MODIFIED docs/identity/app-proxy/conceptual-deployment-plan.md

Modified by Ken Withee on Mar 10, 2026 4:48 PM
📖 View on learn.microsoft.com

+41 / -41 lines changed

Commit: Editorial pass: conceptual-deployment-plan.md (47 fixes)

Changes:

Before

After

title: Plan a Microsoft Entra application proxy deployment
description: An end-to-end guide for planning the deployment of application proxy within your organization
ms.topic: how-to
ms.date: 05/01/2025
ai-usage: ai-assisted
---
 
 
Microsoft Entra application proxy is a secure and cost-effective remote access solution for on-premises applications. It provides an immediate transition path for "Cloud First" organizations to manage access to legacy on-premises applications that aren’t yet capable of using modern protocols. For more introductory information, see [What is application proxy](overview-what-is-app-proxy.md).
 
Application proxy is recommended for giving remote users access to internal resources. Application proxy replaces the need for a VPN or reverse proxy for these remote access use cases. It isn't intended for users who are on the corporate network. These users who use application proxy for intranet access might experience undesirable performance issues.
 
This article includes the resources you need to plan, operate, and manage Microsoft Entra application proxy.
 
 
* **Connectors**: Connectors are lightweight agents that you can deploy onto:
   * Physical hardware on-premises
   * A Virtual Machine (VM) hosted within any hypervisor solution
   * A VM hosted in Azure to enable outbound connection to the application proxy service.
 

title: Plan a Microsoft Entra application proxy deployment
description: An end-to-end guide for planning the deployment of application proxy within your organization
ms.topic: how-to
ms.date: 03/10/2026
ai-usage: ai-assisted
---
 
 
Microsoft Entra application proxy is a secure and cost-effective remote access solution for on-premises applications. It provides an immediate transition path for "Cloud First" organizations to manage access to legacy on-premises applications that aren’t yet capable of using modern protocols. For more introductory information, see [What is application proxy](overview-what-is-app-proxy.md).
 
Application proxy is recommended for giving remote users access to internal resources. Application proxy replaces the need for a VPN or reverse proxy for these remote access use cases. It isn't intended for users who are on the corporate network. Users who access application proxy on the intranet might experience performance issues.
 
This article includes the resources you need to plan, operate, and manage Microsoft Entra application proxy.
 
 
* **Connectors**: Connectors are lightweight agents that you can deploy onto:
   * Physical hardware on-premises
   * A virtual machine (VM) hosted within any hypervisor solution
   * A VM hosted in Azure to enable outbound connection to the application proxy service.
 

MODIFIED docs/identity/app-proxy/application-proxy-security.md

Modified by Ken Withee on Mar 10, 2026 4:40 PM
📖 View on learn.microsoft.com

+40 / -40 lines changed

Commit: Editorial pass: application-proxy-security.md (41 fixes)

Changes:

Before

After

---
title: Security considerations for Microsoft Entra application proxy
description: Covers security considerations for using Microsoft Entra application proxy
ms.topic: concept-article
ms.date: 05/01/2025
ms.reviewer: ashishj
ai-usage: ai-assisted
---
 
The following diagram shows how Microsoft Entra ID enables secure remote access to your on-premises applications.
 
 ![Diagram of secure remote access through Microsoft Entra application proxy](./media/application-proxy-security/secure-remote-access.png)
 
## Security benefits
 
Microsoft Entra application proxy offers many security benefits. The list of benefits are:
- Authenticated access
- Conditional Access
- Traffic termination
- Remote access as a service

---
title: Security considerations for Microsoft Entra application proxy
description: Learn about security considerations and architecture for using Microsoft Entra application proxy.
ms.topic: concept-article
ms.date: 03/10/2026
ms.reviewer: ashishj
ai-usage: ai-assisted
---
 
The following diagram shows how Microsoft Entra ID enables secure remote access to your on-premises applications.
 
![Diagram of secure remote access through Microsoft Entra application proxy](./media/application-proxy-security/secure-remote-access.png)
 
## Security benefits
 
Microsoft Entra application proxy offers many security benefits. The benefits include:
- Authenticated access
- Conditional Access
- Traffic termination
- Remote access as a service

MODIFIED docs/identity/app-proxy/overview-what-is-app-proxy.md

Modified by Ken Withee on Mar 10, 2026 2:46 PM
📖 View on learn.microsoft.com

+38 / -37 lines changed

Commit: Editorial pass: overview-what-is-app-proxy.md (30 fixes)

Changes:

Before

After

---
title: Publish On-Premises Apps with Microsoft Entra Application Proxy
description: Learn about the architecture, connectors, authentication methods, and security benefits of Microsoft Entra application proxy.
ms.topic: conceptual
ms.date: 05/01/2025
ms.reviewer: ashishj
ms.custom:
ai-usage: ai-assisted
 
# Microsoft Entra application proxy
 
Microsoft Entra application proxy provides secure remote access for publishing on-premises web applications externally to remote users. After single sign-on (SSO) to Microsoft Entra ID, users can access both cloud and on-premises applications through an external URL or an internal application portal. For example, application proxy can provide remote access and SSO to Remote Desktop, SharePoint, Teams, Tableau, Qlik, and line-of-business (LOB) applications.
 
Microsoft Entra application proxy is:
 
- **Simple to use**. Users can access your on-premises applications the same way that they access Microsoft 365 and other software-as-a-service (SaaS) apps integrated with Microsoft Entra ID. You don't need to change or update your applications to work with application proxy.
 
- **Secure**. On-premises applications can use the authorization controls and security analytics in Azure. For example, on-premises applications can use Microsoft Entra Conditional Access and two-step verification. Application proxy doesn't require you to open inbound connections through your firewall.
 
- **Cost-effective**. On-premises solutions typically require you to set up and maintain perimeter networks (also known as demilitarized zones or DMZs), edge servers, or other complex infrastructures. Application proxy runs in the cloud. To use it, you don't need to change the network infrastructure or install more appliances in your on-premises environment.

---
title: Publish on-premises apps with Microsoft Entra application proxy
description: Learn about the architecture, connectors, authentication methods, and security benefits of Microsoft Entra application proxy.
ms.topic: conceptual
ms.date: 03/10/2026
ms.reviewer: ashishj
ms.custom:
ai-usage: ai-assisted
 
# Microsoft Entra application proxy
 
Microsoft Entra application proxy provides secure remote access to on-premises web applications for remote users. After single sign-on (SSO) to Microsoft Entra ID, users can access both cloud and on-premises applications through an external URL or an internal application portal. For example, application proxy can provide remote access and SSO to Remote Desktop, SharePoint, Teams, Tableau, Qlik, and line-of-business (LOB) applications.
 
Microsoft Entra application proxy is:
 
- **Simple to use**. Users can access your on-premises applications the same way that they access Microsoft 365 and other software-as-a-service (SaaS) apps integrated with Microsoft Entra ID. You don't need to change or update your applications to work with application proxy.
 
- **Secure**. On-premises applications can use the authorization controls and security analytics in Microsoft Entra. For example, on-premises applications can use Microsoft Entra Conditional Access and multifactor authentication. Application proxy doesn't require you to open inbound connections through your firewall.
 
- **Cost-effective**. On-premises solutions typically require you to set up and maintain perimeter networks (also known as demilitarized zones or DMZs), edge servers, or other complex infrastructures. Application proxy runs in the cloud. To use it, you don't need to change the network infrastructure or install more appliances in your on-premises environment.

MODIFIED docs/identity/app-proxy/application-proxy-add-on-premises-application.md

Modified by Ken Withee on Mar 10, 2026 3:49 PM
📖 View on learn.microsoft.com

+30 / -28 lines changed

Commit: Editorial pass: application-proxy-add-on-premises-application.md (33 fixes)

Changes:

Before

After

---
title: Add an on-premises application for remote access through application proxy in Microsoft Entra ID
description: Microsoft Entra ID has an application proxy service that enables users to access on-premises applications by signing in with their Microsoft Entra account. This tutorial shows you how to prepare your environment for use with application proxy. Then, it uses the Microsoft Entra admin center to add an on-premises application to your Microsoft Entra tenant.
ms.topic: tutorial
ms.date: 02/25/2026
ms.author: ashishj
ms.reviewer: ashishj
ai-usage: ai-assisted
 
# Add an on-premises application for remote access through application proxy in Microsoft Entra ID
 
Microsoft Entra ID has an application proxy service that enables users to access on-premises applications by signing in with their Microsoft Entra account. To learn more about application proxy, see [What is application proxy?](overview-what-is-app-proxy.md). This tutorial prepares your environment for use with application proxy. Once your environment is ready, use the Microsoft Entra admin center to add an on-premises application to your tenant.
 
:::image type="content" source="./media/application-proxy-add-on-premises-application/app-proxy-diagram.png" alt-text="Application proxy Overview Diagram" lightbox="./media/application-proxy-add-on-premises-application/app-proxy-diagram.png":::
 
In this tutorial, you:
- Install and verify the connector on your Windows server, and registers it with application proxy.
- Add an on-premises application to your Microsoft Entra tenant.
- Verify a test user can sign on to the application by using a Microsoft Entra account.
 

---
title: Add an on-premises application for remote access through application proxy in Microsoft Entra ID
description: Learn how to prepare your environment for application proxy and add an on-premises application to your Microsoft Entra tenant.
ms.topic: tutorial
ms.date: 03/10/2026
ms.author: ashishj
ms.reviewer: ashishj
ai-usage: ai-assisted
 
# Add an on-premises application for remote access through application proxy in Microsoft Entra ID
 
Microsoft Entra ID has an application proxy service that enables users to access on-premises applications by signing in with their Microsoft Entra account. To learn more about application proxy, see [What is application proxy?](overview-what-is-app-proxy.md). This tutorial prepares your environment for use with application proxy. After your environment is ready, use the Microsoft Entra admin center to add an on-premises application to your tenant.
 
:::image type="content" source="./media/application-proxy-add-on-premises-application/app-proxy-diagram.png" alt-text="Application proxy overview diagram" lightbox="./media/application-proxy-add-on-premises-application/app-proxy-diagram.png":::
 
In this tutorial, you:
- Install and verify the connector on your Windows server, and register it with application proxy.
- Add an on-premises application to your Microsoft Entra tenant.
- Verify a test user can sign in to the application by using a Microsoft Entra account.
 

MODIFIED docs/identity/app-proxy/application-proxy-troubleshoot.md

Modified by Ken Withee on Mar 10, 2026 4:29 PM
📖 View on learn.microsoft.com

+29 / -29 lines changed

Commit: Editorial pass: application-proxy-troubleshoot.md (32 fixes)

Changes:

Before

After

---
title: Troubleshoot Application Proxy
description: Learn how to troubleshoot errors in Microsoft Entra application proxy.
ms.topic: troubleshooting
ms.date: 05/01/2025
ms.reviewer: ashishj
ai-usage: ai-assisted
---
 
# Troubleshoot application proxy issues and errors
 
This article describes steps you can take to troubleshoot issues and error messages in Microsoft Entra application proxy.
 
## Before you begin
 
The first thing to check is the connector. To learn how to debug a private network connector, see [Debug private network connector issues](application-proxy-debug-connectors.md). If you still have issues connecting to your application, return to this article to troubleshoot the application.  
 
If a user encounters an error while accessing or publishing an application, use these steps to verify that Microsoft Entra application proxy is functioning properly:
 
* Open the Windows Services console. Verify that the **Microsoft Entra private network connector** service is enabled and running. Look at the application proxy service properties page.

---
title: Troubleshoot Application Proxy
description: Learn how to troubleshoot common errors and configuration problems with Microsoft Entra application proxy.
ms.topic: troubleshooting
ms.date: 03/10/2026
ms.reviewer: ashishj
ai-usage: ai-assisted
---
 
# Troubleshoot application proxy issues and errors
 
Use these steps to troubleshoot issues and error messages in Microsoft Entra application proxy.
 
## Before you begin
 
Start by checking the connector. To learn how to debug a private network connector, see [Debug private network connector issues](../../global-secure-access/troubleshoot-connectors.md). If you still have issues connecting to your application, return to this article to troubleshoot the application.  
 
If a user encounters an error while accessing or publishing an application, use these steps to verify that Microsoft Entra application proxy works correctly:
 
* Open the Windows Services console. Verify that the **Microsoft Entra private network connector** service is enabled and running. Look at the application proxy service properties page.

MODIFIED docs/identity/app-proxy/how-to-configure-custom-domain.md

Modified by Ken Withee on Mar 10, 2026 6:33 PM
📖 View on learn.microsoft.com

+23 / -23 lines changed

Commit: Editorial pass: how-to-configure-custom-domain.md (27 fixes)

Changes:

Before

After

---
title: Custom domains in Microsoft Entra application proxy
description: Configure and manage custom domains in Microsoft Entra application proxy.
ms.topic: how-to
ms.date: 05/01/2025
ms.reviewer: ashishj
ai-usage: ai-assisted
ms.custom: sfi-image-nochange
 
- You can control your branding and create the URLs you want. A custom domain can help build your users' confidence, because users see and use a familiar name instead of *`msappproxy.net`*.
 
- Some configurations only work with custom domains. For example, you need custom domains for apps that use Security Assertion Markup Language (SAML). SAML is used when you’re using Active Directory Federation Services (ADFS) but are unable to use WS-Federation. For more information, see [Work with claims-aware apps in application proxy](application-proxy-configure-for-claims-aware-applications.md). 
 
If you're not able to make the internal and external URLs match, it's not as important to use custom domains. But you can still take advantage of the other benefits. 
 
 
### Same internal and external URL, but different behavior 
 
If you don't want your internal users to be directed through the application proxy, you can set up a *split-brain DNS*. A split DNS infrastructure directs name resolution based on host location. Internal hosts are directed to an internal domain name server, and external hosts to an external domain name server.
 

---
title: Custom domains in Microsoft Entra application proxy
description: Configure and manage custom domains in Microsoft Entra application proxy to use your own domain name.
ms.topic: how-to
ms.date: 03/10/2026
ms.reviewer: ashishj
ai-usage: ai-assisted
ms.custom: sfi-image-nochange
 
- You can control your branding and create the URLs you want. A custom domain can help build your users' confidence, because users see and use a familiar name instead of *`msappproxy.net`*.
 
- Some configurations only work with custom domains. For example, you need custom domains for apps that use Security Assertion Markup Language (SAML). You use SAML when you’re using Active Directory Federation Services (AD FS) but can’t use WS-Federation. For more information, see [Work with claims-aware apps in application proxy](application-proxy-configure-for-claims-aware-applications.md). 
 
If you're not able to make the internal and external URLs match, it's not as important to use custom domains. But you can still take advantage of the other benefits. 
 
 
### Same internal and external URL, but different behavior 
 
If you don't want your internal users to be directed through the application proxy, you can set up a *split-brain DNS*. A split DNS infrastructure directs name resolution based on host location. It directs internal hosts to an internal domain name server and external hosts to an external domain name server.
 

MODIFIED docs/identity/app-proxy/how-to-configure-sso.md

Modified by Ken Withee on Mar 10, 2026 6:38 PM
📖 View on learn.microsoft.com

+21 / -20 lines changed

Commit: Editorial pass: how-to-configure-sso.md (26 fixes)

Changes:

Before

After

---
title: Understand single sign-on with an on-premises app using application proxy
description: Understand single sign-on with an on-premises app using application proxy.
ms.topic: how-to
ms.date: 05/01/2025
ms.reviewer: ashishj, asteen
ai-usage: ai-assisted
---
 
# How to configure single sign-on to an application proxy application
 
Single sign-on (SSO) allows your users to access an application without authenticating multiple times. It allows the single authentication to occur in the cloud, against Microsoft Entra ID, and allows the service or Connector to impersonate the user to complete any more authentication challenges from the application.
 
## How to configure single-sign on
To configure SSO, first make sure that your application is configured for Pre-Authentication through Microsoft Entra ID.
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Application Administrator](~/identity/role-based-access-control/permissions-reference.md#application-administrator).
1. Select your username in the upper-right corner. Verify you're signed in to a directory that uses application proxy. If you need to change directories, select **Switch directory** and choose a directory that uses application proxy.
1. Browse to **Entra ID** > **Enterprise apps** > **Application proxy**.
 

---
title: Understand single sign-on with an on-premises app using application proxy
description: Learn how to configure single sign-on for on-premises apps published through Microsoft Entra application proxy.
ms.topic: how-to
ms.date: 03/10/2026
ms.reviewer: ashishj, asteen
ai-usage: ai-assisted
---
 
# How to configure single sign-on to an application proxy application
 
Single sign-on (SSO) lets your users access an application without authenticating multiple times. The authentication occurs in the cloud, against Microsoft Entra ID, and the service or connector impersonates the user to complete additional authentication challenges from the application.
 
## How to configure single sign-on
 
To configure SSO, first make sure that your application is configured for preauthentication through Microsoft Entra ID.
 
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Application Administrator](~/identity/role-based-access-control/permissions-reference.md#application-administrator).
1. Select your username in the upper-right corner. Verify you're signed in to a directory that uses application proxy. If you need to change directories, select **Switch directory** and choose a directory that uses application proxy.
1. Browse to **Identity** > **Applications** > **Enterprise applications** > **Application proxy**.

MODIFIED docs/identity/app-proxy/application-proxy-configure-custom-home-page.md

Modified by Ken Withee on Mar 10, 2026 6:24 PM
📖 View on learn.microsoft.com

+15 / -15 lines changed

Commit: Editorial pass: application-proxy-configure-custom-home-page.md (15 fixes)

Changes:

Before

After

---
title: Custom Home Page for Published Apps Using Microsoft Entra Application Proxy
description: Learn how to set a custom home page for published apps using Microsoft Entra application proxy to ensure users land on the correct page.
ms.topic: how-to
ms.date: 03/25/2025
ms.reviewer: KaTabish
ms.custom: no-azure-ad-ps-ref, sfi-image-nochange
#customer intent: As an IT admin, I want to set a custom home page for published apps using Microsoft Entra application proxy so that users are directed to the correct page when accessing the app.
 
This article discusses how to configure an app to direct a user to a custom home page. When you publish an app with application proxy, you set an internal URL, but sometimes that's not the page a user should see first. Set a custom home page so users get the correct page when accessing the app. Users see the custom home page you set, regardless of whether they access the app from Microsoft Entra My Apps or the Microsoft 365 app launcher.
 
When a user launches the app, they're directed to the root domain URL for the published app by default. The landing page is typically set as the home page URL. Use the Microsoft Entra PowerShell module to define a custom home page URL when you want an app user to land on a specific page within the app.
 
Here's one scenario that explains why your company would set a custom home page:
 
- You want to set `https://ExpenseApp-contoso.msappproxy.net/login/login.aspx` as the home page URL instead, so an external user sees the sign-in page first.
 
> [!NOTE]
> When you give users access to published apps, the apps appear in [My Apps](https://support.microsoft.com/account-billing/sign-in-and-start-apps-from-the-my-apps-portal-2f3b1bae-0e5a-4a86-a33e-876fbd2a4510) and the [Office 365 app launcher](https://www.microsoft.com/microsoft-365/blog/2016/09/27/introducing-the-new-office-365-app-launcher/).
 

---
title: Custom home page for published apps using Microsoft Entra application proxy
description: Learn how to set a custom home page for published apps using Microsoft Entra application proxy to ensure users land on the correct page.
ms.topic: how-to
ms.date: 03/10/2026
ms.reviewer: KaTabish
ms.custom: no-azure-ad-ps-ref, sfi-image-nochange
#customer intent: As an IT admin, I want to set a custom home page for published apps using Microsoft Entra application proxy so that users are directed to the correct page when accessing the app.
 
This article discusses how to configure an app to direct a user to a custom home page. When you publish an app with application proxy, you set an internal URL, but sometimes that's not the page a user should see first. Set a custom home page so users get the correct page when accessing the app. Users see the custom home page you set, regardless of whether they access the app from Microsoft Entra My Apps or the Microsoft 365 app launcher.
 
When a user launches the app, the app directs them to the root domain URL by default. The landing page typically serves as the home page URL. Use the Microsoft Entra PowerShell module to define a custom home page URL when you want an app user to land on a specific page within the app.
 
Here's one scenario that explains why your company would set a custom home page:
 
- You want to set `https://ExpenseApp-contoso.msappproxy.net/login/login.aspx` as the home page URL instead, so an external user sees the sign-in page first.
 
> [!NOTE]
> When you give users access to published apps, the apps appear in [My Apps](https://support.microsoft.com/account-billing/sign-in-and-start-apps-from-the-my-apps-portal-2f3b1bae-0e5a-4a86-a33e-876fbd2a4510) and the [Microsoft 365 app launcher](https://www.microsoft.com/microsoft-365/blog/2016/09/27/introducing-the-new-office-365-app-launcher/).
 

MODIFIED docs/id-governance/simulate-workflow-execution.md

Modified by Ortagus Winfrey on Mar 10, 2026 8:12 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Updates

Changes:

Before

After

description: Learn how to use the What-if tool in Lifecycle Workflows to simulate workflow execution and preview results without impacting actual users.
ms.subservice: lifecycle-workflows
ms.topic: how-to
ms.date: 02/24/2026
ms.custom: template-how-to
ai-usage: ai-assisted
---

description: Learn how to use the What-if tool in Lifecycle Workflows to simulate workflow execution and preview results without impacting actual users.
ms.subservice: lifecycle-workflows
ms.topic: how-to
ms.date: 03/10/2026
ms.custom: template-how-to
ai-usage: ai-assisted
---

MODIFIED docs/identity/authentication/howto-authentication-passwordless-security-key-windows.md

Modified by Justinha on Mar 10, 2026 1:26 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Change 'running' to 'requires' for device unlock version

Changes:

Before

After

 
- OOBE sign-in with a passkey is supported. You can use Web sign-in to unlock a Windows device. For more information, see [Use Web Sign-In To Enable Passwordless Sign-In In Windows](/windows/security/identity-protection/web-sign-in).
- When signing in or unlocking a Windows device using a security key that contains multiple Microsoft Entra accounts, the device defaults to the last account added to the key. However, WebAuthn allows users to select the specific account they wish to use for authentication.
- Unlocking a device running Windows 10 version 1809. For the best experience, use Windows 10 version 1903 or higher.
 
## Prepare devices

 
- OOBE sign-in with a passkey is supported. You can use Web sign-in to unlock a Windows device. For more information, see [Use Web Sign-In To Enable Passwordless Sign-In In Windows](/windows/security/identity-protection/web-sign-in).
- When signing in or unlocking a Windows device using a security key that contains multiple Microsoft Entra accounts, the device defaults to the last account added to the key. However, WebAuthn allows users to select the specific account they wish to use for authentication.
- Unlocking a device requires Windows 10 version 1809. For the best experience, use Windows 10 version 1903 or higher.
 
## Prepare devices

MODIFIED docs/identity/monitoring-health/reference-sla-performance.md

Modified by YalingQing on Mar 10, 2026 5:16 AM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: Learn Editor: Update reference-sla-performance.md

Changes:

Before

After

| Month     | 2021    | 2022    | 2023    | 2024    | 2025    | 2026    |
| ---       | ---     | ---     | ---     | ---     | ---     | ---     |
| January   |         | 99.998% | 99.998% | 99.999% | 99.998% | 99.999% |
| February  | 99.999% | 99.999% | 99.999% | 99.999% | 99.998% |         |
| March     | 99.568% | 99.998% | 99.999% | 99.999% | 99.996% |         |
| April     | 99.999% | 99.999% | 99.999% | 99.999% | 99.999%*|         |
| May       | 99.999% | 99.999% | 99.999% | 99.999% | 99.999% |         |

| Month     | 2021    | 2022    | 2023    | 2024    | 2025    | 2026    |
| ---       | ---     | ---     | ---     | ---     | ---     | ---     |
| January   |         | 99.998% | 99.998% | 99.999% | 99.998% | 99.999% |
| February  | 99.999% | 99.999% | 99.999% | 99.999% | 99.998% | 99.999% |
| March     | 99.568% | 99.998% | 99.999% | 99.999% | 99.996% |         |
| April     | 99.999% | 99.999% | 99.999% | 99.999% | 99.999%*|         |
| May       | 99.999% | 99.999% | 99.999% | 99.999% | 99.999% |         |

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files