/app-proxy/application-proxy-network-topology.md).
41
+For guidance on where to install connectors and optimize your network, see [Network topology considerations when using Microsoft Entra application proxy](../identity/app-proxy/application-proxy-network-topology.md).
4742
4843
## Maintenance
4944
50
−The connectors and the service take care of all the high availability tasks. They can be added or removed dynamically. New requests are routed to one of the available connectors. If a connector is temporarily unavailable, it doesn't respond to this traffic.
45
+Connectors and the service handle high availability. Add or remove connectors at any time. The service routes new requests to an available connector. If a connector is temporarily unavailable, it doesn't receive traffic.
5146
52
−The connectors are stateless and have no configuration data on the machine. The only data they store is the settings for connecting the service and its authentication certificate. When they connect to the service, they pull all the required configuration data and refresh it every couple of minutes.
47
+Connectors are stateless and store no configuration data on the machine. They store only the settings for connecting to the service and the authentication certificate. When they connect to the service, they pull the required configuration data and refresh it every few minutes.
5348
54
−Connectors also poll the server to find out whether there's a newer version of the connector. If one is found, the connectors update themselves.
49
+Connectors poll the service for updates. When a newer version is available, they update themselves.
5550
56
−You can monitor your connectors from the machine they're running on, using either the event log and performance counters. You can also view their status in the Microsoft Entra admin center. For Microsoft Entra Private Access, navigate to Global Secure Access, Connect, and select Connectors. For application proxy, navigate to Identity, Applications, Enterprise applications, and select the application. On the application page select application proxy.
51
+Monitor connectors on the host machine by using the event log and performance counters. View status in the Microsoft Entra admin center. For Microsoft Entra Private Access: Go to Global Secure Access > Connect > Connectors. For application proxy: Go to Identity > Applications > Enterprise applications, and select the application. On the application page, select application proxy.
5752
58
−You don't have to manually delete connectors that are unused. When a connector is running, it remains active as it connects to the service. Unused connectors are tagged as `_inactive_` and are removed after 10 days of inactivity. If you do want to uninstall a connector, though, uninstall both the Connector service and the Updater service from the server. Restart the computer to fully remove the service.
53
+You don't need to delete unused connectors manually. The service tags inactive connectors `_inactive_` and removes them after 10 days. To uninstall a connector, uninstall both the Connector service and the Updater service, then restart the computer.
5954
60
−## Handling Connector Server Issues
61
−If one or more connector servers become unavailable (e.g., due to a server outage, network outage, or similar issue), follow these steps to maintain service continuity:
55
+## Handling connector server issues
56
+If one or more connector servers are down because of a server, network, or similar outage, follow these steps to maintain continuity:
6257
6358
1. Identify and remove the affected (“bad”) servers from the connector group.
6459
2. Add available healthy servers (“good”) or backup servers into the connector group to restore capacity.
6560
3. Reboot affected servers to drain any pre-existing connections. Existing ongoing connections don’t drain immediately with connector group changes.
6661
67
−This sequence is the recommended approach to ensure service stability and minimize disruption when connector servers encounter issues.
62
+Use this sequence to keep service stable and minimize disruption when connector servers have issues.
6863
6964
## Connector updates
7065
71
−Microsoft Entra ID occasionally provides automatic updates for all the connectors that you deploy. As long as the private network connector updater service is running, your connectors may update with the latest major connector release automatically. If you don’t see the Connector Updater service on your server, you need to reinstall your connector to get updates.
66
+Microsoft Entra ID occasionally provides automatic updates for all the connectors that you deploy. As long as the private network connector updater service is running, your connectors can update to the latest major connector release automatically. If you don’t see the Connector Updater service on your server, you need to reinstall your connector to get updates.
7267
73
−If you don't want to wait for an automatic update to come to your connector, you can do a manual upgrade. Go to the [connector download page](https://download.msappproxy.net/subscription/d3c8b69d-6bf7-42be-a529-3fe9c2e70c90/connector/download) on the server where your connector is located and select **Download**. This process kicks off an upgrade for the local connector. Note that not all updates are scheduled for automatic update. It is recommended that you monitor the [version history page](reference-version-history.md) for information about whether an update is deployed automatically or manually via the Microsoft Entra portal.
68
+If you don't want to wait for an automatic update, do a manual upgrade. Go to the [connector download page](https://download.msappproxy.net/subscription/d3c8b69d-6bf7-42be-a529-3fe9c2e70c90/connector/download) on the server that hosts your connector and select **Download**. This action starts an upgrade for the local connector. Not all releases are scheduled for automatic update. Monitor the [version history page](reference-version-history.md) to see whether an update is deployed automatically or requires a manual deployment in the Microsoft Entra portal.
7469
75
−For tenants with multiple connectors, the automatic updates target one connector at a time in each group to prevent downtime in your environment.
70
+In tenants with multiple connectors, automatic updates target one connector at a time in each group to prevent downtime.
7671
77
−You could experience downtime when your connector updates if:
72
+You might experience downtime during an update if:
7873
79
−- You only have one connector. A second connector and a connector group are recommended to avoid downtime and provide higher availability.
80
−- A connector was in the middle of a transaction when the update began. Although the initial transaction is lost, your browser should automatically retry the operation or you can refresh your page. When the request is resent, the traffic is routed to a backup connector.
74
+- You have only one connector. Add a second connector and a connector group to avoid downtime and provide higher availability.
75
+- The update starts while a connector processes a transaction. The initial transaction is lost, but the browser automatically retries the operation or you can refresh the page. The resent request routes to a backup connector.
8176
82
−To see information about previously released versions and what changes they include, see [Application proxy- Version Release History](reference-version-history.md).
77
+For details about previous versions and their changes, see [Application proxy version release history](reference-version-history.md).
8378
84
−## Creating connector groups
79
+## Create connector groups
8580
86
−Connector groups enable you to assign specific connectors to serve specific applications. You can group many connectors together, and then assign each resource or application to a group.
81
+Connector groups let you assign connectors to specific applications. Group connectors, then assign each resource or application to a group.
8782
88
−Connector groups make it easier to manage large deployments. They also improve latency for tenants that have resources and applications hosted in different regions, because you can create location-based connector groups to serve only local applications.
83
+Connector groups simplify management of large deployments. They can reduce latency for tenants with resources and applications in different regions. Create location-based connector groups to serve only local applications.
8984
90
−To learn more about connector groups, see [Understand Microsoft Entra private network connector groups](concept-connector-groups.md).
85
+Learn more in [Understand Microsoft Entra private network connector groups](concept-connector-groups.md).
9186
9287
## Security and networking
9388
⋯ 116 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:37 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.