Connectors can be installed anywhere on the network that allows
them to send requests to the Application Proxy service. What's important is
that the computer running the connector also has access to your apps. You can
install connectors inside of your corporate network or on a virtual machine
that runs in the cloud. Connectors can run within a demilitarized zone (DMZ),
but it's not necessary because all traffic is outbound so your network stays
secure.
Connectors only send outbound requests.
The outbound traffic is sent to the Application Proxy service and to the
published applications. You don't have to open inbound ports because traffic
flows both ways once a session is established. You don't have to set up load
balancing between the connectors or configure inbound access through your
firewalls.
For more information about configuring
outbound firewall rules, see Work with existing on-premises proxy servers.
Use the Azure AD Application Proxy Connector Ports Test Tool to verify that your
connector can reach the Application Proxy service. At a minimum, make sure that
the Central US region and the region closest to you have all green checkmarks. Beyond
that, more green checkmarks means greater resiliency.
Comments