Now by contrast, Azure AD Application Proxy does the same thing.
It provides remote access to on‑premises web applications,
but there is no dependency on Active Directory Federation Services,
or ADFS.
The Azure AD Application Proxy runs in the cloud,
it's part of Azure and part of your Azure AD tenant,
and then you install a connector agent that runs on your on‑premises server,
and we don't have any dependencies on a VPN or an ExpressRoute,
in fact, that's one of the value propositions of Azure AD Application Proxy.
You can replace the cost and overhead of a VPN,
and frankly,
the cost and overhead of using Web Application Proxy with
Windows Server because let's face it, if you've ever set up an ADFS farm,
it's quite a bit of infrastructure, even if you're using virtual machines,
and then there is all of the PKI stuff that you need to do with certificates.
Azure AD does the same thing, but it's so much cleaner.
I'm going to show you this in a demo so you'll see it.
Now,
the concept of pre‑authentication is relevant both
to Azure AD Application Proxy, as well as Windows Server Web Application Proxy.
With this, the idea is let's say you've got an on‑premises API server,
and you need to support connections from over the internet.
You're going to want to pre‑authenticate those connections, obviously.
You're not going to do anonymous auth, are you?
So you will use, by default, Azure AD for pre‑authentication.
Notice I've put Azure AD Connect in parentheses.
This is, in the real world, what you'll do to set up hybrid identity.
So if you want your users to sign in to your local on‑premises apps
from over the internet using familiar credentials,
you would set up Azure AD Connect to replicate local
Active Directory credentials into Azure AD,
and then instruct the user to access the app when they're out
on the internet using those credentials,
that is using their local AD credentials that are not
coincidentally synchronized into Azure AD.
So Azure AD is providing the pre‑authentication,
just like when you're using Web Application Proxy,
ADFS is doing the pre‑authentication.
Now, you can do a passthrough with both Azure AD Application Proxy,
as well as Windows Server Web Application Proxy,
and that's where there is no pre‑auth where the connection goes
straight back to the backend application,
and then it's up to you to implement authentication in the application itself.
I've got to tell you,
it's super convenient that Azure AD can layer in that pre‑authentication
because it unlocks capabilities that you're already paying for like conditional
access policies and Azure multi‑factor authentication,
so you can really do lots of security layers when you're exposing internal apps like this to the internet.