Removing the inbound firewall rule for an Entra application proxy connector

Evaluate solutions for network security and Security Service Edge (SSE)
Answer Correct answer: A — Remove Rule1 (inbound TCP 443); the connector is outbound-only, so no inbound rule is needed and removing it improves security.

Your on-premises network contains an Active Directory Domain Services (AD DS) domain named corp.contoso.com and an AD DS-integrated application named App1. Your perimeter network contains a server named Server1that runs Windows Server. You have a Microsoft Entra tenant named contoso.com that syncs with corp.contoso.com. You plan to implement a security solution that will include the following configurations: • Manage access to App1 by using Microsoft Entra Private Access. • Deploy a Microsoft Entra application proxy connector to Server1. • Implement single sign-on (SSO) for App1 by using Kerberos constrained delegation. • For Server1, configure the following rules in Windows Defender Firewall with Advanced Security: o Rule1: Allow TCP 443 inbound from a designated set of Azure URLs, o Rule2: Allow TCP 443 outbound to a designated set of Azure URLs, o Rule3: Allow TCP 80 outbound to a designated set of Azure URLs, o Rule4: Allow TCP 389 outbound to the domain controllers on corp.contoso.com. You need to maximize security for the planned implementation. The solution must minimize the impact on the connector. Which rule should you remove?

  1. Rule1 Correct Answer
  2. Rule2
  3. Rule3
  4. Rule4
entra application proxy connector outbound only connectivity remove inbound firewall rule

Community Votes

A
55%
C
45%

55% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Connectors require only outbound 80 and 443 (Rule3 and Rule2) and TCP 389 to domain controllers for KCD (Rule4); there is no inbound requirement, so Rule1 (inbound 443) can be removed.

An Entra application proxy / Private Access connector uses outbound-only connectivity, so the inbound TCP 443 rule (Rule1) is unnecessary and should be removed to maximize security while minimizing impact on the connector.

Removing Rule3 (outbound TCP 80) — that rule is required for connector certificate renewal, so removing it would break the connector; only the inbound rule (Rule1) is safe to remove.

Community Discussion (5 comments)

424ede1 👍 2 Selected: A
In application proxy, ALL ACCESS IS OUTBOUND. The private network connectors only use outbound connections to the application proxy service in the cloud over ports 80 and 443. With no inbound connections, there's no need to open firewall ports for incoming connection. This strategy means that your backend servers are not exposed to direct HTTP traffic. They are better protected against targeted DoS because your firewall isn't under attack. https://learn.microsoft.com/en-us/entra/identity/app-proxy/overview-what-is-app-proxy#security-benefits
Lrrr_FromOmicronPersei8 👍 2 Selected: A
Remove Rule1, Entra ID Application Proxy relies on outbound-only connectivity.
Ali96 👍 2 Selected: C
Since Rule3 (TCP 80 outbound) is less secure compared to other rules, it should be removed to maximize security without significantly impacting the connector, assuming the connector can still operate without the need for HTTP (TCP 80) traffic
Er_01 👍 3 Selected: C
https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-connectors The question is unclear what “maximize security” means as the doc says you need both 80/443 out. If it means to allowing PKI to work, C is correct A is wrong because inbound is not referenced at all B can be correct as 443 out allows this to work using CA/GSA to work meeting goal. D is wrong because Kerberos needs 88 to the DC, in addition to 389. All told, a terrible question.
Lrrr_FromOmicronPersei8 👍 2 Selected: A
Remove Rule1. Entra Application Proxy requires no inbound connectivity.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Microsoft Entra application proxy and Private Access connectors communicate with Azure only over outbound connections (TCP 80 and 443). There is no inbound requirement, so Rule1 (Allow TCP 443 inbound) is unnecessary and removing it improves security without affecting the connector.

Why the Other Options Are Wrong

Rule2 (443 outbound) and Rule3 (80 outbound) are required for connector operation and certificate renewal, so removing them would break connectivity. Rule4 (389 outbound to domain controllers) is needed for Kerberos constrained delegation SSO, so it must remain.

Community Comment Notes

The community favored A (55 votes). Comments explain that application proxy is outbound-only and that inbound ports are never needed; a minority (C, 45 votes) suggested removing the less-secure TCP 80 outbound, but that rule is required for certificate renewal.

Official Reference

https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-connectors

Related Analysis

You have a Microsoft 365 subscription that contains 1,000 us

A-Grade

You have an Azure subscription. You plan to deploy enterpris

S-Grade

You have a Microsoft 365 subscription that contains 1,000 Mi

S-Grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide