1. Secure Remote Access to on-premises Web Apps using Azure AD
Microsoft 2016
7/22/2018 3:35 PM
THR3062
Secure Remote Access to on-premises Web Apps using Azure AD
Girish Chander
Principal PM Manager
@chander_girish
Ross Adams
Senior Program Manager
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. What users want… Using their corporate identity Any Device Any Place
Any time
To all their apps (including on-prem)
Using their corporate identity

3. Traditional approaches for remote access
May open up access to entire network
Can be costly to manage and maintain
May not work for all devices

4. Identity as the core of enterprise mobility
Build 2012
7/22/2018
Identity as the core of enterprise mobility
Simple connection
SaaS
Azure
Public
cloud
Cloud
On-premises
Other directories
Windows Server
Active Directory
Self-service
Single sign-on
Microsoft Azure Active Directory

5. Cloud Control plane Conditional access control User attributes Devices
User identity
Group memberships
Auth strength (MFA)
Devices
Authenticated
MDM Managed (Intune)
Compliant with policies
Not lost/stolen
Application
Per-service
Managed client app
Conditional access control
Other
Inside corp. network
Outside corp. network
On-Premises applications

6. Azure AD Application Proxy
Remote Access as a Service
Easily publish your on-prem applications to users outside the corporate network
Extend Azure AD to on-prem
Utilize Azure AD as a central management point for all your apps
On-Premises Applications
Azure Active Directory

7. Microsoft 2016
7/22/2018 3:35 PM
Customer evidence
Azure Active Directory Application Proxy gives the Bristow Group secure remote access to core applications without the cost and complexity of using a virtual private network or other on-premises application publishing tools
For the Bristow Group a leading provider of global industrial aviation services, mobility is key
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

8. Stephen Booth, IT Solution Manager, Unilever
Customer evidence
“We’re also publishing more than 200 on prem web applications to the cloud with Azure Active Directory App Proxy which makes our employees lives easier since they can securely access these apps without VPN.”  
Stephen Booth, IT Solution Manager, Unilever

9. Azure Active Directory Application Proxy
7/22/2018 3:35 PM
1000s OF APPS, 1 IDENTITY
Azure Active Directory Application Proxy
Microsoft Azure
Active Directory
Cloud service that allows users to remotely access on-prem apps from securely from any device and any place
Different types of web-apps and APIs can be ‘published’
Application Proxy
Users connect to the ‘published’ apps and cloud service routes traffic to the backend applications via ‘connectors’
DMZ
Connectors are usually deployed inside the corpnet next to the applications. They maintain an out-bound connection to the service
Corporate network
Connector
Connector
Multiple connectors can be deployed for redundancy, scale and access to different sites
Resource
Resource
Resource
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10. Many different application types supported
Browser based web apps w/ Windows AuthN
Browser based web apps w/ forms based AuthN
Rich Client HTTP Apps
(ADAL integrated)
Other apps
(Clients w/o ADAL, web apps w/ special rqmts, non-HTTP apps etc)
Pass-thru and pre-auth supported
True SSO possible using KCD
Password vaulting based SSO
Supported if client can pass bearer token to proxy app.
Combine with KCD for SSO
Supported through Remote desktop publishing

11. Azure Active Directory Application Proxy & Ping Access
7/22/2018 3:35 PM
1000s OF APPS, 1 IDENTITY
Azure Active Directory Application Proxy & Ping Access
Microsoft Azure
Active Directory
Ping Identity and Microsoft will partner to expand the reach of Azure AD app proxy
Apps that use HTTP-header/cookie based authentication
Apps sitting behind legacy WAM products like SiteMinder, etc.
Integration Timeline:
Public preview: early CY 2017
Application Proxy
DMZ
Corporate network
Connector
Connector
Resource
Resource
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12. Demo!

13. Free IT Pro resources To advance your career in cloud technology
Microsoft Ignite 2016
7/22/2018 3:35 PM
Free IT Pro resources To advance your career in cloud technology
Plan your career path
Microsoft IT Pro Career Center
Cloud role mapping
Expert advice on skills needed
Self-paced curriculum by cloud role
$300 Azure credits and extended trials
Pluralsight 3 month subscription (10 courses)
Phone support incident
Weekly short videos and insights from Microsoft’s leaders and engineers
Connect with community of peers and Microsoft experts
Get started with Azure
Microsoft IT Pro Cloud Essentials
Demos and how-to videos
Microsoft Mechanics
Connect with peers and experts
Microsoft Tech Community
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

14. Please evaluate this session
7/22/2018 3:35 PM
Please evaluate this session
Your feedback is important to us!
From your PC or Tablet visit MyIgnite at
From your phone download and use the Ignite Mobile App by scanning the QR code above or visiting
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.