Microsoft Cybersecurity Architect (SC-100)Design a Zero Trust strategy and architectureMedium
A global manufacturing company is implementing a Zero Trust strategy. They have numerous legacy applications hosted in an on-premises data center that are critical for operations. These applications lack modern authentication capabilities and cannot be directly exposed to the internet. The company needs to securely provide access to these applications for remote employees without using a traditional VPN. Which Microsoft technology would BEST facilitate this requirement in a Zero Trust context?
- AAzure Virtual WAN
- BAzure ExpressRoute
- CMicrosoft Defender for Cloud Apps
- DAzure AD Application Proxy
Show answer & explanationAnswer & explanation
Correct answer: D. Azure AD Application Proxy
Azure AD Application Proxy provides secure remote access to on-premises web applications. It integrates with Azure AD for authentication and Conditional Access, allowing users to access internal applications as if they were cloud apps, without requiring a VPN or changes to the network infrastructure, aligning perfectly with Zero Trust principles.
Why the other options are wrong
- A. Azure Virtual WAN provides optimized and automated branch connectivity to Azure. It's a networking solution, not an application-specific access proxy for legacy apps.
- B. Azure ExpressRoute creates a private connection between an on-premises network and Azure. It's for network connectivity, not secure application access for remote users without a VPN.
- C. Microsoft Defender for Cloud Apps (formerly MCAS) is a Cloud Access Security Broker (CASB) that provides visibility, control, and protection for cloud apps. While important for Zero Trust, it doesn't directly provide secure remote access to on-premises legacy applications.
Azure AD Application Proxy
A service that enables secure remote access to on-premises web applications through Azure Active Directory.
- Publishes internal web apps externally.
- Integrates with Azure AD for authentication and Conditional Access.
- Eliminates the need for VPN or DMZ for remote access.
Memory trick: App Proxy bridges the gap, securing legacy apps with cloud identity.