Microsoft Cybersecurity Architect (SC-100)Design a Zero Trust strategy and architectureMedium
A financial institution is designing a Zero Trust architecture. They have identified that their on-premises applications, which are critical for daily operations, must be accessible securely by remote employees without exposing the internal network directly to the internet. The security architect needs a solution that acts as a reverse proxy to provide secure remote access to these internal web applications, integrating with Azure AD for authentication and Conditional Access policies. Which Azure AD service is BEST suited for this scenario?
- AAzure VPN Gateway
- BAzure AD Application Proxy
- CAzure Front Door
- DAzure Application Gateway
Show answer & explanationAnswer & explanation
Correct answer: B. Azure AD Application Proxy
Azure AD Application Proxy is specifically designed to provide secure remote access to on-premises web applications. It acts as a reverse proxy, integrating with Azure AD for pre-authentication and Conditional Access, precisely matching the scenario's requirements.
Why the other options are wrong
- A. Azure VPN Gateway creates secure IPsec tunnels for network-level connectivity, which is different from application-level remote access using a reverse proxy.
- C. Azure Front Door is a global, scalable entry-point for web applications, providing WAF, CDN, and load balancing, but it's not primarily for connecting on-premises apps to Azure AD for remote access.
- D. Azure Application Gateway is a web traffic load balancer and WAF for web applications, typically for Azure-hosted apps or as a front-end for on-premises apps but without the direct Azure AD integration for remote user access.
Azure AD Application Proxy
A service that enables users to securely access on-premises web applications from a remote location, without requiring a VPN or exposing the internal network directly to the internet.
- Acts as a reverse proxy.
- Integrates with Azure AD for pre-authentication and Conditional Access.
- Publishes internal web apps for external access.
Memory trick: App Proxy Connects On-Prem Apps to Remote Users.