Application Proxy requirements

This page's changes and edits · All guidance changes

Microsoft's edit · 26 Feb 00:12 UTC

Add Private Access & Global Secure Access checks

Microsoft's commit message in MicrosoftDocs/entra-docs · commit da98d47 · +8 −5 lines · also on GitHub

11 ---

2 −title: Add an on-premises application for remote access through application proxy in Microsoft Entra ID.

3 −description: Microsoft Entra ID has an application proxy service that enables users to access on-premises applications by signing in with their Microsoft Entra account. This tutorial shows you how to prepare your environment for use with application proxy. Then, it uses the Microsoft Entra admin center to add an on-premises application to your Microsoft Entra tenant.

2 +title: Add an on-premises application for remote access through application proxy in Microsoft Entra ID

3 +description: Microsoft Entra ID has an application proxy service that enables users to access on-premises applications by signing in with their Microsoft Entra account. This tutorial shows you how to prepare your environment for use with application proxy. Then, it uses the Microsoft Entra admin center to add an on-premises application to your Microsoft Entra tenant.

44 ms.topic: tutorial

5 −ms.date: 05/01/2025

5 +ms.date: 02/25/2026

6 +ms.author: ashishj

67 ms.reviewer: ashishj

78 ai-usage: ai-assisted

89 ---

⋯ 46 unchanged lines

5556 | **Maintenance Mode** | Select if you would like to enable maintenance mode and temporarily disable access for all users to the application. |

5657 | **Internal URL** | The URL for accessing the application from inside your private network. You can provide a specific path on the backend server to publish, while the rest of the server is unpublished. In this way, you can publish different sites on the same server as different apps, and give each one its own name and access rules. If you publish a path, make sure that it includes all the necessary images, scripts, and style sheets for your application. For example, if your app is at `https://yourapp/app` and uses images located at `https://yourapp/media`, then you should publish `https://yourapp/` as the path. This internal URL doesn't have to be the landing page your users see. For more information, see [Set a custom home page for published apps](application-proxy-configure-custom-home-page.md). |

5758 | **External URL** | The address for users to access the app from outside your network. If you don't want to use the default application proxy domain, read about [custom domains in Microsoft Entra application proxy](./how-to-configure-custom-domain.md). |

58 − | **Pre Authentication** | How application proxy verifies users before giving them access to your application. **Microsoft Entra ID** - Application proxy redirects users to sign in with Microsoft Entra ID, which authenticates their permissions for the directory and application. We recommend keeping this option as the default so that you can take advantage of Microsoft Entra security features like Conditional Access and multifactor authentication. **Microsoft Entra ID** is required for monitoring the application with Microsoft Defender for Cloud Apps. **Passthrough** - Users don't have to authenticate against Microsoft Entra ID to access the application. You can still set up authentication requirements on the backend. |

59 + | **Pre Authentication** | How application proxy verifies users before giving them access to your application. **Microsoft Entra ID** - Application proxy redirects users to sign in with Microsoft Entra ID, which authenticates their permissions for the directory and application. **Keep this as the default option** so that you can take advantage of Microsoft Entra security features like Conditional Access and multifactor authentication. **Microsoft Entra ID** is required for monitoring the application with Microsoft Defender for Cloud Apps. **Passthrough** - Users don't have to authenticate against Microsoft Entra ID to access the application. You can still set up authentication requirements on the backend. |

5960 | **Connector Group** | Connectors process the remote access to your application, and connector groups help you organize connectors and apps by region, network, or purpose. If you don't have any connector groups created yet, your app is assigned to **Default**. If your application uses WebSockets to connect, all connectors in the group must be version 1.5.612.0 or later. |

6061

6162 1. If necessary, configure **Additional settings**. For most applications, you should keep these settings in their default states.

⋯ 68 unchanged lines

130131

131132 The error message display in the top-right corner as you try to upload the certificate. You can also select the notification icon to see the error messages.

132133

133 −## Next steps

134 +## Related content

134135

135136 - [What is Global Secure Access?](../../global-secure-access/overview-what-is-global-secure-access.md)

137 +- [Plan a Microsoft Entra application proxy deployment](/entra/identity/app-proxy/conceptual-deployment-plan)

138 +- [ySecurity considerations for accessing apps remotely with Microsoft Entra application proxy](/entra/identity/app-proxy/application-proxy-security)

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:15 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.