To publish App1 using Microsoft Entra Application Proxy, you should allow outbound connections over HTTP and HTTPS on the firewall.

 Here's why:

Outbound connections: The Microsoft Entra Application Proxy connector, which is installed on a server within your private network, initiates the connection to the Microsoft Entra Application Proxy service in the cloud. This is an outbound connection, meaning it's going from your private network to the internet.

HTTP and HTTPS: The connector uses standard ports for web traffic to establish this connection. Specifically, it uses port 80 for HTTP and port 443 for HTTPS. It communicates with the Microsoft Entra Application Proxy service and Microsoft's identity platform to authenticate and establish a secure tunnel. Since the communication is outbound and uses these standard ports, no inbound ports need to be opened on your firewall, which enhances security.