Entra App Proxy.

Posted by jstar77@reddit | sysadmin | View on Reddit | 11 comments

We have just a few on premise web applications left that need to be accessible from the outside world and I just switched the last one over to Entra App Proxy. I'm very happy with how the service works, it has simplified my firewall config and has allowed me to add MFA and conditional access policy to legacy web apps. I hadn't heard a lot about app proxy in Entra, I kind of stumbled up on it, I'm rather impressed with it for my use case considering it's included with Entra P2 which I'm already paying for.

Reply to Post

11 Comments

[-]

Uli-Kunkel@reddit

I used it 4-5 years ago, worked like a charm back then. If it's just some basic web service it's great, if for some reason the devs insist on using local users, and refuse to use entra as the IDP there are some things to be wanted, or at least there were five years ago

[-]

jao_en_rong@reddit

IDP doesn't matter, they can use what they want. You use app proxy to prevent an on-premise application from being exposed directly to the internet. It goes behind Microsoft's front door where they sign in, complete MFA, then get passed through the on-prem connector service to the app. They can still sign in with local accounts or do SSO with whatever IDP they want to use. They'll just have another hoop to jump through.

[-]

Uli-Kunkel@reddit

Yeah but dual auth suck, and passthrough is also a bit.. You should use Azure to get benefit of conditional access. Instead of relying on some hack job solution that got created in a rush.

[-]

jao_en_rong@reddit

You can still use CA policies with app proxy? Lots of you shoulds...no legacy apps, no apps without enterprise support, no apps where the vendor or app development team no longer exists...definitely should be on an air gapped network instead of externally facing on the public internet...no legacy operating systems...no other internal apps should be using non-microsoft web proxies or reverse proxies

[-]

Avas_Accumulator@reddit

Been using it for many years now. It's been part of what allowed us to go full in on Zero Trust, together with AVD and an SSE.

[-]

Top-Perspective-4069@reddit

I have it in front of RDWeb and it works really well. I'm a fan.

[-]

Hangikjot@reddit

yup works great. we use it for all sorts of stuff. I just wish it could have use ports on the outside interface too. https://learn.microsoft.com/en-us/entra/identity/app-proxy/how-to-configure-sso-with-kcd https://learn.microsoft.com/en-us/entra/identity/app-proxy/application-proxy-integrate-with-remote-desktop-services

[-]

AppIdentityGuy@reddit

It's very useful and often overlooked. The next level up is something called Global Secure Access (Private Access)

[-]

jstar77@reddit (OP)

I'm actually testing that right now for RDP access for a few remote users and performance is equivalent to our VPN.

[-]

AppIdentityGuy@reddit

This is for servers that aren't behind an RDS Gateway right?

[-]

jstar77@reddit (OP)

We are using App Proxy for general RDS gateway connectivity but with App Proxy users are limited to the HTML RDS access which is fine for most 90% of users. RDP over GSA is for a few limited use cases where they need to hit a physical box or run up against limitations of the HTML RDS client. Also it works very well on iOS devices where the RDS web client is awful allowing, you to use Microsoft's proper remote desktop app.