Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Gauge your current knowledge
Gauge your current knowledge
The Remote Access role in Windows Server provides the foundation for connecting remote users and branch offices to the corporate network. This role includes several technologies such as DirectAccess, VPN, and Routing and Remote Access Services (RRAS). DirectAccess always-on connectivity for domain-joined clients, meaning remote users are automatically connected without manual action. Site-to-site VPNs connect entire offices, while VPN connectivity supports individual remote clients. The Remote Access role is managed through the Remote Access Management Console and Windows PowerShell, and it requires careful planning for network adapters, IP addressing, and security certificates.
Azure Network Adapter connects on-premises Windows Server machines to an Azure virtual network using a VPN connection. In practice, this adapter appears as a virtual network interface on the Windows Server that can reach Azure resources as if they were local. The setup requires installing the Point-to-Site VPN client on the on-premises server and configuring it to connect to a Virtual Network Gateway in Azure. Once connected, traffic flows from the on-premises server through the VPN tunnel and into the Azure virtual network, allowing hybrid applications to share data across on-premises and cloud environments without complex routing.
Azure extended network extends an on-premises subnet into Azure, allowing virtual machines in Azure to keep the same IP addresses they had on-premises. This capability is useful during migrations or disaster recovery, because it lets you move workloads without changing IP configurations. The extension works by creating a network extension between the on-premises network and an Azure virtual network, typically using a site-to-site VPN or ExpressRoute. Traffic flows through a Virtual Network Gateway, and the on-premises segment is stretched so that Azure VMs and on-premises machines can communicate directly. The tradeoff is that extended networks increase the dependency on the WAN link, so you need to ensure reliable bandwidth and low latency.
The Network Policy and Access Services (NPAS) role provides network authentication, authorization, and accounting services. The most common component is Network Policy Server (NPS), which acts as a Remote Authentication Dial-In User Service (RADIUS) server. NPS processes connection requests from network access servers such as VPN gateways, wireless access points, and 802.1X switches. It evaluates network policies (rules that define who can connect, when, and what network resources they can access) and logs accounting data for billing or auditing. When you deploy NPAS, you must create and order the policies because NPS evaluates them in priority order and stops at the first match. The role integrates with Active Directory to authenticate users and groups before applying the policy.
Web Application Proxy (WAP) is a reverse proxy that publishes on-premises web applications for external users. Users access the applications through Active Directory Federation Services (AD FS), which handles pre-authentication before the request reaches WAP. WAP receives the authenticated request and forwards it to the internal web server. This setup keeps the internal web server hidden from the internet, since WAP is the only server that is reachable externally. WAP can also handle pass-through authentication for non-claims-aware applications and provides load balancing across multiple web servers. To deploy WAP, you first configure AD FS, then install the WAP role service on a server in the perimeter network.
A site-to-site VPN connects an on-premises network to an Azure virtual network over the public internet using an encrypted tunnel. Both sides need a VPN device or service: on-premises, you use a VPN gateway (typically a hardware device or Windows RRAS), and in Azure you use a Virtual Network Gateway configured for site-to-site VPN. The connection is established using Internet Key Exchange (IKEv2) and the tunnel uses IPsec for encryption. Traffic flows from on-premises subnets through the on-premises gateway, across the internet, through the Azure VPN gateway, and into the Azure virtual network. You must configure local network gateways and connection objects in Azure to define the on-premises address space and the shared key. Site-to-site VPNs are always-on and suitable for persistent hybrid connectivity, but performance depends on internet bandwidth, so Azure ExpressRoute is a lower-latency alternative.
Azure Relay facilitates communication between on-premises services and cloud applications without opening firewall ports. The relay works by having the on-premises service initiate an outbound connection to the Azure Relay service in the Microsoft cloud. The cloud application then connects to Azure Relay, which relays messages between the two. Common use cases include exposing on-premises web services, databases, or legacy applications to Azure applications without requiring a VPN or direct inbound firewall rules. Azure Relay supports three modes: Hybrid Connections, WCF Relay, and Event Hubs Relay, each with different protocol and API support. The key benefit is that the on-premises service does not need a public IP address or static port; it only needs outbound connectivity to Azure.
Microsoft Entra Private Access allows users to access private corporate resources from anywhere using a Zero Trust network approach. Instead of placing users on the corporate network via VPN, each connection is authenticated and authorized individually. Microsoft Entra Private Access uses the Microsoft Entra ID identity system and the Global Secure Access client to create a secure tunnel between the user's device and the private resource. The service evaluates conditional access policies—such as requiring multi-factor authentication or checking device compliance—before granting access. This approach eliminates the need for a traditional VPN server and simplifies network perimeter management because it does not require opening inbound ports to the corporate network.
Microsoft Entra Application Proxy publishes on-premises web applications to external users through Microsoft Entra ID. The proxy consists of two components: the Application Proxy service running in Azure and the Application Proxy connector installed on-premises. The connector runs on a Windows Server and maintains an outbound connection to the Azure service. External users authenticate through Microsoft Entra ID; once authenticated, traffic flows from the user to the Application Proxy service, which forwards it through the connector to the on-premises application. The connector uses HTTP or HTTPS to communicate with the on-premises web application. Administrators configure application registration in Microsoft Entra ID and assign users and groups. This solution supports single sign-on, conditional access, and does not require a VPN because the connector only initiates outbound connections.
Microsoft Entra Private Access provides secure, zero-trust remote access to on-premises and private cloud resources without requiring a traditional VPN. When a user attempts to access an internal …
Microsoft Entra Private Access provides secure, zero-trust remote access to on-premises and private cloud resources without requiring a traditional VPN. When a user attempts to access an internal …
To connect an on-premises network to an Azure virtual network securely, you must first deploy an Azure VPN gateway within your virtual network. This gateway sits in its own dedicated gateway subne…
To connect an on-premises network to an Azure virtual network securely, you must first deploy an Azure VPN gateway within your virtual network. This gateway sits in its own dedicated gateway subne…
Network Policy Server (NPS) is a Windows Server role that handles three main jobs: checking who is trying to connect (authentication), deciding what they are allowed to do (authorization), and enf…
Network Policy Server (NPS) is a Windows Server role that handles three main jobs: checking who is trying to connect (authentication), deciding what they are allowed to do (authorization), and enf…
Microsoft Entra Application Proxy provides a secure way for remote users to access on-premises applications without setting up a VPN. The system works by placing lightweight connector agents on se…
Microsoft Entra Application Proxy provides a secure way for remote users to access on-premises applications without setting up a VPN. The system works by placing lightweight connector agents on se…
Design and Configure Relay Namespaces and Hybrid Connections
Design and Configure Relay Namespaces and Hybrid Connections
Routing and Remote Access (RRAS) is a Windows Server role that lets administrators create VPN tunnels for remote workers and branch offices. Site-to-site VPNs connect two locations, such as a main…
Routing and Remote Access (RRAS) is a Windows Server role that lets administrators create VPN tunnels for remote workers and branch offices. Site-to-site VPNs connect two locations, such as a main…
Deploy and Monitor Azure Network Adapter
Deploy and Monitor Azure Network Adapter
VPN (Virtual Private Network) and ExpressRoute are the two main ways to connect an on-premises network to Azure. A VPN sends encrypted traffic over the public internet, making it a good choice…
VPN (Virtual Private Network) and ExpressRoute are the two main ways to connect an on-premises network to Azure. A VPN sends encrypted traffic over the public internet, making it a good choice…
Web Application Proxy is a Windows Server role that lets users securely access on-premises web applications from outside the office network. It works with **Active Directory Federation Services (A…
Web Application Proxy is a Windows Server role that lets users securely access on-premises web applications from outside the office network. It works with **Active Directory Federation Services (A…
StudyCerts
StudyCerts