Private network connectors
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit e34f269 · +107 −84 lines · also on GitHub
11
---
2
−title: Understand the Microsoft Entra private network connector
3
−description: Learn how Microsoft Entra private network connectors work and how they're used by Microsoft Entra Private Access and application proxy.
2
+title: Microsoft Entra Private Network Connectors
3
+description: Learn how Microsoft Entra private network connectors work and how Microsoft Entra Private Access and application proxy use them.
44
author: kenwith
55
ms.author: kenwith
66
manager: dougeby
7
−ms.topic: how-to
7
+ms.topic: concept-article
88
ms.date: 09/25/2025
99
ms.service: global-secure-access
1010
ai-usage: ai-assisted
1111
---
1212
13
−# Understand Microsoft Entra private network connector
13
+# Microsoft Entra private network connectors
1414
15
−Connectors make Microsoft Entra Private Access and Application Proxy possible. They're simple to deploy and maintain, and powerful. This article explains what connectors are, how they work, and how to optimize your deployment.
15
+Connectors make Microsoft Entra Private Access and application proxy possible. This article explains what connectors are, how they work, and how to optimize your deployment.
1616
1717
## What is a private network connector?
1818
19
−Private network connectors are lightweight agents you install on a Windows Server inside your network. They create outbound connections to Microsoft Entra Private Access and the application proxy service to reach backend resources. Organize connectors into connector groups that handle traffic for specific resources. For an architecture overview, see [Using Microsoft Entra application proxy to publish on-premises apps for remote users](../identity/app-proxy/overview-what-is-app-proxy.md). To set them up, see [How to configure private network connectors for Microsoft Entra Private Access](how-to-configure-connectors.md). Users connect to the cloud service, which routes traffic to apps through the connectors.
19
+Private network connectors are lightweight agents that you install on Windows Server inside your network. They create outbound connections to the Private Access and application proxy services to reach back-end resources.
2020
21
−Set up and register a connector with the application proxy service:
22
−1. Open outbound ports 80 and 443 and allow access to the required service and Microsoft Entra ID URLs.
23
−1. Sign in to the Microsoft Entra admin center and run the installer on an on-premises Windows Server.
24
−1. Start the connector so it listens to the application proxy service.
25
−1. Add the on-premises application to Microsoft Entra ID and set the user-facing URLs.
21
+Users connect to the cloud service, which routes traffic to apps through the connectors. For an architecture overview, see [Using Microsoft Entra application proxy to publish on-premises apps for remote users](../identity/app-proxy/overview-what-is-app-proxy.md).
2622
27
−Deploy at least two connectors for redundancy and scale. The service and connectors handle high availability, and you can add or remove connectors at any time. Each request routes to an available connector. If a connector is unavailable, it doesn't handle traffic. The service tags unused connectors as inactive and removes them after 10 days of inactivity.
23
+To set up and register a connector with the application proxy service:
2824
29
−> [!NOTE]
30
−> You can monitor the [version history page](reference-version-history.md) to stay informed on the latest updates so that you can schedule appropriate connector upgrades.
25
+1. Open outbound ports 80 and 443, and allow access to the required service and Microsoft Entra ID URLs.
26
+1. Sign in to the Microsoft Entra admin center and run the installer on an on-premises Windows Server machine.
27
+1. Start the connector so that it listens to the application proxy service.
28
+1. Add the on-premises application to Microsoft Entra ID, and set the user-facing URLs.
3129
32
−Each private network connector belongs to a [connector group](concept-connector-groups.md). Connectors in the same group act as a single unit for high availability and load balancing. Create groups and assign connectors in the Microsoft Entra admin center, then map groups to specific applications. Use at least two connectors in each group for high availability.
30
+For more information about setup, see [How to configure private network connectors for Microsoft Entra Private Access and application proxy](how-to-configure-connectors.md).
3331
32
+Connectors and the service handle high availability. You can add or remove connectors at any time.
33
+
34
+## Connector groups
35
+
36
+You can organize connectors into connector groups that handle traffic for specific resources. Connectors in the same group act as a single unit for high availability and load balancing.
37
+
38
+Create groups and assign connectors in the Microsoft Entra admin center, and then map groups to specific applications. Use at least two connectors in each group for high availability.
39
+
3440
Use connector groups for:
3541
36
−* Geographical app publishing
37
−* Application segmentation/isolation
38
−* Publishing web apps running in the cloud or on-premises
42
+- Geographical app publishing.
43
+- Application segmentation and isolation.
44
+- Publishing web apps running in the cloud or on-premises.
3945
40
−For guidance on where to install connectors and optimize your network, see [Network topology considerations when using Microsoft Entra application proxy](../identity/app-proxy/application-proxy-network-topology.md).
46
+Connector groups simplify management of large deployments. They can reduce latency for tenants with resources and applications in different regions. Create location-based connector groups to serve only local applications.
4147
48
+Learn more in [Microsoft Entra private network connector groups](concept-connector-groups.md).
49
+
4250
## Maintenance
4351
44
−Connectors and the service handle high availability. Add or remove connectors at any time. The service routes new requests to an available connector. If a connector is temporarily unavailable, it doesn't receive traffic.
52
+The service routes new requests to an available connector. If a connector is temporarily unavailable, it doesn't receive traffic.
4553
4654
Connectors are stateless and store no configuration data on the machine. They store only the settings for connecting to the service and the authentication certificate. When they connect to the service, they pull the required configuration data and refresh it every few minutes.
4755
48
−Connectors poll the service for updates. When a newer version is available, they update themselves.
56
+Monitor connectors on the host machine by using the event log and performance counters. View status in the Microsoft Entra admin center:
4957
50
−Monitor connectors on the host machine by using the event log and performance counters. View status in the Microsoft Entra admin center. For Microsoft Entra Private Access: Go to Global Secure Access > Connect > Connectors. For application proxy: Go to Identity > Applications > Enterprise applications, and select the application. On the application page, select application proxy.
58
+- For Private Access: Go to **Global Secure Access** > **Connect** > **Connectors**.
59
+- For application proxy: Go to **Identity** > **Applications** > **Enterprise applications**, and then select the application. On the application page, select **Application proxy**.
5160
52
−You don't need to delete unused connectors manually. The service tags inactive connectors `_inactive_` and removes them after 10 days. To uninstall a connector, uninstall both the Connector service and the Updater service, then restart the computer.
61
+You don't need to delete unused connectors manually. The service tags inactive connectors as `_inactive_` and removes them after 10 days. To uninstall a connector, uninstall both the connector service and the updater service, and then restart the computer.
5362
54
−## Handling connector server issues
55
−If one or more connector servers are down because of a server, network, or similar outage, follow these steps to maintain continuity:
56
−
57
−1. Identify and remove the affected ("bad") servers from the connector group.
58
−2. Add available healthy servers ("good") or backup servers into the connector group to restore capacity.
59
−3. Reboot affected servers to drain any preexisting connections. Existing ongoing connections don’t drain immediately with connector group changes.
60
−
61
−Use this sequence to keep service stable and minimize disruption when connector servers have issues.
63
+## Handling connector server problems
6264
63
−## Connector updates
65
+If one or more connector servers are down because of a server, network, or similar outage, follow these steps to maintain continuity:
6466
65
−Microsoft Entra ID occasionally provides automatic updates for all the connectors that you deploy. As long as the private network connector updater service is running, your connectors can update to the latest major connector release automatically. If you don’t see the Connector Updater service on your server, you need to reinstall your connector to get updates.
67
+1. Identify and remove the affected servers from the connector group.
68
+2. Add available healthy servers or backup servers into the connector group to restore capacity.
69
+3. Restart affected servers to drain any preexisting connections. Existing ongoing connections don't drain immediately with connector group changes.
6670
67
−If you don't want to wait for an automatic update, do a manual upgrade. Go to the [connector download page](https://download.msappproxy.net/subscription/d3c8b69d-6bf7-42be-a529-3fe9c2e70c90/connector/download) on the server that hosts your connector and select **Download**. This action starts an upgrade for the local connector. Not all releases are scheduled for automatic update. Monitor the [version history page](reference-version-history.md) to see whether an update is deployed automatically or requires a manual deployment in the Microsoft Entra portal.
71
+Use this sequence to keep the service stable and minimize disruption when connector servers have problems.
6872
69
−In tenants with multiple connectors, automatic updates target one connector at a time in each group to prevent downtime.
73
+## Connector updates
7074
71
−You might experience downtime during an update if:
72
−
73
−- You have only one connector. Add a second connector and a connector group to avoid downtime and provide higher availability.
74
−- The update starts while a connector processes a transaction. The initial transaction is lost, but the browser automatically retries the operation or you can refresh the page. The re-sent request routes to a backup connector.
75
+Microsoft Entra ID occasionally provides automatic updates for all the connectors that you deploy. Connectors poll the connector updater service for updates. When a newer version is available, they update themselves.
7576
76
−For details about previous versions and their changes, see [Application proxy version release history](reference-version-history.md).
77
+As long as the private network connector updater service is running, your connectors can update to the latest major connector release automatically. If you don't see the updater service on your server, you need to reinstall your connector to get updates.
7778
78
−## Create connector groups
79
+If you don't want to wait for an automatic update, do a manual update. On the server that hosts your connector, go to the [connector download page](https://download.msappproxy.net/subscription/d3c8b69d-6bf7-42be-a529-3fe9c2e70c90/connector/download) and select **Download**. This action starts an update for the local connector.
7980
80
−Connector groups let you assign connectors to specific applications. Group connectors, then assign each resource or application to a group.
81
+Not all releases are scheduled for automatic update. Monitor the [version history page](reference-version-history.md) to see whether an update is deployed automatically or requires a manual deployment in the Microsoft Entra portal.
8182
82
−Connector groups simplify management of large deployments. They can reduce latency for tenants with resources and applications in different regions. Create location-based connector groups to serve only local applications.
83
+In tenants with multiple connectors, automatic updates target one connector at a time in each group to prevent downtime. You might experience downtime during an update if:
84
+
85
+- You have only one connector. To avoid downtime and provide higher availability, add a second connector and a connector group.
86
+- The update starts while a connector processes a transaction. The initial transaction is lost, but the browser automatically retries the operation or you can refresh the page. The re-sent request is routeed to a backup connector.
8387
84
−Learn more in [Understand Microsoft Entra private network connector groups](concept-connector-groups.md).
88
+For details about previous versions and their changes, see [Microsoft Entra private network connector: Version release history](reference-version-history.md).
8589
8690
## Security and networking
8791
88
−Connectors can be installed anywhere on the network that allows them to send requests to the Microsoft Entra Private Access and application proxy service. What's important is that the computer running the connector also has access to your apps and resources. You can install connectors inside of your corporate network or on a virtual machine that runs in the cloud. Connectors can run within a perimeter network, also known as a demilitarized zone (DMZ), but it's not necessary because all traffic is outbound so your network stays secure.
92
+Connectors can be installed anywhere on the network that allows them to send requests to the Private Access and application proxy services. What's important is that the computer running the connector also has access to your apps and resources.
8993
90
−Connectors only send outbound requests. The outbound traffic is sent to the service and to the published resources and applications. You don't have to open inbound ports because traffic flows both ways once a session is established. You also don't have to configure inbound access through your firewalls.
94
+You can install connectors inside your corporate network or on a virtual machine (VM) that runs in the cloud. Connectors can run within a perimeter network, but it's not necessary because all traffic is outbound for network security.
9195
92
−For more information about configuring outbound firewall rules, see [Work with existing on-premises proxy servers](../identity/app-proxy/application-proxy-configure-connectors-with-proxy-servers.md).
96
+Connectors only send outbound requests. The outbound traffic is sent to the service and to the published resources and applications. You don't have to open inbound ports because traffic flows both ways after a session is established. You also don't have to configure inbound access through your firewalls.
9397
98
+A common issue is that connectors appear as inactive in a connector group. A firewall blocking the required ports is a common cause for inactive connectors. For more information about configuring outbound firewall rules, see [Work with existing on-premises proxy servers](../identity/app-proxy/application-proxy-configure-connectors-with-proxy-servers.md).
99
+
94100
## Performance and scalability
95101
96
−Scale for Microsoft Entra Private Access and the application proxy services is transparent, but scale is a factor for connectors. You need to have enough connectors to handle peak traffic. Connectors are stateless and the number of users or sessions don't affect them. Instead, they respond to the number of requests and their payload size. With standard web traffic, an average machine can handle 2,000 requests per second. The specific capacity depends on the exact machine characteristics.
102
+Scale for the Private Access and application proxy services is transparent, but scale is a factor for connectors. You need to have enough connectors to handle peak traffic.
97103
98
−CPU and network define connector performance. CPU performance is needed for TLS encryption and decryption, while networking is important to get fast connectivity to the applications and the online service.
104
+Connectors are stateless, and the number of users or sessions don't affect them. Instead, they respond to the number of requests and their payload size. With standard web traffic, an average machine can handle 2,000 requests per second. The specific capacity depends on the exact machine characteristics.
99105
106
+CPU and the network define connector performance. CPU performance is needed for TLS encryption and decryption, whereas networking is important to get fast connectivity to the applications and the online service.
107
+
100108
In contrast, memory is less of an issue for connectors. The online service takes care of much of the processing and all unauthenticated traffic. Everything that can be done in the cloud is done in the cloud.
101109
102110
When connectors or machines are unavailable, traffic goes to another connector in the group. Multiple connectors in a connector group provide resiliency.
103111
104112
Another factor that affects performance is the quality of the networking between the connectors, including:
105113
106
−- **The online service**: Slow or high-latency connections to the Microsoft Entra service influence the connector performance. For the best performance, connect your organization to Microsoft with Express Route. Otherwise, have your networking team ensure that connections to Microsoft are handled as efficiently as possible.
107
−- **The backend applications**: In some cases, there are extra proxies between the connector and the backend resources and applications that can slow or prevent connections. To troubleshoot this scenario, open a browser from the connector server and try to access the application or resource. If you run the connectors in cloud but the applications are on-premises, the experience might not be what your users expect.
108
−- **The domain controllers**: If the connectors perform single sign-on (SSO) using Kerberos Constrained Delegation, they contact the domain controllers before sending the request to the backend. The connectors have a cache of Kerberos tickets, but in a busy environment the responsiveness of the domain controllers can affect performance. This issue is more common for connectors that run in Azure but communicate with domain controllers that are on-premises.
114
+- **Online service**: Slow or high-latency connections to the Microsoft Entra service influence the connector performance. For the best performance, connect your organization to Microsoft through Azure ExpressRoute. Otherwise, have your networking team ensure that connections to Microsoft are handled as efficiently as possible.
115
+- **Back-end applications**: In some cases, there are extra proxies between the connector and the back-end resources and applications that can slow or prevent connections. To troubleshoot this scenario, open a browser from the connector server and try to access the application or resource. If you run the connectors in cloud but the applications are on-premises, the experience might not be what your users expect.
116
+- **Domain controllers**: If the connectors perform single sign-on (SSO) by using Kerberos constrained delegation, they contact the domain controllers before sending the request to the back end. The connectors have a cache of Kerberos tickets, but the responsiveness of the domain controllers can affect performance in a busy environment. This issue is more common for connectors that run in Azure but communicate with domain controllers that are on-premises.
109117
110
−For more information about optimizing your network, see [Network topology considerations when using Microsoft Entra application proxy](../identity/app-proxy/application-proxy-network-topology.md).
118
+For guidance on where to install connectors and how to optimize your network, see [Optimize traffic flow with Microsoft Entra application proxy](../identity/app-proxy/application-proxy-network-topology.md).
111119
112
−## Expanding Ephemeral Port Range
120
+## Expanding ephemeral port range
113121
114
−Private Network connectors initiate TCP/UDP connections to designated destination endpoints, requiring available source ports on the connector host machine. Expanding the ephemeral port range can improve the availability of source ports, particularly when managing a high volume of concurrent connections.
122
+Private network connectors initiate TCP and UDP connections to designated destination endpoints. These connections require available source ports on the connector host machine. Expanding the ephemeral port range can improve the availability of source ports, particularly when you're managing a high volume of concurrent connections.
115123
116
−To view the current dynamic port range on a system, use the following netsh commands:
124
+To view the current dynamic port range on a system, use the following `netsh` commands:
125
+
117126
- `netsh int ipv4 show dynamicport tcp`
118127
- `netsh int ipv4 show dynamicport udp`
119128
- `netsh int ipv6 show dynamicport tcp`
120129
- `netsh int ipv6 show dynamicport udp`
121
−
122
−Sample netsh commands to increase the ports
130
+
131
+Here are sample `netsh` commands to increase the ports:
132
+
123133
- `netsh int ipv4 set dynamicport tcp start=1025 num=64511`
124134
- `netsh int ipv4 set dynamicport udp start=1025 num=64511`
125135
- `netsh int ipv6 set dynamicport tcp start=1025 num=64511`
⋯ 1 unchanged line
127137
128138
These commands set the dynamic port range from 1025 to the maximum of 65535. The minimum start port is 1025.
129139
130
−## Specifications and Sizing Requirements
131
−The following specifications are recommended for each Microsoft Entra Private Network Connector:
140
+## Specifications and sizing requirements
132141
133
−- **Memory:** 8 GiB or more
134
−- **CPU:** 4 CPU cores or more
142
+We recommend the following specifications for each Microsoft Entra private network connector:
135143
144
+- **Memory**: 8 GiB or more
145
+- **CPU**: 4 CPU cores or more
146
+
136147
Keep peak CPU and memory utilization per connector under 70%. If sustained utilization exceeds 70%, add connectors to the group or scale up host capacity to distribute load. Monitor with Windows performance counters to validate that utilization returns to an acceptable range.
137148
138
−Up to ~1.5 Gbps aggregate TCP throughput (combined inbound + outbound) per connector on an Azure VM sized at 4 vCPU / 8 GiB RAM with standard networking. Higher throughput can be achieved by using larger VM sizes (more vCPUs, memory, accelerated/high-bandwidth NICs) or by adding more connectors in the same group to scale out.
149
+You can expect up to ~1.5 Gbps aggregate TCP throughput (combined inbound and outbound) per connector on an Azure VM sized at 4 vCPU and 8 GiB RAM with standard networking. You can achieve higher throughput by using larger VM sizes (more vCPUs, more memory, and accelerated or high-bandwidth NICs), or by adding more connectors in the same group to scale out.
139150
140
−**More details:**
141
−- Performance guidance (for example ~1.5 Gbps on a 4 vCPU / 8 GiB host) is derived from controlled lab tests using iPerf3 TCP data streams in a dedicated test tenant. Actual throughput can vary based on CPU generation, NIC capabilities (accelerated networking, offloads), TLS cipher suites, network latency and jitter, packet loss, concurrent protocol mix (HTTP(S), SMB, RDP), intermediate devices (firewalls, IDS/IPS, SSL inspection), and backend application responsiveness. Scenario-based benchmark data (mixed workloads, high-connection concurrency, latency-sensitive applications) will be added to this documentation as it becomes available.
142
−- Once a connector is enrolled, it establishes outbound TLS tunnels to the Private Access cloud infrastructure. These tunnels handle all data path traffic. In addition, we have some control plane channel, driving keep-alive heartbeat, health reporting, connector upgrades and so on utilizing minimal bandwidth.
143
−- You can deploy more connectors in the same connector group to increase overall throughput, provided adequate network and internet connectivity is available. It is recommended to maintain a minimum of two healthy connectors to ensure resiliency and consistent availability. For best practices regarding high availability, refer to the guidance [here](../identity/app-proxy/application-proxy-high-availability-load-balancing.md#best-practices-for-high-availability-of-connectors).
151
+We derived this performance guidance from controlled lab tests that used iPerf3 TCP data streams in a dedicated test tenant. Actual throughput can vary based on:
144152
153
+- CPU generation
154
+- NIC capabilities (accelerated networking, offloads)
155
+- TLS cipher suites
156
+- Network latency and jitter
157
+- Packet loss
158
+- Concurrent protocol mix (HTTPS, SMB, RDP)
159
+- Intermediate devices (firewalls, IDS/IPS, SSL inspection)
160
+- Back-end application responsiveness
161
+
162
+Scenario-based benchmark data (mixed workloads, high-connection concurrency, latency-sensitive applications) will be added to this documentation as it becomes available.
163
+
164
+After a connector is enrolled, it establishes outbound TLS tunnels to the Private Access cloud infrastructure. These tunnels handle all data path traffic. In addition, the control plane channel uses minimal bandwidth to drive keep-alive heartbeat, health reporting, connector updates, and other functions.
165
+
166
+You can deploy more connectors in the same connector group to increase overall throughput, if adequate network and internet connectivity is available. We recommend that you maintain a minimum of two healthy connectors to ensure resiliency and consistent availability.
167
+
168
+To learn more, see [Best practices for high availability of connectors](../identity/app-proxy/application-proxy-high-availability-load-balancing.md#best-practices-for-high-availability-of-connectors).
169
+
145170
## Domain joining
146171
147
−Connectors can run on a machine that isn't domain-joined. However, if you want single sign-on (SSO) to applications that use integrated Windows authentication (IWA), you need a domain-joined machine. In this case, the connector machines must be joined to a domain that can perform [Kerberos](https://web.mit.edu/kerberos) Constrained Delegation on behalf of the users for the published applications.
172
+Connectors can run on a machine that isn't domain joined. However, if you want single sign-on (SSO) to applications that use integrated Windows authentication, you need a domain-joined machine. In this case, the connector machines must be joined to a domain that can perform [Kerberos](https://web.mit.edu/kerberos) constrained delegation on behalf of the users for the published applications.
148173
149
−Connectors can also be joined to domains in forests that have a partial trust, or to read-only domain controllers.
174
+You can also joint connectors to:
150175
151
−## Connector deployments on hardened environments
176
+- Domains in forests that have a partial trust.
177
+- Read-only domain controllers.
152178
153
−Usually, connector deployment is straightforward and requires no special configuration.
179
+## Connector deployments on hardened environments
154180
155
−However, there are some unique conditions that should be considered:
181
+Usually, connector deployment is straightforward and requires no special configuration. But consider these unique conditions:
156182
157
−- Outbound traffic requires specific ports to be open. To learn more, see [configure connectors](concept-connectors.md).
183
+- Outbound traffic requires specific ports to be open (80 and 443).
158184
- FIPS-compliant machines might require a configuration change to allow the connector processes to generate and store a certificate.
159185
- Outbound forward proxies could break the two-way certificate authentication and cause communication to fail.
160186
161187
## Connector authentication
162188
163
−To provide a secure service, connectors have to authenticate toward the service, and the service has to authenticate toward the connector. This authentication is done using client and server certificates when the connectors initiate the connection. This way the administrator’s username and password aren't stored on the connector machine.
189
+To provide a secure service, connectors have to authenticate toward the service, and the service has to authenticate toward the connector. This authentication uses client and server certificates when the connectors initiate the connection. This way, the administrator's username and password aren't stored on the connector machine.
164190
165
−The certificates used are specific to the service. They're created during the initial registration and automatically renewed every couple of months.
191
+The certificates are specific to the service. They're created during the initial registration and automatically renewed every couple of months.
166192
167
−After the first successful certificate renewal, the Microsoft Entra private network connector service (Network Service) has no permission to remove the old certificate from the local machine store. If the certificate expires or isn't used by the service, you can delete it safely.
193
+After the first successful certificate renewal, the Microsoft Entra private network connector service has no permission to remove the old certificate from the local machine store. If the certificate expires or the service doesn't use it, you can delete it safely.
168194
169
−To avoid problems with certificate renewal, ensure that the network communication from the connector towards the [documented destinations](concept-connectors.md) is enabled.
195
+To avoid problems with certificate renewal, ensure that the network communication from the connector toward the documented destinations is enabled.
170196
171
−If a connector isn't connected to the service for several months, its certificates could be outdated. In this case, uninstall and reinstall the connector to trigger registration. You can run the following PowerShell commands:
197
+If a connector isn't connected to the service for several months, its certificates might be outdated. In this case, uninstall and reinstall the connector to trigger registration. You can run the following PowerShell commands:
172198
173199
```
174200
Import-module MicrosoftEntraPrivateNetworkConnectorPSModule
175201
Register-MicrosoftEntraPrivateNetworkConnector -EnvironmentName "AzureCloud"
176202
```
177203
178
−For government, use `-EnvironmentName "AzureUSGovernment"`. For more information, see [Install Agent for the Azure Government Cloud](../identity/hybrid/connect/reference-connect-government-cloud.md#install-the-agent-for-the-azure-government-cloud).
204
+For government, use `-EnvironmentName "AzureUSGovernment"`. For more information, see [Install the agent for the Azure Government cloud](../identity/hybrid/connect/reference-connect-government-cloud.md#install-the-agent-for-the-azure-government-cloud).
179205
180
−To learn how to verify the certificate and troubleshoot problems see [Verify Machine and backend components support for application proxy trust certificate](../identity/app-proxy/application-proxy-connector-installation-problem.md).
206
+To learn how to verify the certificate and troubleshoot problems, see [Troubleshoot problems installing the private network connector](../identity/app-proxy/application-proxy-connector-installation-problem.md).
181207
182208
## Under the hood
183209
⋯ 5 unchanged lines
189215
190216
You can examine the state of the service in the Services window. The connector is made up of two Windows Services: the actual connector, and the updater. Both of them must run all the time.
191217
192
−## Inactive connectors
193
−A common issue is that connectors appear as inactive in a connector group. A firewall blocking the required ports is a common cause for inactive connectors.
194
−
195
−## Next steps
218
+## Related content
196219
197220
- [Understand Microsoft Entra private network connector groups](concept-connector-groups.md)
198221
- [Work with existing on-premises proxy servers](../identity/app-proxy/application-proxy-configure-connectors-with-proxy-servers.md)
⋯ 2 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:51 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.