Azure Relay, formally called Azure Service Bus Relay,
connects on‑premises services and cloud applications
through a single‑port connection,
so it's a secure hybrid connection that's scoped to a single application.
It is the functional equivalent of least‑privilege authorization,
what you might do with role‑based access control in Azure
where you give identities only enough permissions to do
the work that they need to do, but no more.
Similarly, instead of setting up, say,
a Site‑to‑Site VPN that operates at the entire network scope,
you can create connections between individual hosts in
Azure services on a single port.
So note that this is a different use case from Azure AD Application Proxy.
The specific sub‑feature in Azure Relay is called Hybrid Connections,
and this can work with two development stacks,
.NET and Node, and it covers both WebSockets and HTTP.
Now the demo I'm going to do is how you can use Hybrid Connections to
establish a connection between an Azure App Service web app and a
back‑end server that may be in your local datacenter.
So under the hood to all of this hybrid connectivity,
the Azure AD Application Proxy, the Azure Relay resource,
this is all using Azure Service Bus under the hood,
which is the main communications architecture underneath Azure Resource Manager.
And for that matter,
there's the Azure Service Bus resource that is an enterprise‑class messaging architecture.