You have an on-premises app named Appl.

When publishing an on-premises application (App1) using Microsoft Entra Private Access, administrators must enable the Private Access profile within the Microsoft Entra admin center. The Private Access profile is a part of Global Secure Access, and it defines the configuration used to securely route traffic for private applications hosted on-premises or within private networks through Entra’s zero-trust access layer.

According to the Microsoft SC-300 official training material and Microsoft Learn module “Configure Microsoft Entra Private Access”, enabling the Private Access profile is performed from the Security profiles blade. This blade allows administrators to turn on or off specific Global Secure Access profiles — including Internet Access and Private Access — and to define access control behaviors such as authentication requirements and network routing logic.

The other options serve different roles:

Remote networks are used to define connectors and locations for routing traffic.

Traffic forwarding specifies device agent or connector traffic routing paths.

Connectors are the agents deployed on-premises to link private apps to the Entra fabric.

Therefore, to enable the Private Access profile, you must navigate to Microsoft Entra admin center → Global Secure Access → Security profiles, and from there toggle on Private Access.