Trying to connect to an on premise server with GSA via Entra Private Connector

Question

Trying to connect to an on premise server with GSA via Entra Private Connector

Ryan Scherling 0

We are changing our environment a little and moving to a Entra ID environment, but we still are using some on premise servers. We have a lot of cloud native users that may want access to the servers, I tried downloading the Entra private connector but the application keeps saying setup failed please make sure all prerequisites are met. And in the event viewer i get:

Connector registration failed: Make sure your computer is able to connect to the Azure Active Directory Application Proxy service. For more information see: https://go.microsoft.com/fwlink/?linkid=2319117. Error: 'There was no endpoint listening at https:/https://xxxxxxxxxxxxxx.registration.msappproxy.net/register/RegisterConnector registration.msappproxy.net/register/RegisterConnector that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details.'

I do not know what I am missing to complete this connection.

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-04T14:03:35.0066667+00:00

Hello Ryan Scherling,

The error indicates that the connector registration is failing when attempting to reach the Microsoft Entra registration endpoint.

Please verify that the connector server has outbound HTTPS (TCP 443) connectivity and that any firewall, proxy, SSL inspection, or web filtering solution is not blocking access to the required Microsoft Entra endpoints. Also ensure that TLS 1.2 is enabled on the server.

To help narrow down the cause, could you please provide the following information:

The Windows Server version where the connector is being installed.

Whether the server accesses the internet through a proxy.

The complete Event Viewer error, including any InnerException details.

Connector logs from: C:\ProgramData\Microsoft AAD App Proxy Connector\Trace

Also, please confirm whether you are deploying the connector for Microsoft Entra Application Proxy or for Global Secure Access (Private Access), as the deployment requirements differ between the two solutions.
Ryan Scherling 0 Reputation points

2026-06-04T14:27:32.3666667+00:00

It is a windows Server 2022, it doesn't access internet over a proxy, that is the only error message i have, and im trying to deploy the connector as GSA.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-04T15:21:52.61+00:00
Hello Ryan Scherling,

Thank you for the details.

Windows Server 2022 is a supported operating system for the Microsoft Entra private network connector used by Global Secure Access (Private Access).

Since the server is not using an outbound proxy, the next thing to verify is connectivity from the connector server to the required Microsoft endpoints. The registration error you're seeing typically occurs when the connector is unable to communicate with the Microsoft registration service during setup.

Please check the following:

Outbound HTTPS (TCP 443) connectivity is allowed from the server.

DNS resolution is working correctly for *.msappproxy.net.

No firewall, web filtering, or SSL inspection device is blocking traffic to Microsoft endpoints.

The server can reach *.msappproxy.net and *.servicebus.windows.net, which are required by the connector.

I would also recommend reviewing the connector logs under the connector trace directory, as they often contain more detailed registration errors than the Event Viewer entry. Microsoft also provides a dedicated connector troubleshooting guide that may help identify the specific connectivity failure.

Could you confirm whether this is a new connector installation, and whether the server is able to successfully resolve and connect to the *.msappproxy.net endpoints over port 443?

1 answer

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-04T14:03:35.0066667+00:00

Hello Ryan Scherling,

The error indicates that the connector registration is failing when attempting to reach the Microsoft Entra registration endpoint.

Please verify that the connector server has outbound HTTPS (TCP 443) connectivity and that any firewall, proxy, SSL inspection, or web filtering solution is not blocking access to the required Microsoft Entra endpoints. Also ensure that TLS 1.2 is enabled on the server.

To help narrow down the cause, could you please provide the following information:

The Windows Server version where the connector is being installed.

Whether the server accesses the internet through a proxy.

The complete Event Viewer error, including any InnerException details.

Connector logs from: C:\ProgramData\Microsoft AAD App Proxy Connector\Trace

Also, please confirm whether you are deploying the connector for Microsoft Entra Application Proxy or for Global Secure Access (Private Access), as the deployment requirements differ between the two solutions.
Ryan Scherling 0 Reputation points

2026-06-04T14:27:32.3666667+00:00

It is a windows Server 2022, it doesn't access internet over a proxy, that is the only error message i have, and im trying to deploy the connector as GSA.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-04T15:21:52.61+00:00

Hello Ryan Scherling,

Thank you for the details.

Windows Server 2022 is a supported operating system for the Microsoft Entra private network connector used by Global Secure Access (Private Access).

Since the server is not using an outbound proxy, the next thing to verify is connectivity from the connector server to the required Microsoft endpoints. The registration error you're seeing typically occurs when the connector is unable to communicate with the Microsoft registration service during setup.

Please check the following:

Outbound HTTPS (TCP 443) connectivity is allowed from the server.

DNS resolution is working correctly for *.msappproxy.net.

No firewall, web filtering, or SSL inspection device is blocking traffic to Microsoft endpoints.

The server can reach *.msappproxy.net and *.servicebus.windows.net, which are required by the connector.

I would also recommend reviewing the connector logs under the connector trace directory, as they often contain more detailed registration errors than the Event Viewer entry. Microsoft also provides a dedicated connector troubleshooting guide that may help identify the specific connectivity failure.

Could you confirm whether this is a new connector installation, and whether the server is able to successfully resolve and connect to the *.msappproxy.net endpoints over port 443?

Answer 1

The connector registration error indicates that the connector server cannot reach the Microsoft Entra Application Proxy/Global Secure Access service endpoint over HTTPS. The installer fails when prerequisites for connectivity are not met.

Use the following checks and steps on the connector server:

Confirm server prerequisites

OS: Windows Server 2016 or later.
.NET: At least 4.7.2 installed.
TLS: TLS 1.2 enabled on the server before installing the connector.
Role: Use an account with Application Administrator (or Global Secure Access Administrator / Global Admin for first connector) when prompted during registration.

See the Windows Server and TLS requirements in the prerequisites section: How to configure private network connectors for Microsoft Entra Private Access and Microsoft Entra application proxy.

Verify outbound network connectivity The error There was no endpoint listening at https://...registration.msappproxy.net/register/RegisterConnector almost always means the connector cannot reach the Application Proxy/Global Secure Access service over HTTPS.

On the connector server:

Ensure outbound ports are open:
- TCP 80: for downloading certificate revocation lists (CRLs).
- TCP 443: for all outbound communication with the Application Proxy/Global Secure Access service.
If a firewall or proxy is in the path, verify it allows outbound HTTPS from the server (including Windows services running as Network Service) to the required Microsoft Entra Application Proxy/Global Secure Access URLs.
If the firewall enforces traffic by originating user, explicitly allow ports 80 and 443 for Windows services that run as Network Service.

Confirm the correct tenant and role during installation

Sign in to the Microsoft Entra admin center with an Application Administrator (or Global Secure Access Administrator/Global Admin for the first connector) in the correct tenant.
Download the connector from Global Secure Access > Connect > Connectors using that same tenant.
Run the installer on the connector server and, when prompted, sign in with the same admin account.

Reinstall with latest connector version

If a previous connector was installed, uninstall it and delete any related folders before reinstalling, as recommended.
Ensure the connector version is at least 1.5.3417.0 and that .NET 4.7.1+ (and for current guidance, 4.7.2+) is present.

Verify installation and registration After resolving connectivity and reinstalling:

In the Microsoft Entra admin center, go to Global Secure Access > Connect > Connectors and confirm the connector appears and shows as Active.
On the connector server, open services.msc and verify these services are Running:
- Microsoft Entra private network connector
- Microsoft Entra private network connector updater If not running, start them manually.

If the error persists after confirming OS, .NET, TLS 1.2, and outbound 80/443 access to the required URLs, use the connector diagnostics tool (installed with the connector) to test connectivity and review its output for any blocked endpoints.

References: