How are you handling Entra Application Proxy certificate rotations?
Asked by
MellowCedar42
For those using Microsoft Entra Application Proxy with custom domains, how are you managing certificate renewals? As far as I can tell, there is no straightforward automated ACME workflow for rotating the certificates bound to Application Proxy. I'm wondering whether others have built a solution, accepted the recurring roughly 47-day rotation process, or are considering migrating to another access-proxy platform because of it.
Answers
One alternative people consider is Cloudflare Zero Trust, although that would be a migration to a different access-proxy solution rather than a way to automate certificates inside Entra Application Proxy.
Reply to this answer
We still rotate the certificates on a schedule because there doesn’t seem to be a clean way to connect ACME renewal directly to the custom-domain binding. We made it less painful by treating it like a formal certificate runbook: start reminders around day 30, document who owns the private key, and use a second connector for staged validation when possible. The riskiest parts are usually transferring the private key and confirming that the custom-domain TLS binding updates without disrupting connector trust. Until Microsoft provides an automated renewal path, I’d plan for this as a recurring operations task. For us, the main reasons to consider moving away from Application Proxy would be broader session-control requirements and too many manual publishing workflows, rather than certificate rotation alone.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowCedar42: Right, it wouldn’t override Entra’s certificate limitations. It’s simply a separate platform with its own certificate and publishing model, so it only makes sense if the broader feature set and operational model are a better fit.