L11. Application Proxy: Secure Remote Access to On-Prem Apps

What Is Application Proxy?

Entra Application Proxy provides secure remote access to on-premises web applications without requiring a VPN. Users access internal apps through a public URL, and Entra ID handles authentication before the traffic reaches your network. Key benefit: No inbound firewall ports need to be opened. The connector initiates outbound connections to the Application Proxy service.

Architecture

The Application Proxy architecture has three components:

1. Application Proxy service: Runs in the Microsoft cloud, handles external requests
2. Application Proxy connector: Lightweight agent installed on a Windows Server in your network
3. On-premises application: The internal web app you want to publish

Traffic flow:

1. User navigates to the external URL
2. Entra ID pre-authenticates the user (MFA, Conditional Access apply here)
3. A token is sent to the Application Proxy service
4. The service forwards the request to the connector
5. The connector accesses the on-premises application on behalf of the user
6. The response returns through the same path

Connector Groups

Connectors are organized into connector groups. Each published application is assigned to a connector group. This allows you to:

• Isolate applications by network segment
• Place connectors close to the applications they serve
• Provide high availability (multiple connectors per group)

Exam tip: You need at least two connectors per group for high availability. If a single connector goes down, the other handles all traffic. Connectors auto-update automatically.

Pre-Authentication Methods

Exam tip: Pre-authentication with Entra ID is always preferred because it enables Conditional Access, MFA, and identity-based security before traffic reaches your network. Passthrough bypasses all Entra ID security controls.

SSO to On-Premises Applications

Kerberos Constrained Delegation (KCD)

KCD enables seamless SSO to on-premises applications that use Windows Integrated Authentication (Kerberos):

1. Configure the connector machine for KCD in Active Directory
2. Set the connector service account SPN
3. Configure the application in Entra ID with the internal app SPN
4. The connector obtains a Kerberos ticket on behalf of the authenticated user

Exam tip: KCD requires the connector server to be domain-joined and to have delegation permissions configured in AD. If SSO fails, check that the connector service account has the correct SPN delegation.

Header-Based SSO

For applications that read identity from HTTP headers, Application Proxy can inject headers (like username, email, UPN) into the request before forwarding to the application.

SAML SSO

Application Proxy can perform SAML authentication with the on-premises application, providing SSO for apps that support SAML 2.0.

Custom Domains

By default, published apps get a URL like https://app-contoso.msappproxy.net. You can configure custom domains (e.g., https://app.contoso.com) by:

1. Adding a CNAME record pointing to the msappproxy.net domain
2. Uploading a matching TLS certificate (wildcard or specific)

Licensing

Application Proxy requires Entra ID P1 or P2 licensing. There is no additional per-app cost: the license covers unlimited published applications.