📖 What is Microsoft Entra ID Application Proxy?
Microsoft Entra ID Application Proxy is a service that allows users to access on-premises web applications from outside the corporate network without needing a VPN. It provides a secure remote access solution by routing traffic through the cloud and enforcing Entra ID authentication.
"The 'Connector' is the critical component here; it must be installed on a server within the on-premises network to facilitate the connection."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Microsoft Entra ID Application Proxy?
- ▸ The Application Proxy Connector is a lightweight agent installed on-premises that establishes an outbound connection to the cloud, removing the need for inbound firewall rules.
- ▸ Pre-authentication allows administrators to enforce Entra ID authentication and Conditional Access policies before a user is granted access to the internal web application.
- ▸ Kerberos Constrained Delegation (KCD) enables the proxy to provide Single Sign-On (SSO) for legacy on-premises applications that use Windows Integrated Authentication.
- ▸ External and Internal URLs distinguish the public-facing address users visit from the private network address the Connector uses to route traffic to the app.
- ▸ The service supports both Pre-authentication for enhanced security and Passthrough for applications that handle their own authentication independently of Entra ID.
🎯 How does Microsoft Entra ID Application Proxy appear on the MS-102 Exam?
A scenario might describe a requirement to provide secure remote access to an on-premises web app without using a VPN. You will be expected to identify Application Proxy and the necessity of the Connector.
You may be asked how to apply a Conditional Access policy to an internal application. The answer involves configuring the Application Proxy with Pre-authentication enabled to intercept the request.
Expect questions where you must troubleshoot connectivity issues; remember that the Connector only requires outbound HTTPS traffic on port 443 to communicate with the Entra ID service.
❓ Frequently Asked Questions
How does Application Proxy differ from a traditional VPN?
A VPN provides full network-level access to a corporate subnet, whereas Application Proxy provides granular, application-level access. This reduces the attack surface by exposing only specific web applications rather than the entire network.
What is the benefit of installing multiple Connectors?
Installing multiple Connectors on separate on-premises servers provides high availability and load balancing. If one server goes offline, the other Connectors continue to route traffic, preventing a single point of failure.
When should I use Passthrough authentication instead of Pre-authentication?
Use Passthrough when the application has its own robust authentication mechanism that cannot integrate with Entra ID, or when you want the application to handle all identity verification directly.