Private network connectors
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit e5bbde1 · +26 −11 lines · also on GitHub
⋯ 52 unchanged lines
5353
5454
Connectors are stateless and store no configuration data on the machine. They store only the settings for connecting to the service and the authentication certificate. When they connect to the service, they pull the required configuration data and refresh it every few minutes.
5555
56
−Monitor connectors on the host machine by using the event log and performance counters. View status in the Microsoft Entra admin center:
56
+### Connector status
5757
58
+You can view status of connectors in the Microsoft Entra admin center:
59
+
5860
- For Private Access: Go to **Global Secure Access** > **Connect** > **Connectors**.
5961
- For application proxy: Go to **Identity** > **Applications** > **Enterprise applications**, and then select the application. On the application page, select **Application proxy**.
6062
61
−You don't need to delete unused connectors manually. The service tags inactive connectors as `_inactive_` and removes them after 10 days. To uninstall a connector, uninstall both the connector service and the updater service, and then restart the computer.
63
+### Logs
6264
65
+Connectors are installed on Windows Server, so they have most of the same management tools. You can use Windows event logs and Windows performance counters to monitor connectors.
66
+
67
+Connectors have both **Admin** and **Session** logs. The **Admin** log includes key events and their errors. The **Session** log includes all the transactions and their processing details.
68
+
69
+To view the logs:
70
+
71
+1. Open **Event Viewer** and go to **Applications and Services Logs** > **Microsoft** > **Microsoft Entra private network** > **Connector**.
72
+
73
+ The **Admin** log is visible by default.
74
+1. To make the **Session** log visible, on the **View** menu, select **Show Analytic and Debug Logs**.
75
+
76
+ The **Session** log is typically used for troubleshooting and is disabled by default. Enable it to start collecting events, and disable it when you no longer need it.
77
+
78
+### Service state
79
+
80
+The connector consists of two Windows services: the actual connector and the updater. Both of them must run all the time. You can examine the state of the services in the **Services** window.
81
+
6382
## Handling connector server problems
6483
6584
If one or more connector servers are down because of a server, network, or similar outage, follow these steps to maintain continuity:
⋯ 17 unchanged lines
83102
In tenants with multiple connectors, automatic updates target one connector at a time in each group to prevent downtime. You might experience downtime during an update if:
84103
85104
- You have only one connector. To avoid downtime and provide higher availability, add a second connector and a connector group.
86
−- The update starts while a connector processes a transaction. The initial transaction is lost, but the browser automatically retries the operation or you can refresh the page. The re-sent request is routeed to a backup connector.
105
+- The update starts while a connector processes a transaction. The initial transaction is lost, but the browser automatically retries the operation or you can refresh the page. The re-sent request is routed to a backup connector.
87106
88107
For details about previous versions and their changes, see [Microsoft Entra private network connector: Version release history](reference-version-history.md).
89108
⋯ 5 unchanged lines
95114
96115
Connectors only send outbound requests. The outbound traffic is sent to the service and to the published resources and applications. You don't have to open inbound ports because traffic flows both ways after a session is established. You also don't have to configure inbound access through your firewalls.
97116
98
−A common issue is that connectors appear as inactive in a connector group. A firewall blocking the required ports is a common cause for inactive connectors. For more information about configuring outbound firewall rules, see [Work with existing on-premises proxy servers](../identity/app-proxy/application-proxy-configure-connectors-with-proxy-servers.md).
99
−
100117
## Performance and scalability
101118
102119
Scale for the Private Access and application proxy services is transparent, but scale is a factor for connectors. You need to have enough connectors to handle peak traffic.
⋯ 102 unchanged lines
205222
206223
To learn how to verify the certificate and troubleshoot problems, see [Troubleshoot problems installing the private network connector](../identity/app-proxy/application-proxy-connector-installation-problem.md).
207224
208
−## Under the hood
209
−
210
−Connectors are installed on Windows Server, so they have most of the same management tools including Windows Event Logs and Windows performance counters.
225
+## Inactive connectors
211226
212
−The connectors have both **Admin** and **Session** logs. The **Admin** log includes key events and their errors. The **Session** log includes all the transactions and their processing details.
227
+You don't need to delete unused connectors manually. The service tags inactive connectors as `_inactive_` and removes them after 10 days.
213228
214
−To see the logs, open **Event Viewer** and go to **Applications and Services Logs** > **Microsoft** > **Microsoft Entra private network** > **Connector**. To make the **Session** log visible, on the **View** menu, select **Show Analytic and Debug Logs**. The **Session** log is typically used for troubleshooting, and is disabled by default. Enable it to start collecting events and disable it when it's no longer needed.
229
+To uninstall a connector, uninstall both the connector service and the updater service. Then, restart the computer.
215230
216
−You can examine the state of the service in the Services window. The connector is made up of two Windows Services: the actual connector, and the updater. Both of them must run all the time.
231
+If connectors that you expect to be active appear as inactive in a connector group, a firewall might be blocking the required ports. For more information about configuring outbound firewall rules, see [Work with existing on-premises proxy servers](../identity/app-proxy/application-proxy-configure-connectors-with-proxy-servers.md).
217232
218233
## Related content
219234
⋯ 4 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:51 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.