Learn how to integrate an on-premises Power BI with Microsoft Entra application proxy.

Integrate Microsoft Entra application proxy with Qlik Sense.

Learn how to configure application proxy with Remote Desktop Services (RDS)

PowerShell example that assigns a group to a Microsoft Entra application proxy application.

PowerShell example that assigns a user to a Microsoft Entra application proxy application.

PowerShell example that lists all the users and groups assigned to a specific Microsoft Entra application proxy application.

PowerShell example that lists Microsoft Entra application proxy applications along with the application ID (AppId), name (DisplayName), and object ID (ObjId).

PowerShell example that lists all Microsoft Entra private network connector groups with the assigned applications.

PowerShell example that lists all Microsoft Entra application proxy applications that are using custom domains but don't have a valid TLS/SSL certificate uploaded.

PowerShell example that lists all Microsoft Entra application proxy applications that are using custom domains and certificate information.

PowerShell example that lists all Microsoft Entra application proxy applications that are using default domains (.msappproxy.net).

PowerShell example that lists all Microsoft Entra application proxy applications that are using wildcards.

PowerShell example that lists all Microsoft Entra application proxy applications in your directory that have a lifetime token policy.

PowerShell example that bulk replaces a certificate across Microsoft Entra application proxy applications.

PowerShell example that lists all Microsoft Entra application proxy applications that are published with the identical certificate.

Microsoft Entra application proxy PowerShell example used to move all applications currently assigned to a connector group to a different connector group.

Use these PowerShell samples for Microsoft Entra application proxy to get information about application proxy apps and connectors in your directory, assign users and groups to apps, and get certificate information.

Use Microsoft Entra application proxy to access your on-premises application through Microsoft Teams.

Learn how to use Microsoft Entra application proxy to provide remote access for your Tableau deployment.

Learn how to prepare your environment for application proxy and add an on-premises application to your Microsoft Entra tenant.

Configure and manage custom domains in Microsoft Entra application proxy to use your own domain name.

Learn how to configure single sign-on for on-premises apps published through Microsoft Entra application proxy.

Learn how to set a custom home page for published apps using Microsoft Entra application proxy to ensure users land on the correct page.

When a user signs in, the authentication process checks which authentication methods are registered for the user. The user is prompted to sign-in with the most secure method according to the following order. The order of authentication methods is dynamic. It's updated as the security landscape changes, and as better authentication methods emerge. Users can always cancel and choose a different available sign in method if needed. If your organization has Conditional Access policies that require specific authentication methods, those policies will continue to take priority over the system preferred MFA order. Click the link for more information about each method.

Cloud Sync solves common challenges organizations face with hybrid identity infrastructure by eliminating single points of failure, reducing on-premises management overhead, and enabling complex multi-forest scenarios that support organizational growth and change.

The following table shows the availability of features for browser-delegated and native authentication.

**Service category:** Entra Connect

| [TLS inspection is enabled and correctly configured for outbound traffic](zero-trust-protect-networks.md#tls-inspection-is-enabled-and-correctly-configured-for-outbound-traffic) | Microsoft Entra ID P1 |

A Microsoft Entra documentation page was updated: Zero Trust Protect Networks.

An end-to-end guide for planning the deployment of application proxy within your organization

author: shlipsey3

A Microsoft Entra documentation page was updated: Find help and get support for Microsoft Entra.

author: HULKsmashGithub

author: HULKsmashGithub

author: HULKsmashGithub

PowerShell example that lists all Microsoft Entra private network connector groups and connectors in your directory.

To create a new group directly in an administrative unit, use the following request. To add an existing group instead, see **Add groups to an administrative unit** earlier in this article.

3. Create or use a managed administrative account from the tenant that you want to delete. For example: `[email protected]`.

$groupInfo | Add-Member -MemberType NoteProperty -Name "Group ID" -Value $group.Id

|-----------------------|-------------------------|------------------------|

Support header-based authentication with PingAccess and Microsoft Entra application proxy.

PowerShell example that lists all Microsoft Entra application proxy applications along with the application ID (AppId), name (DisplayName), external URL (ExternalUrl), internal URL (InternalUrl), and authentication type (ExternalAuthenticationType).

- Store refresh tokens in encrypted, platform‑protected storage.

- OOBE sign-in with a passkey is supported. You can use Web sign-in to unlock a Windows device. For more information, see [Use Web Sign-In To Enable Passwordless Sign-In In Windows](/windows/security/identity-protection/web-sign-in).

- S/MIME using a security key.

1. To configure scoping filters, refer to the following instructions provided in the [Scoping filter article](~/identity/app-provisioning/define-conditional-rules-for-provisioning-user-accounts.md).

This article describes the steps you need to perform in both GitHub Enterprise Managed User (OIDC) and Microsoft Entra ID to configure automatic user provisioning. When configured, Microsoft Entra ID automatically provisions and de-provisions users and groups to GitHub Enterprise Managed User (OIDC) using the Microsoft Entra provisioning service. For important details on what this service does, how it works, and frequently asked questions, see [Automate user provisioning and deprovisioning to SaaS applications with Microsoft Entra ID](~/identity/app-provisioning/user-provisioning.md).

- Fixed a [known issue](#known-issue-synchronization-fails-after-upgrade-if-miiserverexeconfig-was-previously-modified) where auto-upgrade could stop your Microsoft Entra Connect server unexpectedly. Auto-upgrade now detects modifications to the `miiserver.exe.config` and `miisclient.exe.config` configuration files and skips automatic upgrade on those servers. If you manually upgrade and previously modified these configuration files, you might encounter installation failures. To resolve the issue, see the [known issues section](#known-issue-synchronization-fails-after-upgrade-if-miiserverexeconfig-was-previously-modified).

Learn how to restore a deleted group, view restorable groups, and permanently delete a group in Microsoft Entra ID.

How to add Web Application Firewall (WAF) protection for apps published with Microsoft Entra application proxy.

Learn how to use Microsoft Entra application proxy to protect your Network Device Enrollment Service (NDES).

Learn about the architecture, connectors, authentication methods, and security benefits of Microsoft Entra application proxy.

Learn about security considerations and architecture for using Microsoft Entra application proxy.

Learn how to integrate an on-premises SharePoint farm with Microsoft Entra application proxy using Security Assertion Markup Language (SAML).

This section will outline best practices independent software vendors (ISV’s) can adopt to enable automated certificate rollover when SAML certificates are near expiry and when applications federated with Microsoft Entra ID. SAML certificates in Entra ID are used for signing assertions in federated single sign-on (SSO). These certificates expire (typically every 1-3 years) and rotation requires a Customer and SaaS ISV coordination to update a mutual certificate in both systems without downtime. Industry trends are shortening certificate lifetimes, manual rollover processes increasingly create operational burden and risk service disruption — especially in large organizations with many SAML enterprise applications.

Use Microsoft Defender for Cloud Apps with on-premises applications in Microsoft Entra ID. Use the Defender for Cloud Apps Conditional Access App Control to monitor and control sessions in real-time based on Conditional Access policies. You apply these policies to on-premises applications that use application proxy in Microsoft Entra ID.

| Month | 2021 | 2022 | 2023 | 2024 | 2025 | 2026 |

Learn how to troubleshoot common errors and configuration problems with Microsoft Entra application proxy.

- Execute each step **sequentially** and don't skip ahead.

author: arlucaID

This file is used by an AI coding agent (such as GitHub Copilot in VS Code Agent mode) to automate onboarding to Microsoft Entra Agent ID.

Use an AI coding agent to automate the onboarding process for Microsoft Entra Agent ID, including blueprint creation, credential configuration, and agent identity provisioning.

Learn how to use the What-if tool in Lifecycle Workflows to simulate workflow execution and preview results without impacting actual users.

1. If you want to allow users in external directories from connected organizations to be able to request access packages in this catalog, set **Enabled for external users** to **Yes**. The access packages must also have a policy allowing users from connected organizations to request. If the access packages in this catalog are intended only for users already in the directory, then set **Enabled for external users** to **No**.

Microsoft Entra ID simplifies how enterprises manage access to groups and applications in Microsoft Entra ID and other Microsoft web services with a feature called access reviews. This article covers how a designated reviewer performs an access review for members of a group or users with access to an application. If you want to review access to an access package, read [Review access of an access package in entitlement management](entitlement-management-access-reviews-review-access.md).

Learn how to configure web content filtering in Microsoft Entra Internet Access.

Learn how to manage the Internet Access traffic forwarding profile for Microsoft Entra Internet Access.

Global Secure Access includes Microsoft Entra Private Access and Microsoft Entra Internet Access. This article outlines data storage and privacy information.

Global Secure Access points of presence and IP addresses for Microsoft Entra Internet Access and Microsoft Entra Private Access.

Learn how to configure and deploy Microsoft Entra and Netskope Security Service Edge (SSE) solutions together for optimized security and connectivity across private applications, Microsoft 365, and internet access.

Learn how to manage the Private Access traffic forwarding profile for Microsoft Entra Private Access.

- **Free Microsoft Entra tenant** — [Create a new tenant](~/identity-platform/quickstart-create-new-tenant.md) with an [Azure free account](https://azure.microsoft.com/pricing/purchase-options/azure-account). This gives you Entra ID Free tier. You can then [activate a free trial of Microsoft Entra ID P1 or P2](~/fundamentals/get-started-premium.md) if needed for testing.

This article lists all releases of Microsoft Entra private network connector and describes new features and fixed issues.

Learn how to roll out traffic forwarding profiles to users and groups with Global Secure Access

Learn how to enable and manage the Microsoft traffic forwarding profile for Global Secure Access.

Learn about the built-in administrator roles you can assign to manage Global Secure Access permissions.

Learn how to access the Global Secure Access area of the Microsoft Entra admin center.

Learn how to configure per-app access to private resources in Global Secure Access.

Learn how to configure Quick Access to private resources in Global Secure Access.

Learn how to Install the Windows client to acquire Microsoft traffic in Global Secure Access.

Valid Global Secure Access configurations for custom remote network device links settings, including IKE, ASN, IPSec, and DH group.

Global Secure Access Threat intelligence threat types

Global Secure Access Web content filtering categories

Learn how to assign a remote network to a traffic forwarding profile for Global Secure Access.

Learn how to configure the connectivity between your customer premises equipment and the Global Secure Access network.

Learn how to list remote networks for Global Secure Access.

Learn how to update and delete remote networks for Global Secure Access.

Use these PowerShell samples for Global Secure Access.

Learn how to configure Microsoft and Zscaler SSE for unified SASE solutions to enhance security and connectivity in your organization.

Microsoft and Palo Alto Network’s Security Service Edge (SSE) coexistence solution guide.

Learn how to apply security policies like web content filtering, threat intelligence, and cloud firewall to remote network traffic in Global Secure Access.

Microsoft and Cisco’s Secure Access coexistence solution guide.

Microsoft and Cisco’s Security Service Edge (SSE) coexistence solution guide.

Microsoft and Cisco VPNs coexistence solution guide.

Configure Azure resources to simulate remote network connectivity to Microsoft's Security Edge Solutions with Global Secure Access.

The Global Secure Access Secure Web Gateway (SWG) implements defense-in-depth through five security layers that together create a comprehensive inspection chain for internet-bound traffic. Each layer serves a distinct protective function:

Learn how Microsoft's Security Service Edge (SSE) solution, Global Secure Access, provides network access control and visibility to users and devices inside and outside a traditional office.

Learn about the Microsoft Secure Access Service Edge (SASE) partner ecosystem. Learn about partner integrations and partner coexistence.

$RegistrySettings = @(

Monitor the health and status of your network traffic with the Global Secure Access dashboard.

Troubleshoot problems installing the Microsoft Entra private network connector.

A troubleshooting article that includes a workaround for a case where a Distributed File System (DFS) doesn't operate correctly with Global Secure Access.

Learn how to Create a remote network, apply Conditional Access, and review the logs in Global Secure Access.