Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Gauge your current knowledge
Gauge your current knowledge
Microsoft Entra Application Proxy provides a secure way for remote users to access on-premises applications without setting up a VPN. The system works by placing lightweight connector agents on servers inside your network that create outbound connections to Azure. When a user tries to reach an internal application, the request goes through Azure AD for authentication first, then flows through the proxy to reach the internal application. This approach is more secure than VPNs because it keeps your internal network hidden from the public internet while still allowing remote access.
Connectors are small software agents that you install on Windows servers in your internal network. They must support Transport Layer Security (TLS) 1.2 and should be placed on the same network segment as the backend applications they protect for best performance. The connectors maintain persistent outbound connections to Azure, which means you do not need to open inbound ports in your firewall. Deploying multiple connectors across different machines ensures high availability—if one connector fails, traffic automatically routes through the remaining connectors.
When users connect to published applications, they authenticate through Azure AD before the proxy forwards their requests to internal resources. This pre-authentication step validates their identity and can check whether their device complies with your security policies. For applications that need single sign-on, you can use Kerberos Constrained Delegation (KCD) to pass user credentials through without requiring them to re-enter passwords. Conditional Access policies let you enforce additional security requirements based on factors like user location, device compliance status, or sign-in risk level.
To make an internal application available to remote users, you create an application object in Microsoft Entra ID with both an internal URL (for users on your local network) and an external URL (for remote users). You then assign connectors to Connector Groups and configure settings such as backend timeout values to match your application's needs. The Application Proxy handles all traffic over TLS encryption, ensuring that data remains secure while in transit. Various cookies manage session security and persistence.
You control who can access published applications by assigning users directly, syncing on-premises groups through Microsoft Entra Connect, or creating dynamic groups based on user attributes. Users can also discover and launch their assigned applications through the My Apps portal, which provides a central interface for accessing all published resources. This flexibility lets you match your access management approach to your organization's size and needs.
To understand how applications are being used and to detect potential issues, you rely on logs generated by Microsoft Entra ID and the connector servers. Audit logs in the Microsoft Entra admin center track changes to application configurations and user access. Usage reports show which applications users are accessing and when. On the connector servers themselves, Windows Event Logs capture details about connection health and any errors that occur. Together, these logging sources help you monitor for abnormal activities and ensure smooth operations.
StudyCerts
StudyCerts