1. Azure AD Application Proxy
TechReady 18
9/10/2018
Azure AD Application Proxy
EMS Partner Bootcamp
© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Application Access Scenarios
Azure Active Directory
Azure AD Application Proxy
SaaS Apps
Forefront UAG/TMG
Web Application Proxy +
AD FS
On-Prem Apps
On-Prem Apps
Active Directory

3. Azure AD Application Proxy
Remote Access as a Service
Easily publish your on-prem applications to users outside the corporate network
Extend Azure AD to on-prem
Utilize Azure AD as a central management point for all your apps
On-Premises Applications
Azure Active Directory

4. How it works Connectors are deployed on corpnet
Multiple connectors can be deployed for redundancy and scale
The connector auto connects to the cloud service
User connects to the cloud service that routes their traffic to the resources via the connectors
Azure Active Directory
Application Proxy
DMZ
Corporate Network
Connector
Connector
App
App
App

5. SSO from the cloud
Single Sign-on experience from Azure Active Directory to on-prem applications
Connectors use the Azure AD token data to impersonate as the end user to the backend applications using Kerberos Constrained Delegation (KCD)
Support any application that uses Integrated Windows Authentication (IWA) such as SharePoint, Outlook Web Access and CRM.
No need to change the backend applications
No need to install agents on backend applications
No need to expose on-prem apps directly to the Internet
Azure Active Directory
Application Proxy
Azure AD Token:
DMZ
Corporate Network
Connector
Connector
Kerberos Ticket:
App
App
App

6. Use your own domain name
Why?
Domain name recognized by your users
Replace existing solutions / well known URLs
Have same internal and external URLs
Notifications and links just work
Some applications won’t work otherwise
How?
Upload a certificate with private key that covers the custom domain name (regular, wildcard or SAN)
Create a CNAME record in the external DNS to point to the msappproxy.net address
Azure Active Directory
Application Proxy
sales-contoso.msappproxy.net
External DNS
sales.contoso.com
Corporate Network
Connector
Connector
Internal DNS
sales.contoso.com
App

7. Demo Azure Application Proxy

8. Cloud Scale Security
All HTTP/S traffic is terminated in the cloud blocking most HTTP level attacks such as the Heartbleed bug.
Unauthenticated traffic filtered in the cloud – will not arrive on-prem.
No incoming connections to the corporate network – only outgoing connection to the Azure AD Application Proxy service
Internet facing service always up to date with latest security patches and server upgrades
Login abnormalities detection, reporting and auditing by Azure AD
Azure Active Directory
Application Proxy
DMZ
Corporate Network
Connector
Connector
App
App
App

9. SSO from the cloud
Single Sign-on experience from Azure Active Directory to on-prem applications
Connectors use the Azure AD token data to impersonate as the end user to the backend applications using Kerberos Constrained Delegation (KCD)
Support any application that uses Integrated Windows Authentication (IWA) such as SharePoint, Outlook Web Access and CRM.
No need to change the backend applications
No need to install agents on backend applications
No need to expose on-prem apps directly to the Internet
Azure Active Directory
Application Proxy
Azure AD Token:
DMZ
Corporate Network
Connector
Connector
Kerberos Ticket:
App
App
App

10. Use your own domain name
Why?
Domain name recognized by your users
Replace existing solutions / well known URLs
Have same internal and external URLs
Notifications and links just work
Some applications won’t work otherwise
How?
Upload a certificate with private key that covers the custom domain name (regular, wildcard or SAN)
Create a CNAME record in the external DNS to point to the msappproxy.net address
Azure Active Directory
Application Proxy
sales-contoso.msappproxy.net
External DNS
sales.contoso.com
Corporate Network
Connector
Connector
Internal DNS
sales.contoso.com
App

11. Azure AD Application Proxy http://channel9. msdn