Werk #20238: Microsoft Entra ID connections: optional proxy
| Component | Checks & agents | ||
| Title | Microsoft Entra ID connections: optional proxy | ||
| Date | Sep 18, 2026 | ||
| Level | Trivial Change | ||
| Class | New Feature | ||
| Compatibility | Compatible - no manual interaction needed | ||
| Checkmk versions & editions |
|
You can now configure a proxy on a Microsoft Entra ID connection, under Setup > Microsoft Entra ID connections. The new Proxy option sits next to the tenant and client IDs in the Copy app IDs step of the connection wizard, and offers the usual choices: auto-detect from the environment, no proxy, a globally configured proxy, or an explicit URL.
The setting applies to every connection Checkmk makes to Microsoft on your behalf: the authorization request the wizard performs when you connect the mailbox, and the recurring Microsoft Graph API calls of the services configured via Check email, Check mailboxes and Check email delivery.
Why this matters
Without this option, these requests only honored the HTTP_PROXY, HTTPS_PROXY
and NO_PROXY variables of the site's process environment. If your site needs a
proxy to reach login.microsoftonline.com, the only fix was to add those
variables to ~/etc/environment on every site involved -- invisible in Setup,
not distributed with your configuration, and impossible to scope to Microsoft
alone.
A symptom worth recognizing: the connection wizard fails with a connection error
while curl to the very same token endpoint succeeds from a shell on the same
host. The shell and the site's processes simply do not share an environment.
Compatibility
Connections that have no proxy configured keep using the process environment, so
nothing changes for existing setups -- including ones already relying on
~/etc/environment.
Also improved
TLS failures on the token request are now reported as such. Because a certificate error surfaces as a subclass of a connection error, a TLS-inspecting proxy previously produced a bare "Connection error" that read like a network outage. The message now names the certificate problem and points at the global setting Trusted certificate authorities for SSL.