Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft EntraMedium
A company is integrating a legacy on-premises application with Microsoft Entra ID. The application uses Kerberos authentication and cannot be directly exposed to the internet. Users need to access this application from outside the corporate network using their Microsoft Entra credentials. Which Microsoft Entra capability should be deployed to facilitate this access?
- AMicrosoft Entra B2B collaboration
- BMicrosoft Entra Domain Services
- CMicrosoft Entra Application Proxy
- DMicrosoft Entra Connect
Show answer & explanationAnswer & explanation
Correct answer: C. Microsoft Entra Application Proxy
Microsoft Entra Application Proxy allows you to publish on-premises web applications to external users, providing secure remote access using Microsoft Entra ID for single sign-on. It handles authentication and traffic routing without requiring a VPN or exposing the internal network.
Why the other options are wrong
- A. B2B collaboration manages external user access to cloud resources, not for exposing on-premises apps.
- B. Entra Domain Services provides managed domain services in Azure, not for publishing on-premises applications.
- D. Entra Connect synchronizes directories, it does not provide remote access to applications.
Microsoft Entra Application Proxy
A Microsoft Entra ID feature that provides secure remote access to on-premises web applications. It acts as a reverse proxy, allowing users to access internal apps from anywhere without a VPN.
- Publishes on-premises web apps to be accessible from outside the corporate network.
- Integrates with Microsoft Entra ID for authentication and Conditional Access.
- Supports various authentication methods including Kerberos (via KCD).
- Requires installing a connector agent in the on-premises network.
Memory trick: Entra's App Proxy bridges the gap, for your apps, no matter where they're at.