{"id":4166,"date":"2020-05-11T08:10:51","date_gmt":"2020-05-11T06:10:51","guid":{"rendered":"https:\/\/www.msb365.blog\/?p=4166"},"modified":"2023-06-23T13:03:52","modified_gmt":"2023-06-23T11:03:52","slug":"azure-proxy","status":"publish","type":"post","link":"https:\/\/www.msb365.blog\/?p=4166","title":{"rendered":"Azure Application Proxy"},"content":{"rendered":"

What is the Azure Application Proxy?<\/strong><\/h3>\n

Azure AD Application Proxy is a feature of Azure AD Premium and Azure AD Basic. It allows publication of internal web-based application to provide Internet access to authorized users in the corporate domain.<\/p>\n

The Azure AD Application Proxy can be used in place of internal Web Application Proxy Servers to provide authorized internal users access to internal, web-based applications from outside the security of the corporate network.<\/p>\n

\"\"<\/a><\/p>\n

Typically, your organization will have internally deployed SharePoint sites, Outlook Web Access, Citrix Director (for those Citrix customers), and many other line-of-business web applications. Using Application Proxy (a feature of Azure AD), you integrate those applications with Azure AD, and the applications can be consumed externally in a secure manner.<\/p>\n

Often the case when needing to present such applications out to the internet, you have to depend on VPN-type solutions for security, proxies, DMZ extensions of your applications, or else modify different firewalls to accept direct traffic to your internal resources. Using Application Proxy, a\u00a0Proxy Connector\u00a0is installed on a server in your internal network, which acts as the broker (reverse-proxy) to provide you with access to that application. No need to deal with VPNs or firewall rules, just allow ports 80 and 443 from the Connector out to the internet.<\/p>\n

 <\/p>\n

\u00a0<\/strong><\/p>\n

Why should I use the Azure Application Proxy?<\/strong><\/h3>\n

\u00a0<\/strong>There are many advantages, that is why we should use the Azure Application Proxy, here is a short list of some of them (This list is not final).<\/p>\n

 <\/p>\n

One outgoing and none One incoming connection<\/strong><\/p>\n

You do not need to have an incoming HTTPS publication in your firewall to an internal web server. The connector internal opens an outgoing connection.<\/p>\n

 <\/p>\n

No public IP<\/strong><\/p>\n

For me personally one of the two most important points, if a company has only few or no more free public IP addresses or its IP address changes from time to time, this has no influence on the publications with the Azure Application Proxy.<\/p>\n

 <\/p>\n

No public certificate<\/strong><\/p>\n

My second personal highlight is that it does not necessarily need its own public certificate. Microsoft provides this and it can be used as often as you like. In this case, however, the domain is specified in the address link. If you don’t want this, you can of course also use your own public certificates.<\/p>\n

These can be used relatively easily.<\/p>\n

 <\/p>\n

PreAuth, Conditional Access, MFA<\/strong><\/p>\n

You can also select “Passthough” but the pre-qualification of users is a great protection against attacks on accounts, as Azure can already fend off these logins<\/p>\n

 <\/p>\n

DDoS protection<\/strong><\/p>\n

Since your own web server is always hidden behind the Azure services, you have a very good DDoS protection built in. Here, too, you have to consider that Microsoft has a huge infrastructure in front of it and this would normally rarely or never be built by companies.<\/p>\n

 <\/p>\n

OAUTH<\/strong><\/p>\n

If a user has already authenticated himself on the AzureAD Ap Proxy (preferably with MFA), then you may want to avoid a second login to the actual back end. This is possible via OAUTH tokens. The Azure AD App proxy “knows” the user and your backend app is also known in Azure AD. Then you can also send the user a suitable token which he passes on to the backend service. More and more applications support this login.<\/p>\n

 <\/p>\n

Guest Access<\/strong><\/p>\n

Pre-authentication is not limited to its own tenant. You can also authenticate the users of other tenants via the Azure AD App Proxy. Depending on the application, this option opens up the horizon by a right slice.
\n<\/strong><\/p>\n

 <\/p>\n

 <\/p>\n

Cost\/License<\/strong><\/h3>\n

 <\/p>\n

In order to use Azure Application Proxy and all its benefits, one of the following licenses is required:
\nAzure AD Premium P1 or P2.<\/p>\n

Azure AD Premium P1 is currently also included in the following Microsoft plan:
\nEnterprise Mobility & Security E3<\/p>\n

The Azure AD Premium P2 version is offered in the following Microsoft plan
\nAzure Mobility & Security E5<\/p>\n

The complete overview of the features can be found here:<\/p>\n

https:\/\/azure.microsoft.com\/en-us\/pricing\/details\/active-directory\/<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

Configuration Azure Application Proxy<\/strong><\/h3>\n

 <\/p>\n\n\n\n\n\n\n\n\n\n\n
Log on to the Azure portal<\/strong><\/td>\n\"\"<\/a><\/td>\n<\/tr>\n
Navigate to Enterprise applications<\/strong>.<\/td>\n\"\"<\/a><\/td>\n<\/tr>\n
Select On-premises application<\/strong>. The Azure portal will inform you that you have no Application Proxy Connector servers and that you must download and install the required software to a server. Click Download Application Proxy Connector.<\/strong><\/td>\n\"\"<\/a><\/td>\n<\/tr>\n
Before installing the Application Proxy Connector software, turn off IE ESC (Internet Explorer Enhanced Security Configuration) via Server Manager. Click Accept terms & Download.<\/strong><\/td>\n\"\"<\/a><\/td>\n<\/tr>\n
Run the installer from a supported server operating system, and click I agree to the license terms<\/strong> and conditions<\/strong> followed by Install<\/strong>.<\/td>\n\"\"<\/a><\/td>\n<\/tr>\n
Enter credentials of an Azure global administrator account.<\/td>\n\"\"<\/a><\/td>\n<\/tr>\n
Click Close<\/strong> to complete the install.<\/p>\n

 <\/p>\n

Two services are installed alongside the Proxy Connector:<\/p>\n

 <\/p>\n

Microsoft AAD Application Proxy Connector \u2013 Enables connectivity.<\/p>\n

Microsoft AAD Application Proxy Connector Updater \u2013 Checks for new versions of the connector and updates the connector accordingly.<\/td>\n

\"\"<\/a><\/td>\n<\/tr>\n
Return back to the Azure portal and click I\u2019ve finished the installation.<\/strong><\/td>\n\"\"<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

Add an application<\/strong><\/h3>\n

\u00a0<\/strong><\/p>\n\n\n\n\n\n\n\n\n
Back in the Enterprise applications <\/strong>portal at the Azure Portal <\/strong>we click on + New application<\/strong><\/td>\n\"\"<\/a><\/td>\n<\/tr>\n
Here we choose the type of our deployment, in our case we choose On-premises application<\/strong><\/td>\n\"\"<\/a><\/td>\n<\/tr>\n
We fill in the needed information it is shown in the form.<\/p>\n

I will use for this article one of my printers\u2026<\/td>\n

\"\"<\/a><\/td>\n<\/tr>\n
Your application will show as below and is editable at any time. You can also add new applications from this screen. Click on Application proxy<\/strong>.<\/td>\n\"\"<\/a><\/td>\n<\/tr>\n
In the next Step, we need to assign the new application to Users or User Groups, who should be allowed, to access the App.<\/p>\n

For that we click on Assign users and groups<\/strong><\/td>\n

\"\"<\/a><\/td>\n<\/tr>\n
Here we do it in the way, how we also add permissions to other Groups in Azure.<\/td>\n\"\"<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u00a0<\/strong><\/p>\n

Accessing the Application<\/strong><\/h3>\n

 <\/p>\n

There are two ways, how we can now access the configured Application:<\/p>\n

 <\/p>\n\n\n\n\n
The first way is, if we go to the Office 365 Portal using the path https:\/\/portal.office.com<\/a><\/p>\n

Here we click on the \"\"<\/a>\u00a0symbol and scroll down to our app.<\/td>\n

\"\"<\/a><\/td>\n<\/tr>\n
The second way is if we know the public link, we simply hit it in a web Browser.<\/td>\n\"\"<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

 <\/p>\n

Photo by\u00a0Piotr Hamryszczak<\/a>\u00a0on\u00a0Unsplash<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

What is the Azure Application Proxy? Azure AD Application Proxy is a feature of Azure AD Premium and Azure AD Basic. It allows publication of internal web-based application to provide Internet access to authorized users in the corporate domain. The Azure AD Application Proxy can be used in place of internal Web Application Proxy Servers […]<\/p>\n","protected":false},"author":1,"featured_media":4186,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[12,1923],"tags":[],"class_list":["post-4166","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","category-microsoft-365"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts\/4166","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4166"}],"version-history":[{"count":3,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts\/4166\/revisions"}],"predecessor-version":[{"id":5175,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts\/4166\/revisions\/5175"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/media\/4186"}],"wp:attachment":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}