4/17/2017 © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks.

4/17/2017 © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4/17/2017 Free Your Apps: Introducing Microsoft Azure Active Directory Application Proxy and Windows Server Web Application Proxy EM-B318 Meir Mendelovich & Arieh Bibliowicz, Program Managers, AD Product Group © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Agenda Application Proxies Overview
Azure AD Application Proxy: Preview and Future Windows Server Web Application Proxy: Q&A

Application Proxies Overview

Microsoft Remote Access Solutions
Intune System Center Desktop Virtualization RDS Gateway Azure RemoteApp VDI Session host Conditional Access Web Application Proxy Web Applications Azure AD Application Proxy Files LOB Apps DirectAccess & VPN Active Directory Azure Active Directory Remote Access Azure Virtual Networks

Conditional Access Scenarios
Azure Active Directory Azure AD Application Proxy SaaS Apps Web Application Proxy On-Prem Apps On-Prem Apps Active Directory

Azure AD Application Proxy

Motivation Remote Access as a Service Extend Azure AD to on-prem
Easily publish your on-prem applications to users outside the corporate network Extend Azure AD to on-prem Utilize Azure AD as a central management point for all your apps On-Premises Applications Azure Active Directory

Remote Access as a Service
Easy to deploy and operate: minimal on-prem footprint Secure remote access to business applications with zero DMZ on-prem infrastructure deployment and no network infrastructure change. Deep integration with Azure Active Directory Richness of AAD capabilities and experiences: IW access panel discovery and SSO, central application management across SaaS and on-prem, machine learning traffic analysis, multifactor authentication, analytics and reporting. Available for AAD Premium customers. More secure to the business: pre-DMZ protection All security verifications are outside of the organization premises done in cloud scale. DDoS attacks will not influence your business.

How it works Connectors are deployed on corpnet
Multiple connectors can be deployed for redundancy and scale The connector auto connects to the cloud service User connects to the cloud service that routes their traffic to the resources via the connectors Azure Active Directory Application Proxy DMZ Corporate Network Connector Connector Resource Resource Resource

Integrate on-prem apps with Azure AD
End-user portal – Access Panel Azure AD authentication capabilities: Username and password synced from on-prem AD Federated login to on-prem or other federation servers Multi-factor authentication Customized login screen Authorization based on user or groups SSO to Office365, thousands of SaaS apps and all applications integrated with AAD Reports, auditing and security monitoring based on big data and machine learning. Azure Active Directory Authorization Reporting & Auditing Security Monitoring Authentication + MFA Application Proxy Access Panel Portal DMZ Corporate Network Connector Connector Resource Resource Resource

Cloud Scale Security All HTTP/S traffic is terminated in the cloud blocking most HTTP level attacks. Unauthenticated traffic filtered in the cloud – will not arrive on-prem. No incoming connections to the corporate network – only outgoing connection to the Azure AD Application Proxy service Internet facing service always up to date with latest security patches and server upgrades Login abnormalities detection, reporting and auditing by Azure AD Azure Active Directory Application Proxy DMZ Corporate Network Connector Connector Resource Resource Resource

https://myapps.microsoft.com/
User: Password: Pass1234

What is keeping us busy

What is keeping us busy Service General Availability before the end of this year SSO to on-prem IWA (Kerberos) applications using cloud credentials Make your existing on-prem IWA application accessible from anywhere Users login with AAD, credentials are translated by the connectors. Custom domain publishing (app1.contoso.com) Use your own domain for the published applications URL Avoid the need for link translation with split-brain DNS Monitoring and managing of connectors from the cloud Once installed and registered – zero administration on the connectors Advanced monitoring and auditing capabilities Azure AD is the single point of auditing for all apps

Windows Server Web Application Proxy

Web Application Proxy vNext
Part of Windows Server vNext along AD FS vNext Web Application Proxy is the obvious choice to publish Office servers: Allow TMG and UAG customers to move to Web Application Proxy

Preview features in a glance
Publish more apps: Preauthentication for HTTP Basic protocols such as Exchange ActiveSync. Can enforce device registration. Wildcard publishing to support to ease SharePoint 2013 apps ( Allow HTTP publishing (not HTTPS) Built-in HTTP  HTTPS redirection Remote Desktop Gateway (RDG) publishing Less effort: Improved service log for complete audit trail and improved error handling New debug log for better troubleshooting Enable application editing in the UI Propagate client IP address to backend application

HTTP Basic / ActiveSync – How it works
Web Application Proxy terminates the request and passes all credentials to AD FS AD FS validates, applies policy and replies with a token Upon success, Web Application Proxy allows the request to pass to backend Web Application Proxy caches the token for future use AD AD FS Credentials Token Web Application Proxy Backend (Exchange or other) HTTPS with Basic Auth / client cert. HTTPS with Basic Auth

Wildcard Publishing In Windows Server 2012 R2, Web Application Proxy allowed publishing only by whitelisting specific domain names. In vNext, it allows publishing using wildcard domains:  Useful for: SharePoint 2013 apps publishing. Organizations that doesn’t want to whitelist published applications – publish bulk of sites at once.

HTTP Publishing and HTTP Redirection
HTTP Publishing: publish apps with no SSL. Only for pass-through apps. HTTP Redirection: redirect users that wrongly type HTTP address to the correct HTTPS address. Web Application Proxy

Related content Blogs: MSDN Documentation: Contact Us:
4/17/2017 Related content Blogs: AD Team blog: Application Proxies blog: MSDN Documentation: Azure AD App Proxy: Web Application Proxy: Contact Us: Meet us at Ask The Experts event Feedback © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Related content Microsoft Solutions Experience Location (MSE)
4/17/2017 Tue, Oct 28 3:15 PM-4:30 PM EM-B214 Privileged Access Management for Active Directory Wed, Oct 29 8:30 AM-9:45 AM EM-B316 Directory Integration: Creating One Directory with Active Directory and Azure Active Directory Wed, Oct 29 3:15 PM-4:30 PM EM-B319 Microsoft Identity Manager vNext Overview CDP-B210 Cloud Identity: Microsoft Azure Active Directory Explained Thu, Oct 30 10:15 AM-11:30 AM CDP-B312 Microsoft Azure Active Directory Premium, in Depth Thu, Oct 30 12:00 PM-1:15 PM EM-B310 Active Directory + BYOD = Peace of Mind Thu, Oct 30 5:00 PM-6:15 PM DEV-B322 Building Web Apps and Mobile Apps Using Microsoft Azure Active Directory for Identity Management Fri, Oct 31 8:30 AM-9:45 AM CDP-B207 Securing Organizations: Azure Active Directory Intelligence as a Differentiator Fri, Oct 31 10:15 AM-11:30 AM EM-B410 Advanced Active Directory Federation Services and Web Application Proxy Troubleshooting Fri, Oct 31 2:45 PM-4:00 PM EM-B313 Microsoft Azure Multi-Factor Authentication Deep Dive: Securing Access on Premises and in the Cloud Microsoft Solutions Experience Location (MSE) © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Resources Learning TechNet Developer Network
4/17/2017 Resources Sessions on Demand Learning Microsoft Certification & Training Resources TechNet Resources for IT Professionals Developer Network © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Enterprise Mobility Track Resources
4/17/2017 Enterprise Mobility Track Resources Enterprise Mobility Suite mobilitysuite Microsoft Intune Configuration Manager Hybrid Identity Access & Info Protection Desktop Virtualization © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Please Complete An Evaluation Form Your input is important!
4/17/2017 Please Complete An Evaluation Form Your input is important! TechEd Mobile app Phone or Tablet QR code TechEd Schedule Builder CommNet station or PC © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Evaluate this session 4/17/2017
© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4/17/2017 © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

How it works

Application Proxy Data Flow
System Center Marketing 4/17/2017 Application Proxy Data Flow DMZ Contoso.com corpnet Active Directory Web App1 Web App2 AAD Application Proxy Cloud Service AAD App Proxy Connector DMZ Fabrikam.com corpnet Active Directory Web App1 Once Started, the connector polls the Azure AD Application Proxy service for new client request. Web App2 AAD App Proxy Connector © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

System Center Marketing 4/17/2017 Application Proxy Data Flow DMZ Contoso.com corpnet A user sends a request to the public address of the service that is unique per tenant and per application. e.g. Active Directory Web App1 Web App2 AAD Application Proxy Cloud Service AAD App Proxy Connector DMZ Fabrikam.com corpnet Active Directory Web App1 Web App2 AAD App Proxy Connector © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

System Center Marketing 4/17/2017 Application Proxy Data Flow DMZ Contoso.com corpnet Active Directory Web App1 Web App2 AAD Application Proxy Cloud Service AAD App Proxy Connector DMZ Corp Net2 : Fabrikam.com Active Directory Web App1 The Azure AD Application Proxy service sends the user’s request as payload to an available connector Web App2 AAD App Proxy Connector © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

System Center Marketing 4/17/2017 Application Proxy Data Flow The connector sends the request to the backend application and once there is a response, it sends it back to the Application Proxy DMZ Contoso.com corpnet Active Directory Web App1 Web App2 AAD Application Proxy Cloud Service AAD App Proxy Connector DMZ Fabrikam.com corpnet Active Directory Web App1 Web App2 AAD App Proxy Connector © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

System Center Marketing 4/17/2017 Application Proxy Data Flow DMZ Contoso.com corpnet Active Directory Application Proxy returns the response to the client request Web App1 Web App2 AAD Application Proxy Cloud Service AAD App Proxy Connector DMZ Fabrikam.com corpnet Active Directory Web App1 Web App2 AAD App Proxy Connector © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Application Proxy Preauthentication
System Center Marketing 4/17/2017 Application Proxy Preauthentication DMZ Contoso.com corpnet User sends an unauthenticated request to an application that is configured to require preauthentication Active Directory Web App1 Web App2 AAD Application Proxy Cloud Service AAD App Proxy Connector Active Directory © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

System Center Marketing 4/17/2017 Application Proxy Preauthentication DMZ Contoso.com corpnet Application Proxy redirects the user to Azure AD for preauthentication. Nothing is sent to the backend Active Directory Web App1 Web App2 AAD Application Proxy Cloud Service AAD App Proxy Connector Active Directory © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

System Center Marketing 4/17/2017 Application Proxy Preauthentication DMZ Contoso.com corpnet Active Directory Web App1 Web App2 AAD Application Proxy Cloud Service AAD App Proxy Connector Token: Active Directory User is authenticated by Azure AD. This process may involve other systems, such as MFA, depending on tenant configuration. Once authenticated, the user is redirected back to the Application Proxy service with the acquired token © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

System Center Marketing 4/17/2017 Application Proxy Preauthentication DMZ Contoso.com corpnet Active Directory User request arrives again, now with a valid authentication token. Once the token is validated, the request is sent to the backend application Web App1 Web App2 AAD Application Proxy Cloud Service AAD App Proxy Connector Token: Active Directory © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

System Center Marketing 4/17/2017 Application Proxy Preauthentication DMZ Contoso.com corpnet Active Directory Web App1 Web App2 AAD Application Proxy Cloud Service AAD App Proxy Connector Active Directory Application Proxy sends the request to the application trough the connectors and returns the response to the client © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4/17/2017 © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks.

Similar presentations

Presentation on theme: "4/17/2017 © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks."— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

4/17/2017 © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks.

Similar presentations

Presentation on theme: "4/17/2017 © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks."— Presentation transcript:

Similar presentations

About project

Feedback