I'm preparing a fresh Windows Server 2025 machine for a Microsoft Entra Private Access (Global Secure Access) connector. Microsoft's connector setup guide recommends running a script that enables TLS 1.2 for Schannel and configures .NET to use the system's strong TLS settings, followed by a restart.
Windows Server 2019, 2022, and 2025 generally support and enable TLS 1.2 by default, so I'm wondering whether this script is still necessary on a clean Server 2025 installation or whether it's mainly retained for older systems such as Server 2012 or 2016. In particular, does the connector require explicit .NET settings such as SystemDefaultTlsVersions and SchUseStrongCrypto, even when TLS 1.2 already works for the operating system?
Has anyone installed and registered the connector on Server 2025 without applying those registry changes, and did the installation complete successfully?
3 Answers
A clean Server 2025 installation should already have TLS 1.2 available, so the connector will usually work without manually creating the Schannel keys. However, the script also configures older .NET behavior through SystemDefaultTlsVersions and SchUseStrongCrypto. Those settings can matter if the connector or another dependency uses legacy .NET defaults, so applying Microsoft's documented script is a low-risk way to remove that uncertainty. Restart the server afterward.
If you are hardening the machine, treat TLS version settings separately from cipher-suite and protocol hardening. A tool or Group Policy can manage Schannel policy across servers, but you do not need a third-party utility just to run the published PowerShell configuration. Avoid disabling protocols or ciphers globally without checking the connector and other applications that share the server.
The connector needs TLS 1.2 for outbound connections; this does not mean you have to force TLS 1.2 exclusively for every inbound Schannel connection. On a current Windows Server build, the installer or registration process should expose a problem if it cannot establish the required connection, but testing the prerequisites before deployment is still worthwhile.
This was more commonly needed on older Windows Server versions, especially when older .NET applications did not automatically use the operating system's newer TLS defaults. Server 2025 is much less likely to need the workaround, but the documented configuration is still the safest supported path.