Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Multi-Geo capability can help optimize the traffic flow from Microsoft Entra clients to Microsoft Entra apps through private access. This article explains how to enable the multi-Geo capability for Microsoft Entra Private Access.
Prerequisites
- You must have a Microsoft Entra Private Access license.
- You must have a Microsoft Entra Private Access connector group. For more information, see How to configure private network connectors for Microsoft Entra Private Access and Microsoft Entra application proxy.
- You must have the Global Secure Access Administrator role or the Privileged Role Administrator role. For more information, see Microsoft Entra Built-in Roles.
Overview
Multi-Geo capability helps optimize traffic flow from Microsoft Entra clients to Microsoft Entra apps through private access. Currently, the tenant's default geo location determines the Microsoft Entra routing for private access. For instance, if a tenant's default region is North America, all connector groups must connect to the Microsoft Entra backend in North America, even if some applications and connector groups are in different regions. Multi-Geo support lets customers optimize traffic flow by assigning connector groups according to their preferred geo locations instead of relying solely on the tenant's geo location. Each connector group connects to the SSE backend in the selected area, enhancing overall efficiency. This arrangement provides customers with the flexibility to direct connections to the SSE backend of their choice.
Enable multi-Geo capability
To enable the multi-Geo capability for Microsoft Entra Private Access, complete the following steps. This procedure involves creating connector group in different geographic region, installing connectors, and adding application segments to the connector group.
- Sign in to the Microsoft Entra admin center as a Global Secure Access Administrator.
- Browse to Applications > Enterprise applications > Private Network connectors.
- Create a connector group, associate it with a geographic region of your choice.
- Select + New Connector Group.
- In the New Connector Group pane, enter a name for the connector group.
- Under Advanced settings, select the optimized country/region for the connector group. The region you select determines the backend that the connector group connects to.
- Install a connector. The connector installation require working with an admin in the associated region. For more information, see How to configure private network connectors for Microsoft Entra Private Access and Microsoft Entra application proxy.
- Add an application segment to the connector group.
- Browse to Global Secure Access > Applications > Enterprise applications > Network access properties.
- Select + Add application segment.
- Select the application segment you want to add to the connector group.
- Select Save.
- After about 30 minutes, the multi-Geo configuration takes effect and traffic begins flowing.
Note
- Multi-Geo connectors aren't available through Quick Access. Multi-Geo supports only private enterprise apps.
- Multi-Geo doesn't support the Domain Name System (DNS) experience.
- Mulit-Geo doesn't support Japan region selection through Microsoft Entra admin center.