Application Proxy Connector Health

The question it answers: Which Application Proxy connector groups serving apps have no active connector, or hang on a single one, and which connectors are inactive?

Apps published through Microsoft Entra Application Proxy stop working the moment their connector group has no active connector. Groups serving apps with no active connector, inactive connectors and groups that hang on a single connector are listed first.

Note

There is no read-only permission for this API. If you do not want to grant a write permission to the reporting app, leave this report without data - it fails with a permission error and nothing else is affected.

At a glance

Where in the app	Entra ID › App & Workload Identities › App Proxy Connectors
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 (Application Proxy).
Report id (API and MCP)	entra.security.app-proxy-connectors

Columns

Column	Key	Type
Connector group	GroupName	Text
Machine	MachineName	Text
Status	Status	Status
Finding	Finding	Text
Apps in group	GroupApplications	Text
Active in group	GroupActiveConnectors	Text
External IP	ExternalIp	Text
Region	Region	Text
Default group	IsDefaultGroup	YesNo

Filters

Filter	Key (API)	On when the page opens
Only connectors and groups that need attention	attention	Yes

What it needs

Licence: Microsoft Entra ID P1 (Application Proxy).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
OnPremisesPublishingProfiles.ReadWrite.All	Microsoft Graph	Manage on-premises published resources	the only permission this API accepts - read-write

Data sources it reads

• GET /beta/onPremisesPublishingProfiles/applicationProxy/connectorGroups
• GET .../connectorGroups/{id}/members
• GET .../connectorGroups/{id}/applications

Through the API and MCP

GET /ir-api/v1/reports/entra.security.app-proxy-connectors?size=100
GET /ir-api/v1/reports/entra.security.app-proxy-connectors?filter=attention

An AI assistant reads it with the MCP tool get_report and the id entra.security.app-proxy-connectors. The client needs the Read grant for Entra ID. See Using the API.