Removing the inbound firewall rule for an Entra application proxy connector

SC-100 By islever Editorial Last updated

Evaluate solutions for network security and Security Service Edge (SSE)

Short answer

A Remove Rule1 (inbound TCP 443); the connector is outbound-only, so no inbound rule is needed and removing it improves security.

Question

Your on-premises network contains an Active Directory Domain Services (AD DS) domain named corp.contoso.com and an AD DS-integrated application named App1. Your perimeter network contains a server named Server1that runs Windows Server. You have a Microsoft Entra tenant named contoso.com that syncs with corp.contoso.com. You plan to implement a security solution that will include the following configurations: • Manage access to App1 by using Microsoft Entra Private Access. • Deploy a Microsoft Entra application proxy connector to Server1. • Implement single sign-on (SSO) for App1 by using Kerberos constrained delegation. • For Server1, configure the following rules in Windows Defender Firewall with Advanced Security: o Rule1: Allow TCP 443 inbound from a designated set of Azure URLs, o Rule2: Allow TCP 443 outbound to a designated set of Azure URLs, o Rule3: Allow TCP 80 outbound to a designated set of Azure URLs, o Rule4: Allow TCP 389 outbound to the domain controllers on corp.contoso.com. You need to maximize security for the planned implementation. The solution must minimize the impact on the connector. Which rule should you remove?
  1. Rule1 Correct Answer
  2. Rule2
  3. Rule3
  4. Rule4

Key Takeaways

Connectors require only outbound 80 and 443 (Rule3 and Rule2) and TCP 389 to domain controllers for KCD (Rule4); there is no inbound requirement, so Rule1 (inbound 443) can be removed.

An Entra application proxy / Private Access connector uses outbound-only connectivity, so the inbound TCP 443 rule (Rule1) is unnecessary and should be removed to maximize security while minimizing impact on the connector.

Common mistake: Removing Rule3 (outbound TCP 80) — that rule is required for connector certificate renewal, so removing it would break the connector; only the inbound rule (Rule1) is safe to remove.

Expert Analysis

Why the Answer Is Correct

Microsoft Entra application proxy and Private Access connectors communicate with Azure only over outbound connections (TCP 80 and 443). There is no inbound requirement, so Rule1 (Allow TCP 443 inbound) is unnecessary and removing it improves security without affecting the connector.

Why the Other Options Are Wrong

Rule2 (443 outbound) and Rule3 (80 outbound) are required for connector operation and certificate renewal, so removing them would break connectivity. Rule4 (389 outbound to domain controllers) is needed for Kerberos constrained delegation SSO, so it must remain.

Community Comment Notes

The community favored A (55 votes). Comments explain that application proxy is outbound-only and that inbound ports are never needed; a minority (C, 45 votes) suggested removing the less-secure TCP 80 outbound, but that rule is required for certificate renewal.

Official Reference

https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-connectors

This link opens the official vendor documentation in a new tab.

Community Votes

A
55%
C
45%

55% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. Er_01 👍 3 Answered C
    https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-connectors The question is unclear what “maximize security” means as the doc says you need both 80/443 out. If it means to allowing PKI to work, C is correct A is wrong because inbound is not referenced at all B can be correct as 443 out allows this to work using CA/GSA to work meeting goal. D is wrong because Kerberos needs 88 to the DC, in addition to 389. All told, a terrible question.
  2. 424ede1 👍 2 Answered A
    In application proxy, ALL ACCESS IS OUTBOUND. The private network connectors only use outbound connections to the application proxy service in the cloud over ports 80 and 443. With no inbound connections, there's no need to open firewall ports for incoming connection. This strategy means that your backend servers are not exposed to direct HTTP traffic. They are better protected against targeted DoS because your firewall isn't under attack. https://learn.microsoft.com/en-us/entra/identity/app-proxy/overview-what-is-app-proxy#security-benefits
  3. Ali96 👍 2 Answered C
    Since Rule3 (TCP 80 outbound) is less secure compared to other rules, it should be removed to maximize security without significantly impacting the connector, assuming the connector can still operate without the need for HTTP (TCP 80) traffic
  4. Lrrr_FromOmicronPersei8 👍 2 Answered A
    Remove Rule1, Entra ID Application Proxy relies on outbound-only connectivity.
  5. Lrrr_FromOmicronPersei8 👍 2 Answered A
    Remove Rule1. Entra Application Proxy requires no inbound connectivity.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Microsoft Entra Permissions Management to find unused RBAC assignments

S-grade

Scenarios supported by compliant network check in Global Secure Access

S-grade

Changing DNS MX records to route all inbound mail through Defender for Office 365

S-grade

Applying customer-managed key encryption at the file level in Data Lake Storage

S-grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide