This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 98%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGV%3C/text%3E%3C/svg%3E)
Good day,
I need some advice or assistance with regards to Entra Private Connectors, we have done a deployment and everything is working however because of the region its a little slower than it should be.
We are based in EMEA however the default connector is set to NA and is greyed out, I have removed all apps and connectors from the default connector however I am still not able to change the region.
I have also tried to create a second connector group and have added this to the Europe region however when I try to add the applications to the group, it does not appear in the list.
Any suggestions would be greatly appreciated as I am not sure why this does not want to work.
We are looking to get away from traditional VPN for the ZTNA configuration and if we cannot get this working with Microsoft then we will need to look at another partner like zScaler.
Kind regards,
Gareth Vorster
So just to add to this I did some checks in powershell and am seeing the below. The issue here is that my tenant in in Europe I have confirmed this in multiple places but this is still showing these connectors on in North America? The custom connector I created shows as eur but I cannot see it listing on the applications? PS C:\WINDOWS\system32> Get-MgBetaOnPremisePublishingProfileConnectorGroup -OnPremisesPublishingProfileId applicationProxy | FL
Applications :
ConnectorGroupType : passthroughAuthentication
Id : 3c4aae4d-2e2a-xxxxxxxxxxxx
IsDefault : False
Members :
Name : Default group for Pass-through Authentication
Region : nam
AdditionalProperties : {}
Applications :
ConnectorGroupType : syncFabric
Id : a7fa412c-024b-xxxxxxxxxxxx
IsDefault : False
Members :
Name : Default group for AD Sync Fabric
Region : nam
AdditionalProperties : {}
Applications :
ConnectorGroupType : applicationProxy
Id : f9f994d5-d3f4-xxxxxxxxxxxx
IsDefault : False
Members :
Name : GSA
Region : eur
AdditionalProperties : {}
Applications :
ConnectorGroupType : syncFabric
Id : 3a72359e-737a-xxxxxxxxxxx
IsDefault : False
Members :
Name : Group-DOMAIN-08737644-6bcd-xxxxxxxxxx
Region : nam
AdditionalProperties : {}
Applications :
ConnectorGroupType : exchangeOnline
Id : ced3a238-e8d9-xxxxxxxx
IsDefault : False
Members :
Name : Default group for Exchange Online
Region : nam
AdditionalProperties : {}
Applications :
ConnectorGroupType : applicationProxy
Id : 76dcba2c-0568-xxxxxxxx
IsDefault : True
Members :
Name : Default
Region : nam
AdditionalProperties : {}
Really not sure where to go form here?
Any suggestions would be appreciated.
Kind regards, Gareth Vorster
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
@Gareth Vorster Apologies for the delayed response, let me check on the above mentioned ask and revert back, I also noticed you have opened a case # 2410100050001869 as well for the same.
@Givary-MSFT No problem, yes I have logged a ticket for it as we need to see if we can move off our current cloud proxy and move all our services to this before we have to renew the current solution. If I can get this issue resolved then we will be moving two of our solutions to this one and that will reduce our risk substantially. If you need anymore information please let me know as I can share this with you to assist in resolving the issue.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 84%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGB%3C/text%3E%3C/svg%3E)
Hi Gareth,
Microsoft will be implementing Multi-Geo connectors support in the first quarter of 2025. So stay tunned for upcoming announcements on this topic.
Best Regards,
Is there anyway I can get added to the list for prelaunch testing for the multigeo support?
@Gareth Vorster Thank you for reaching out to us, while researching on your issue came across this doc - https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-connectors where it is mentioned - Microsoft Entra Private Access does not support multi-geo connectors. The cloud service instances for your connector are chosen in the same region as your Microsoft Entra tenant (or the closest region to it) even if you have connectors installed in regions different from your default region.
Multi Geo Connector group functionality is unsupported for the GSA Private Access Apps flow. To address this, you must create/select a connector group from the same Tenant location.
Let me know if you have any further questions, feel free to post back.
Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.
Hi Givary, I have seen this, however currently the way it is working it should not be according to that article. My tenant is located in the EMEA region, I have checked this on the Azure Portal and in 365 and I have the same results.
@Gareth Vorster Thank you for more details like where the tenant is located, let me check on this and revert back.
@Gareth Vorster Regarding this issue, checked with my engineering team and here is the update which I have - Entra Private Access backend doesn't have an Africa geo - South Africa is not an EU country and is not considered EU for us. Therefore, it defaults to the default region which is NA. Once we support multi geo (which is in development) and soon we will have this feature available too. Let me know if you have any further questions, feel free to post back.
Hi Givary, this is disappointing news as I stated we were looking to move multiple services to Microsoft for GSA. What I don't understand is my tenant is set in the EU so I cannot understand why it would set our region would be set to NA. Do you perhaps have a timeline for when multi-geo will be available, as I need to know if I will be able to get GSA into our budget or if I would need to move to another solution outside of Microsoft's offering?
@Gareth Vorster Completely understand your concern, let me check on this and revert back.
@Givary-MSFT have you perhaps got any more news for me regarding our case?
Today I wanted to continue testing and now I cannot set my connectors back to the default group?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(172.8, 34%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERL%3C/text%3E%3C/svg%3E)
have the same issue, in South Africa and need to set the connector to EU, don't know why it's using North America. should be EU
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(105.60000000000001, 43%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDO%3C/text%3E%3C/svg%3E)
Is there a timeline for when Multi-Region support will be available within GSA?
We are wanting to make the switch to GSA for a VPN replacement though we have a segmented network with data centres in multiple countries - so having traffic route through our "home" region to a connector in another country is a poor experience with significant latency. Having the ability to map directly to a connector within that countries data centre would solve this.
Is there a timeframe for the Multi-Geo Connector enablement?
We have a large segmented network with servers in multiple Data Centers globally and routing GSA through our "home" M365 tenant location is causing extreme lag to applications in those Data Centers, even if the Connector is installed locally within that Data Center.
Thanks!
So this issue according to Microsoft cannot be fixed, so I am now going to have to look at solutions like zScaler or Netscope for ZTNA. For anyone else with this issue please note this, To get this working they need to implement Multi-Geo as it is right now if your MgBeta Graph setup is not in your tenant location then it will not allow you to add a connector to another region. What is odd is that my Tenant is EU/ZA for Azure and 365 but my graph is sitting in NA and cannot be moved according to the Microsoft engineer.