Microsoft Entra Private Access
GeneralOperate Private Access
In brief
The Private Access operations page no longer includes the row describing a connector offline condition, related Sentinel analytics guidance, or the Windows service check.
What Entra admins need to know
No administrator action is required; avoid relying on the removed troubleshooting workflow.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| Alert | Condition | Role | Automated by | What to do next |
|---|---|---|---|---|
| ||||
| All connectors in a group offline | No connectors in a connector group are sending heartbeats | Network Ops L2 + Incident Commander | Sentinel analytics rule Connector group offline + Playbook 2 | Severity: Critical. All users of applications assigned to this group lose access. 1. Escalate immediately per your incident management process. 2. Check for common root cause: network outage, firewall change, or server patching affecting all connector hosts. 3. If recovery isn't immediate, activate your fallback connectivity plan (for example, temporary VPN access). |
| Connector high resource usage | CPU > 80% or memory > 85% sustained for 15+ minutes on a connector host | Network Ops L1 | Azure Monitor alert (Playbook 5) | 1. Check the number of active sessions on the connector. 2. Redistribute load by adding another connector to the group. 3. Investigate if a specific application is generating unusual traffic volume. |
| Application segment unreachable | Users receive connection failures for a specific Private Access application | Network Ops L1 → App Owner | Sentinel analytics rule Private access segment failures | 1. Verify the backend application server is running and reachable from the connector host. 2. Test DNS resolution from the connector host for the application fully qualified domain name (FQDN). 3. Check the application segment configuration in the Microsoft Entra admin center for correct IP/FQDN and port ranges. See Troubleshoot application access and Troubleshoot problems installing the private network connector. |
@@ -61,7 +61,6 @@ Configure the following alerts and document the response action for each. Use [M | Alert | Condition | Role | Automated by | What to do next | | --- | --- | --- | --- | --- |-| Connector offline | A Private Access connector stops sending heartbeats for more than 5 minutes | Network Ops L1 | Sentinel analytics rule *Connector health degradation* (content hub) | 1. Check the connector server: verify the `Microsoft Entra private network connector` Windows service is running.<br>2. Check outbound connectivity to `*.msappproxy.net` on port 443.<br>3. Review Windows Event Logs on the connector host.<br>4. If the connector can't be recovered, verify traffic has failed over to another connector in the group (see [Failover validation](#failover-validation)). See [Microsoft Entra private network connectors](/entra/global-secure-access/concept-connectors#maintenance) and [Troubleshoot problems installing the private network connector](/entra/global-secure-access/troubleshoot-connectors#troubleshooting-connector-functionality). | | All connectors in a group offline | No connectors in a connector group are sending heartbeats | Network Ops L2 + Incident Commander | Sentinel analytics rule *Connector group offline* + [Playbook 2](#playbook-2-auto-create-itsm-ticket-for-connector-group-failure) | **Severity: Critical.** All users of applications assigned to this group lose access.<br>1. Escalate immediately per your incident management process.<br>2. Check for common root cause: network outage, firewall change, or server patching affecting all connector hosts.<br>3. If recovery isn't immediate, activate your fallback connectivity plan (for example, temporary VPN access). | | Connector high resource usage | CPU > 80% or memory > 85% sustained for 15+ minutes on a connector host | Network Ops L1 | Azure Monitor alert ([Playbook 5](#playbook-5-connector-group-capacity-alert)) | 1. Check the number of active sessions on the connector.<br>2. Redistribute load by adding another connector to the group.<br>3. Investigate if a specific application is generating unusual traffic volume. | | Application segment unreachable | Users receive connection failures for a specific Private Access application | Network Ops L1 → App Owner | Sentinel analytics rule *Private access segment failures* | 1. Verify the backend application server is running and reachable from the connector host.<br>2. Test DNS resolution from the connector host for the application fully qualified domain name (FQDN).<br>3. Check the application segment configuration in the Microsoft Entra admin center for correct IP/FQDN and port ranges. See [Troubleshoot application access](/entra/global-secure-access/troubleshoot-app-access#how-does-dns-work-with-global-secure-access) and [Troubleshoot problems installing the private network connector](/entra/global-secure-access/troubleshoot-connectors#troubleshooting-connector-functionality). |