You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/app-proxy/application-proxy-faq.yml
+15-15Lines changed: 15 additions & 15 deletions
Original file line number
Diff line number
Diff line change
@@ -27,12 +27,12 @@ sections:
27
27
- Enable/Disable “Allow public clients flows”.
28
28
- CWAP_AuthSecret (Client secrets).
29
29
- API Permissions.
30
-
Modifying any of the above configuration items on the App registration page will break pre-authentication for Azure AD Application Proxy.
30
+
Modifying any of the above configuration items on the App registration page breaks pre-authentication for Azure AD Application Proxy.
31
31
32
32
- question: |
33
33
Can I delete an App Proxy app from the App registrations page in the Microsoft Entra admin center?
34
34
answer: |
35
-
No. You should delete an App Proxy app from the **Enterprise applications** area of the Microsoft Entra admin center. If you delete the App Proxy app from the **App registrations** area of the Microsoft Entra admin center then you could experience issues.
35
+
No. You should delete an App Proxy app from the **Enterprise applications** area of the Microsoft Entra admin center. If you delete the App Proxy app from the **App registrations** area of the Microsoft Entra admin center, then you could experience issues.
36
36
- question: |
37
37
What license is required to use Microsoft Entra application proxy?
38
38
answer: |
@@ -41,12 +41,12 @@ sections:
41
41
- question: |
42
42
What happens to Microsoft Entra application proxy in my tenant, if my license expires?
43
43
answer: |
44
-
If your license expires, Application Proxy will automatically be disabled. Your application information will be saved for up to one year.
44
+
If your license expires, Application Proxy is automatically disabled. Your application information is saved for up to one year.
45
45
46
46
- question: |
47
47
Why is the "Enable Application Proxy button grayed out?
48
48
answer: |
49
-
Make sure you have at least a Microsoft Entra ID P1 or P2 license and a Microsoft Entra application proxy Connector installed. After you successfully install your first connector, the Microsoft Entra application proxy service will be enabled automatically.
49
+
Make sure you have at least a Microsoft Entra ID P1 or P2 license and a Microsoft Entra application proxy Connector installed. After you successfully install your first connector, the Microsoft Entra application proxy service is enabled automatically.
50
50
51
51
- name: Connector configuration
52
52
questions:
@@ -62,9 +62,9 @@ sections:
62
62
63
63
To manually upgrade a connector:
64
64
65
-
- Download the latest version of the connector. (You will find it under Application Proxy on the Microsoft Entra admin center. You can also find the link at [Microsoft Entra application proxy: Version release history](./application-proxy-release-version-history.md).
65
+
- Download the latest version of the connector. (You can find it under Application Proxy on the Microsoft Entra admin center. You can also find the link at [Microsoft Entra application proxy: Version release history](./application-proxy-release-version-history.md).
66
66
- The installer restarts the Azure AD Application Proxy Connector services. In some cases, a reboot of the server might be required if the installer cannot replace all files. Therefore we recommend closing all applications (i.e. Event Viewer) before you start the upgrade.
67
-
- Run the installer. The upgrade process is quick and does not require providing any credentials and the connector will not be re-registered.
67
+
- Run the installer. The upgrade process is quick and does not require providing any credentials and the connector is not re-registered.
68
68
69
69
- question: |
70
70
Can Application Proxy Connector services run in a different user context than the default?
@@ -102,7 +102,7 @@ sections:
102
102
- question: |
103
103
Should I create a dedicated account to register the connector with Microsoft Entra application proxy?
104
104
answer: |
105
-
There's no reason to. Any Global Administrator or application administrator account will work. The credentials entered during installation aren't used after the registration process. Instead, a certificate is issued to the connector, which is used for authentication from that point on.
105
+
There's no reason to. Any Global Administrator or application administrator account works. The credentials entered during installation aren't used after the registration process. Instead, a certificate is issued to the connector, which is used for authentication from that point on.
106
106
107
107
- question: |
108
108
How can I monitor the performance of the Microsoft Entra application proxy connector?
@@ -121,7 +121,7 @@ sections:
121
121
- question: |
122
122
What versions of Windows Server can I install a connector on?
123
123
answer: |
124
-
Application Proxy requires Windows Server 2012 R2 or later. There is currently a limitation on HTTP2 for Windows Server 2019. In order to successfully use the connector on Windows Server 2019, you will need to add the following registry key and restart the server:
124
+
Application Proxy requires Windows Server 2012 R2 or later. There is currently a limitation on HTTP2 for Windows Server 2019. In order to successfully use the connector on Windows Server 2019, you need to add the registry key and restart the server:
How do I change the landing page my application loads?
182
182
answer: |
183
-
From the Application Registrations page, you can change the homepage URL to the desired external URL of the landing page. The specified page will load when the application is launched from My Apps or the Office 365 Portal. For configuration steps, see [Set a custom home page for published apps by using Microsoft Entra application proxy](application-proxy-configure-custom-home-page.md)
183
+
From the Application Registrations page, you can change the homepage URL to the desired external URL of the landing page. The specified page is loaded when the application is launched from My Apps or the Office 365 Portal. For configuration steps, see [Set a custom home page for published apps by using Microsoft Entra application proxy](application-proxy-configure-custom-home-page.md)
184
184
185
185
- question: |
186
186
Why do I get redirected to a truncated URL when I try to access my published application whenever the URL contains a "#" (hashtag) character?
187
187
answer: |
188
-
If Microsoft Entra pre-authentication is configured, and the application URL contains a “#” character when you try to access the application for the first time, you get redirected to Microsoft Entra ID (login.microsoftonline.com) for the authentication. Once you complete the authentication you get redirected to the URL part prior to the ”#” character and everything that comes after the “#“ seems to be ignored/ removed. For example if the URL is `https://www.contoso.com/#/home/index.html`, once the Microsoft Entra authentication is done the user will be redirected to `https://www.contoso.com/`.
188
+
If Microsoft Entra pre-authentication is configured, and the application URL contains a “#” character when you try to access the application for the first time, you get redirected to Microsoft Entra ID (login.microsoftonline.com) for the authentication. Once you complete the authentication you get redirected to the URL part prior to the ”#” character and everything that comes after the “#“ seems to be ignored/ removed. For example if the URL is `https://www.contoso.com/#/home/index.html`, once the Microsoft Entra authentication is done the user is redirected to `https://www.contoso.com/`.
189
189
This behavior is by design due to how the “#” character is handled by the browser.
190
190
191
191
Possible solutions/ alternatives:
@@ -202,7 +202,7 @@ sections:
202
202
- question: |
203
203
Can I configure Application Proxy to add the HSTS header?
204
204
answer: |
205
-
Application Proxy does not automatically add the HTTP Strict-Transport-Security header to HTTPS responses, but it will maintain the header if it is in the original response sent by the published application. Proving a setting to enable this functionality is on the roadmap.
205
+
Application Proxy does not automatically add the HTTP Strict-Transport-Security header to HTTPS responses, but it maintains the header if it is in the original response sent by the published application. Proving a setting to enable this functionality is on the roadmap.
206
206
207
207
- question: |
208
208
Can I use a custom port number in the external URL?
@@ -272,7 +272,7 @@ sections:
272
272
answer: |
273
273
No, this won’t work, because a guest user in Microsoft Entra ID doesn't have the attribute that is required by any of the logon identities mentioned above.
274
274
275
-
In this case there will be a fallback to “User principal name”. For more details on the B2B scenario please read [Grant B2B users in Microsoft Entra ID access to your on-premises applications](../external-identities/hybrid-cloud-to-on-premises.md).
275
+
In this case there is a fallback to “User principal name”. For more details on the B2B scenario please read [Grant B2B users in Microsoft Entra ID access to your on-premises applications](../external-identities/hybrid-cloud-to-on-premises.md).
276
276
277
277
- name: Pass-through authentication
278
278
questions:
@@ -284,7 +284,7 @@ sections:
284
284
- question: |
285
285
Can I publish a web application with client certificate authentication requirement?
286
286
answer: |
287
-
No, this scenario isn't supported because Application Proxy will terminate TLS traffic.
287
+
No, this scenario isn't supported because Application Proxy terminates TLS traffic.
288
288
289
289
- name: Remote Desktop Gateway publishing
290
290
questions:
@@ -314,7 +314,7 @@ sections:
314
314
315
315
- question: |
316
316
Can I use the Resources Launch Method option "Download the rdp file" under Settings on the Remote Desktop Web Client Portal in Microsoft Entra pre-authentication scenario?
317
-
answer: This option enables the user to download the rdp file and use it by another RDP client (outside of the Remote Desktop Web Client). Typically, another RDP clients (like the Microsoft Remote Desktop Client) cannot handle the pre-authentication natively. That's why this will not work.
317
+
answer: This option enables the user to download the rdp file and use it by another RDP client (outside of the Remote Desktop Web Client). Typically, another RDP clients (like the Microsoft Remote Desktop Client) cannot handle the pre-authentication natively. That's why the scenario doesn't work.
318
318
319
319
- name: SharePoint publishing
320
320
questions:
@@ -369,7 +369,7 @@ sections:
369
369
answer: |
370
370
This scenario isn't supported directly. Your options for this scenario are:
371
371
372
-
1. Publish both the HTTP and HTTPS URLs as separate applications with a wildcard, but give each of them a different custom domain. This configuration will work since they have different external URLS.
372
+
1. Publish both the HTTP and HTTPS URLs as separate applications with a wildcard, but give each of them a different custom domain. This configuration works since they have different external URLS.
373
373
374
374
2. Publish the HTTPS URL through a wildcard application. Publish the HTTP applications separately using these Application Proxy PowerShell cmdlets:
0 commit comments