Microsoft Entra application proxy errors: connector events, gateway messages and fixes

Microsoft Entra application proxy publishes on-premises web apps through an outbound-only connector, so every failure lands in one of three places: the browser error page, the connector's event logs, or the Kerberos hop to the back end. This quick reference lists the messages and events Microsoft documents for each, with the usual cause and the first check, plus the tests that prove which hop is broken.

How to read these codes#

• The browser page says This corporate app can't be accessed and shows a Status Code at the bottom left. Gateway time-out means the cloud service couldn't reach a connector; Bad gateway means the connector couldn't reach the app; Forbidden means the user isn't authorized. Note the TransactionID and Timestamp: they match connector events.
• Connector runtime events: Event Viewer › Applications and Services Logs › Microsoft › Microsoft Entra private network › Connector › Admin (Kerberos events, trust certificate). The updater writes to … › Updater › Admin.
• Registration failures: Windows Logs › Application, source Microsoft Entra private network connector. Installer logs go to %TEMP%.
• Naming: the connector is now the Microsoft Entra private network connector, shared with Microsoft Entra Private Access. Its services are WAPCSvc (Network Service) and WAPCUpdaterSvc (Local System).
• Connector Diagnostics tool: from connector version 1.5.4287.0, ConnectorDiagnosticsTool in the install folder checks the certificate, ports 80/443, the outbound proxy, CRL access, the service and the back-end endpoint.

Sign-in failures before the app is reached (preauthentication) are ordinary Entra sign-ins; read their AADSTS codes in the AADSTS quick reference and Conditional Access blocks in AADSTS53000 vs AADSTS53003.

Browser messages users see#

Connector installation and registration errors#

# Latest registration error, then re-register an existing connector
Get-EventLog -LogName Application -Source "Microsoft Entra private network connector" -EntryType Error -Newest 1
Import-Module MicrosoftEntraPrivateNetworkConnectorPSModule
Register-MicrosoftEntraPrivateNetworkConnector

The installer credentials are used only for registration; afterward the connector authenticates with its own certificate. Its thumbprint is in %ProgramData%\Microsoft\Microsoft Entra Private Network Connector\Config\TrustSettings.xml, issued for connectorregistrationca.msappproxy.net.

Connector runtime and status problems#

Kerberos constrained delegation (KCD) events#

Microsoft's KCD troubleshooting guide checks three stages in order: preauthentication, the delegation service, then the app. The essentials:

• Internal DNS uses an A record, not a CNAME, for the app address.
• The connector's computer account may delegate to the app's SPN with Use any authentication protocol; setspn -x finds duplicate SPNs.
• A domain policy capping Kerberos token size can block the ticket.
• In IIS, Negotiate sits above NTLM. A response blob starting TlRMTVNTUAAB is NTLM; Kerberos blobs start YII.
• Switch the app's SSO from Integrated Windows authentication to Microsoft Entra single sign-on disabled: if users then get in, the fault is KCD. Ticket-side KDC errors are in the Kerberos error codes reference.

How to verify a fix#

1. Services and status: Get-Service WAPCSvc, WAPCUpdaterSvc shows both Running, and the connector is Active under Global Secure Access › Connect › Connectors.
2. Diagnostics: run ConnectorDiagnosticsTool; every check should pass.
3. Internal path: open the internal URL from the connector server. Good: the app loads, and the response offers Negotiate.
4. External path: sign in through the external URL as an assigned, licensed user. Good: the app opens without a prompt, and the Connector Admin log shows no new 12008, 13019 or 13022.
5. Remove any test changes (preauthentication off, NTLM removed, extended protection off) once Kerberos works.

To purge stale Kerberos tickets on the back-end server after an SPN or identity change, Microsoft documents this command:

Get-WmiObject Win32_LogonSession | Where-Object {$_.AuthenticationPackage -ne 'NTLM'} |
    ForEach-Object {klist.exe purge -li ([Convert]::ToString($_.LogonId, 16))}

References#

• Troubleshoot application proxy issues and errors (Microsoft Learn): user messages and Kerberos events.
• Troubleshoot "corporate app can't be accessed" (Microsoft Learn): gateway time-out, bad gateway and forbidden.
• Troubleshoot problems installing the private network connector (Microsoft Learn): registration errors, certificates and the diagnostics tool.