In this demonstration,
we'll take a look at Azure AD Application Proxy and the Azure Relay Service,
particularly hybrid connections.
So starting with Azure AD Application Proxy,
you're looking at the desktop of one of my local servers.
It's a domain member server named localhyperv.
I've installed IIS on this machine.
Not worried about certificates in this example,
as you're going to see that Azure can take over the TLS for you
if you're willing to trust Microsoft cert.
But notice here,
it's just the standard Internet Information Services splash at localhost,
and I just added some custom text here as a proof of concept to
make sure that once we complete the configuration,
we're able to load this page from over the internet.
So the use case is you have an internal service or app,
a web app or an API basically,
that's got no direct connection to the internet itself,
and we're going to use Azure AD Application Proxy to facilitate that connection.
So, let's go over to the portal here and let's go into Azure Active Directory.
Now note that you have to be running Azure AD Premium
P1 or P2 to use this capability.
Right here, you can see I'm licensed for P2, so I have everything.
And that makes sense because, as I mentioned in the theory part of this lesson,
one of the value propositions of Azure AD Application Proxy
is the preauthentication with Azure AD.
And you can optionally layer in things, or features or technologies,
like Azure AD Identity Protection, Azure AD Conditional Access policies,
and Azure MFA as well.
And all of that's going to require Azure AD Premium licensing as well.
So here we have what's called a connector.
And as this says,
a connector creates a secure communication channel
between your on‑premises network and Azure.
And I've got a localmem server that's got one of those created.
And note that you can create multiple connectors for
redundancy and put them into connector groups.
So what we want to do here is download the connector
service agent onto my local system here.
I'm going to accept the terms and download that package,
and we're going to run that installer in place because
I'm already on the target server.
This is the Azure Active Directory Application Proxy connector.
I'm going to agree to the license terms,
and we're just essentially doing a Next/Next/Finish type installation.
All right,
so we're signing in to our subscription with an administrative credential.
All right, good deal. Setup successful.
So now that we've got the agent installed on my machine,
we can configure an app, so let's click Configure an app.
The display name for our new application, I'm going to call this hyperv‑app.
I know that's not very creative.
Now the internal URL is how someone on the local area
network would get to that resource, and this is really low tech,
as you can see, http://localhost.
Now I'd mentioned about the certificate issue.
Notice here that the external URL is going to map under
Microsoft's msappproxy.net domain.
And I would imagine you could alias this or you could use a custom domain.
I would suggest you look at the exercise files.
I'm going to do the same thing after I finish this demo
because if I was implementing this today,
I would want to use a custom domain and make sure that I've
got my certificate and an HTTPS binding.
So it looks like it's going to be set up under
https://hypervapp, let me get rid of that dash, ‑timwinfo,
that's my tenant name, msappproxy.net.
Let me put that on my other monitor so I have that URL easy.
As far as preauthentication, like I said,
the default is to authenticate all connections using Azure AD,
but you could pass through directly to the app.
That's less secure.
I'm not going to choose that option.
And our Connector Group, I just have the one Default one.
You've got some settings down here, as far as cookies,
Use HTTP‑Only Cookie, Use a Secure Cookie,
Use a Persistent Cookie, Translate URLs.
Once you're finished with your settings,
we can Add to create that new application definition
in the default connector group.
Now it looks like it raised an error because I'm
already using the same internal URL.
That makes sense.
I should have remembered that, but let's actually go back to Configure an app,
and let's do this again, localhyperv1app.
The Internal URL, this time I'm going to use the hostname of the server,
http://localhyperv1.
Okay, good.
So let me copy the URL to my clipboard on my other monitor.
We'll leave everything alone here.
So actually,
I customized the cookies because I'm not messing with HTTPS yet at this point.
So let's wait for this process to complete successfully,
and in the meantime let me dismiss completed tasks.
Good deal.
That one was created successfully.
So, unfortunately, there's not an OK here.
We just have to hit X to come out here.
And let's do a hard refresh, and hopefully the interface will update accordingly.
Yes, okay.
So now we have two references.
Now because these machines are being NAT'd behind the same public IP,
that's why I ran into that error with the same internal hostname
because how could you possibly come in on that public IP on the same
internal URL and expect differentiation?
So I probably should have seen that to begin with.
Okay, so to finish our configuration,
we can't just expect to go directly to that msappproxy.net because
we have to assign this application to users.
And the way we do that is we go to Enterprise applications,
and let me reverse sort here to get that resource.
So this is the Azure service principal that represents that proxied app,
so let me click it.
And what we're going to need to do, I'm going to designate an owner,
first of all, somebody that's going to have management on the entire application.
I'm already a directory administrator, so I'm good.
But let's say that my colleague, Adee, should also be an application owner.
So that would give her full ability to manage the
configuration of this registered app.
But I specifically want to go to Users and groups and assign at
least myself this app because this is how we're going to
instruct our users to get to the app.
So I'm going to bring in Tim, of course, the manager of the app.
Adee is going to need to come in here as well. And
let's complete that assignment.
So this is a common workflow when you're configuring single sign‑on
for Azure AD‑backed applications in your directory.
You assign them to users.
And then as this banner says,
The application will appear for assigned users within My Apps.
What is My Apps?
Hopefully you know, but if you don't, what My Apps is,
it's Microsoft's single sign‑on portal for Azure Active Directory.
The well‑known DNS is myapplications.microsoft.com.
And it's an authenticated portal,
so we're going to have to come in being authenticated by Azure AD and again,
conditional access, all of those rules apply.
This is what the My Apps portal looks like.
And any Microsoft 365 apps that the user is licensed for,
as you can see I've got Excel will show up here,
as well as line‑of‑business apps that you've developed,
like I've got this AZ‑104 practice app, third‑party
apps that use Azure as a back end, you can register those,
like I've got Alpaqa Studio for Cosmos.
And then, lastly, you can see I haven't customized the icon yet,
but notice that I've got Hyper‑V, or localhyperv app,
in my My Apps list, so let's give that a click.
We've preauthenticated, and so it brings us here on our msappproxy.net,
HTTPS connection, and we're seeing the Internet Information Services page. Good enough, huh?