12.4 Web Application Proxy & Microsoft Entra Application Proxy

Web Application Proxy & Microsoft Entra Application Proxy

Traditional enterprise application publishing relied on perimeter demilitarized zones (DMZs), inbound firewall port exceptions, public IP addresses, and broad network-layer VPNs. These legacy architectures create substantial attack surfaces: opening inbound firewall ports exposes web servers to zero-day internet scans, while traditional VPNs grant remote devices broad network-level access, allowing lateral movement in the event of an endpoint breach.

Microsoft's modern application publishing ecosystem implements Zero Trust principles across three generations of technology. This section covers the first two — Web Application Proxy (WAP) for perimeter AD FS federation and Microsoft Entra Application Proxy for outbound-only web application publishing, both of which are limited to HTTP/HTTPS. The third generation, Microsoft Entra Private Access, extends the same identity-centric model to every protocol and is covered in section 12.5; Azure Relay, which solves the narrower problem of exposing a single on-premises TCP endpoint to an Azure PaaS service, is covered in section 12.6.

---

1. Evolution of Remote Application Publishing

Understanding the architectural trajectory from legacy perimeter DMZs to cloud-delivered Security Service Edge (SSE) is vital for enterprise design and AZ-800 certification.

+-----------------------------------------------------------------------------------+
|                     EVOLUTION OF APPLICATION ACCESS PARADIGMS                     |
|                                                                                   |
|   [GENERATION 1: PERIMETER DMZ]                                                   |
|   - Web Application Proxy (WAP) + AD FS                                           |
|   - Requires Inbound Port 443, Public IPs, Perimeter DMZ, Public DNS              |
|   - Lateral Movement Risk: Moderate (DMZ Isolation)                               |
|                                   |                                               |
|                                   v                                               |
|   [GENERATION 2: CLOUD REVERSE PROXY]                                             |
|   - Microsoft Entra Application Proxy                                             |
|   - Outbound-only HTTPS (Port 443), Zero Inbound Ports, Entra ID Pre-Auth (MFA)   |
|   - Scope: HTTP / HTTPS Web Applications Only                                     |
|                                   |                                               |
|                                   v                                               |
|   [GENERATION 3: ZERO TRUST NETWORK ACCESS (ZTNA / SSE)]                          |
|   - Microsoft Entra Private Access (Global Secure Access)                         |
|   - Outbound-only Connectors + GSA Client on Endpoints                            |
|   - Scope: ALL Protocols & Ports (TCP, UDP, RDP, SMB, SSH, Kerberos, Legacy ERP)  |
+-----------------------------------------------------------------------------------+

Comparative Architectural Matrix

---

2. Web Application Proxy (WAP) Architecture

Web Application Proxy (WAP) is a role service of the Remote Access role in Windows Server. Designed specifically to reside in perimeter demilitarized zones (DMZs), WAP acts as a reverse proxy and AD FS proxy.

+-----------------------------------------------------------------------------------+
|                         WEB APPLICATION PROXY ARCHITECTURE                        |
|                                                                                   |
|   [INTERNET]                  [PERIMETER DMZ]               [INTERNAL LAN]        |
|   +-------------+             +-----------------------+     +-------------------+ |
|   | Remote User | ==(HTTPS)==>| Web App Proxy (WAP)   | ===>| Internal Web App  | |
|   +-------------+   Port 443  | - No Domain Join      | KCD | - Kerberos / NTLM | |
|                               | - Reverse Proxy       |     +-------------------+ |
|                               | - AD FS Proxy Role    |                           |
|                               +-----------------------+     +-------------------+ |
|                                           |                 | AD FS Farm        | |
|                                           +===(Auth Token)==| (Internal DCs)    | |
|                                                             +-------------------+ |
+-----------------------------------------------------------------------------------+

Key Operational Characteristics

1. DMZ Placement: The WAP server sits between an external firewall and an internal firewall. It should not be joined to the internal Active Directory domain to prevent domain credential harvesting if the DMZ server is compromised.
2. Inbound Firewall Requirement: External firewalls must open inbound TCP port 443 forwarding to the WAP server's public IP address.
3. Pre-Authentication Options:
   • Active Directory Federation Services (AD FS): Clients are redirected to AD FS to obtain a security token before WAP permits traffic to reach the internal web application.
   • Pass-Through: WAP forwards raw client requests directly to the backend application without pre-authentication (used for basic authentication or client-certificate authentication).
4. Kerberos Constrained Delegation (KCD): When publishing internal web applications configured for Windows Integrated Authentication (Kerberos), WAP can authenticate the user via AD FS claims and use KCD to obtain a Kerberos ticket to the backend server on the user's behalf.

---

3. Microsoft Entra Application Proxy Architecture

Microsoft Entra Application Proxy provides secure remote access to internal on-premises web applications without deploying a DMZ, opening inbound firewall ports, or managing external DNS records.

+-----------------------------------------------------------------------------------+
|                  MICROSOFT ENTRA APPLICATION PROXY ARCHITECTURE                   |
|                                                                                   |
|   [INTERNET CLIENT]           [MICROSOFT ENTRA CLOUD]        [INTERNAL NETWORK]   |
|   +-------------------+       +-----------------------+      +------------------+ |
|   | Remote User       |       | Entra App Proxy Svc   |      | Private Network  | |
|   | (Browser / M365)  | ====> | - Pre-Auth (MFA / CA) | <==> | Connector Agent  | |
|   +-------------------+       | - Token Validation    | Out- | (Windows Server) | |
|                               +-----------------------+ bound|        |         | |
|                                                        HTTPS |   (KCD / NTLM)   | |
|                                                        443   v        v         | |
|                                                              +------------------+ |
|                                                              | Internal Web App | |
|                                                              | (e.g., SharePoint| |
|                                                              +------------------+ |
+-----------------------------------------------------------------------------------+

Outbound-Only Connector Mechanics

• The Connector Agent: A lightweight Windows service installed on a domain-joined Windows Server inside the internal corporate network.
• No Inbound Open Ports: The Connector initiates and maintains persistent outbound HTTPS connections over TCP port 443 to the Microsoft Entra Application Proxy cloud service endpoints (*.msappproxy.net and *.servicebus.windows.net).
• Request Flow:
  1. The user navigates to the external URL (e.g., https://expenses.contoso.com).
  2. Microsoft Entra ID intercepts the request, validates the user's identity, and enforces Conditional Access policies (MFA, Compliant Device, User/Sign-in Risk).
  3. Upon successful pre-authentication, Entra ID places the request in the cloud proxy queue.
  4. The internal Connector picks up the request over its existing outbound control channel, retrieves the data from the internal backend web server, and streams the response back to the cloud service.

Single Sign-On (SSO) via Kerberos Constrained Delegation (KCD)

When backend web servers use Windows Integrated Authentication (Kerberos), the Private Network Connector uses Kerberos Service for User (S4U) extensions (S4U2self and S4U2proxy) to generate Kerberos tickets on behalf of authenticated users:

# Register Service Principal Name (SPN) on the Backend Web Server account
setspn -S HTTP/internalweb.corp.contoso.com CORP\svc-web

# Configure Kerberos Constrained Delegation on the Connector Server in Active Directory
# (Using Active Directory Users and Computers -> Connector Computer Object -> Delegation tab)
# Select: \"Trust this computer for delegation to specified services only\" -> \"Use any authentication protocol\"
# Add target service: HTTP/internalweb.corp.contoso.com

---

4. Choosing Between WAP and Entra Application Proxy

Both products publish internal web applications, so the exam tests the decision criteria rather than the click-path.

Exam trap: WAP is a role service of the Remote Access role, not a standalone role, and it is the only one of the two that belongs in a DMZ. A question describing a server that is deliberately not domain-joined and sits between two firewalls is describing WAP. Conversely, any question that stresses "no inbound firewall ports" while still describing browser-based access to an internal web app is describing Entra Application Proxy.