📋 Microsoft Entra Documentation Changes

ms.date: 09/25/2025

# Understand Microsoft Entra private network connector

Connectors make Microsoft Entra Private Access and Application Proxy possible. They're simple to deploy and maintain, and powerful. This article explains what connectors are, how they work, and how to optimize your deployment.

Private network connectors are lightweight agents you install on a Windows Server inside your network. They create outbound connections to Microsoft Entra Private Access and the application proxy service to reach backend resources. Organize connectors into connector groups that handle traffic for specific resources. For an architecture overview, see [Using Microsoft Entra application proxy to publish on-premises apps for remote users](../identity/app-proxy/overview-what-is-app-proxy.md). To set them up, see [How to configure private network connectors for Microsoft Entra Private Access](how-to-configure-connectors.md). Users connect to the cloud service, which routes traffic to apps through the connectors.

Set up and register a connector with the application proxy service:

1. Open outbound ports 80 and 443 and allow access to the required service and Microsoft Entra ID URLs.

1. Sign in to the Microsoft Entra admin center and run the installer on an on-premises Windows Server.

1. Start the connector so it listens to the application proxy service.

ms.date: 09/25/2025

# Microsoft Entra private network connector groups

Use private network connector groups to assign connectors to applications. Connector groups give you more control and help you optimize deployments.

Each private network connector is in a connector group. Connectors in the same group act as a unit for high availability and load balancing. If you don't create groups, all connectors are in the default group. Create new groups and assign connectors in the Microsoft Entra admin center.

Use connector groups when applications run in different locations. Create groups by location so each application uses nearby connectors.

> If you have a large Application Proxy deployment, don't assign applications to the default connector group. New connectors don't receive live traffic until you move them to an active group. You can also idle connectors by moving them back to the default group so you can do maintenance without affecting users.

1. Select **Delegate approvals** on the Approvals page.

#### To remove the delegate, you'd:

1. Select **Delegate approvals** on the Approvals page.

 

# Global Secure Access client overview

The Global Secure Access client gives organizations control over network traffic at the end-user computing device. With this client, organizations can route specific traffic profiles through Microsoft Entra Internet Access and Microsoft Entra Private Access. Routing traffic in this method allows for more controls like continuous access evaluation (CAE), device compliance, or multifactor authentication to be required for resource access.

The Global Secure Access client uses a lightweight filter (LWF) driver to acquire traffic. In contrast, many other Security Service Edge (SSE) solutions integrate as a virtual private network (VPN) connection. This distinction allows the Global Secure Access client to coexist with these other solutions. The Global Secure Access client acquires traffic based on the traffic forwarding profiles you configure.

As part of increasing the security posture of Microsoft Entra Connect, Microsoft deployed a dedicated first-party application to enable the synchronization between Active Directory and Microsoft Entra ID. This new application will manifest as a first party service principal called the "Microsoft Entra AD Synchronization Service" (Application Id: `6bf85cfa-ac8a-4be5-b5de-425a0d0dc016`) and will be visible in the Enterprise Applications experience within the Microsoft Entra admin center. This application is critical for the continued operation of on-premises to Microsoft Entra ID synchronization functionality through Entra Connect.

 

We have since released a new version (2.5.79.0) of Microsoft Entra Connect that contains this service change. All customers are required to upgrade to the minimum versions by September 30, 2026 to avoid service disruptions.

If you aren’t upgraded to the minimum required version (2.5.79.0), you might encounter the following impact to the Microsoft Entra Connect Sync service when the service change takes effect:

Yes. For Azure Government cloud customers, contact your account manager.