Hybrid cloud app publishing. The business case we're
concerned with here is how can we securely expose an
internal app to internet access? Now,
this becomes particularly important when a business is looking at the
hybrid cloud in staged migrations. In all likelihood, you're not going
to cut over all of your on‑premises services into Azure, you're going
to do a stepwise approach.
So you may have some services running in Azure and some running on‑prem. So
that brings up important questions of connectivity between your local
servers and the ones that are running in Azure.
And if you're not yet there,
as far as establishing a site‑to‑site VPN or an ExpressRoute circuit,
the question of an application proxy becomes particularly salient.
Now in Windows Server, we have the Application Proxy, or it's
actually called the Web Application Proxy, or WAP. And this, in
my experience, is associated most of the time with Active
Directory Federation Services.
So you see, this is a Microsoft docs diagram. As always,
I give the citation in the lower‑left corner of the slide. And in
this case, it looks like we've got an AD FS farm on‑premises,
that's the left side of the diagram.
And on the right side of the diagram, we have, say, Office 365,
which of course, is now called Microsoft 365 licensed in our Azure
AD tenant, and we want to give our users single sign‑on capability
into this cloud application.
How do we do that?
Well,
we don't need to get too far into the plumbing for the
hybrid cloud administrator role.
There are other Azure certifications and job roles where you do need
to know how to set up using Azure AD Connect federated or
synchronized identity. But here, notice that we've got over the
internet a federation trust between our on‑premises domain and our
Azure Active Directory tenant.
And what happens is when the user logs in or tries to sign in to Office 365,
their browser will redirect back to the Web Application Proxy or AD FS proxy
on‑prem where the user is signed in locally.
So that's the idea with Web Application Proxy, it's called a reverse proxy.
So you're able to shield servers inside your network perimeter that in
all likelihood have private non‑internet routable IP addresses and
they're behind firewalls, and you can still connect to them securely
through that Web Application Proxy.
And like I said, in Windows Server, you can proxy regular web
applications, but the normal use case, the one for the exam that I want
you to think about is using Web Application Proxy as part of your Active
Directory Federation Services deployment in order to give two things
really, one, you're maintaining the user's credentials entirely locally in
Active Directory as opposed to synchronizing those identities into Azure
AD. And number two,
you're able to use this token‑based authentication, and you
can repurpose your Web Application Proxy in your AD FS farm
with other service providers.
This slide of course just shows Azure AD, but you can use AD
FS for federation identity with other services elsewhere in the world and on the internet.