Access to On-Premises Resources
Application Proxy · Entra Private Access · Entra Domain Services · Kerberos
Practice questions for this topic →
Options
| Need | Solution |
|---|---|
| Remote access to on-prem web apps with Entra pre-authentication, no inbound firewall ports | Microsoft Entra application proxy |
| Zero-trust access to private apps on any protocol (RDP, SMB, SSH) without a VPN | Microsoft Entra Private Access (Global Secure Access) |
| SSO to an Integrated Windows Authentication app through App Proxy | Kerberos Constrained Delegation on the connector |
| SSO to an app that reads identity from HTTP headers | Header-based SSO |
| Legacy apps needing LDAP, Kerberos/NTLM or domain join in Azure, with no domain controllers to run | Microsoft Entra Domain Services |
Publishing a first app (Microsoft's tutorial order)
- 1. Install and verify the private network connector on a Windows server and register it with application proxy. 2. Add the on-premises application to your Entra tenant. 3. Grant admin consent for the User.Read permission (no longer automatic for new apps since June 30, 2026). 4. Verify that a test user can sign in with an Entra account.
Connectors, Private Access and Domain Services
- Since June 30, 2026 application proxy no longer automatically grants admin consent for the User.Read delegated permission when you create a new application proxy app; grant it explicitly after creating the app (existing apps aren't affected). It needs an Entra ID P1 or P2 subscription and an Application Administrator account.
- Application proxy publishes on-premises web apps through an external URL or the portal; it needs no inbound connections through your firewall, works with Conditional Access and MFA, and needs no DMZ. SSO methods: password-based, Integrated Windows Authentication (KCD), header-based, SAML. Pre-authentication must be set to Microsoft Entra ID before SSO.
- Private network connectors are lightweight agents on Windows Server inside your network, making outbound connections (ports 80 and 443). They're stateless, are grouped in connector groups (geography, segmentation), and Microsoft says to use at least two per group for high availability. The same connectors serve both application proxy and Private Access.
- Private Access lets you define private FQDNs and IPs and replace the VPN once the Global Secure Access client is installed. Quick Access is the primary group of resources; per-app (Global Secure Access) apps carry different Conditional Access policies for subsets of users or resources.
- Domain Services gives managed domain join, Group Policy, LDAP and Kerberos/NTLM. Entra ID stays the source of authority. It's a bridge for legacy workloads, not a replacement for on-premises AD.
Exam Tips
Tick each tip once you can answer it without looking.
“Publish an internal web app to remote users with MFA, no VPN, no inbound ports” → Entra application proxy + Conditional Access. Trap: App Proxy connectors make outbound connections only.
“Replace VPN for non-web apps (RDP, file shares) with Conditional Access” → Microsoft Entra Private Access. Trap: App Proxy is web-only.
“On-prem app uses Integrated Windows Authentication; users need SSO via App Proxy” → Kerberos Constrained Delegation (KCD).
“Legacy app reads user identity from HTTP headers” → App Proxy header-based SSO.
“High availability for App Proxy” → Install 2+ private network connectors in a connector group.
“Lift-and-shift app needing LDAP/Kerberos domain join, no DCs to manage” → Microsoft Entra Domain Services.
“Connector facts” → Windows Server agents, outbound ports 80 and 443, stateless, at least 2 per connector group. Trap: The same connectors serve App Proxy and Private Access.
“Private Access configuration” → Quick Access for the primary FQDNs and IPs; per-app Global Secure Access apps with their own Conditional Access. Trap: Needs the Global Secure Access client.
“Entra Domain Services” → Managed domain join, Group Policy, LDAP, Kerberos and NTLM without running domain controllers. Trap: A bridge for legacy workloads; Entra ID remains the source of authority.
“App Proxy SSO methods” → Password-based, Integrated Windows Authentication (KCD), header-based, SAML. Trap: Pre-authentication must be set to Entra ID first.
“New application proxy app after June 30, 2026” → Admin consent for User.Read is no longer granted automatically: grant it after creating the app. Trap: Applies to new apps only; existing apps aren't affected.
“Publish a first app through application proxy (Microsoft's tutorial order)” → Install and register the connector, add the app, grant User.Read admin consent, then verify a test user can sign in. Trap: Since June 30, 2026 the consent is no longer granted automatically for new apps.