While preparing for the AZ-305: Designing Microsoft Azure Infrastructure Solutions exam, many candidates struggle with implementing secure remote access to legacy app workloads integrated with on-premises Active Directory. In the enterprise world, this decision often hinges on balancing seamless Single Sign-On (SSO) for users working remotely without VPN access, while maintaining strict security governance and compliance within a hybrid environment. Let’s drill into a simulated hybrid identity scenario.
The Scenario #
Northwind Logistics is a global supply chain company with an on-premises Active Directory environment and a legacy internal web application (WebPortal1) that uses Integrated Windows Authentication (IWA). The application is hosted on premises behind their corporate firewall. Many users currently access the app seamlessly via VPN. However, an increasing number of remote employees are often working without VPN access due to performance limitations and increasing regional offices.
The IT team wants to enable these remote users to access WebPortal1 via Single Sign-On without requiring VPN, while maintaining on-premises authentication and adhering to corporate security policies aligned with the Microsoft Cloud Adoption Framework. The environment is synchronized with Azure AD (using Azure AD Connect) and device compliance is managed via Intune.
Key Requirements #
Provide remote users seamless, secure SSO access to the on-premises internal web application (WebPortal1) without requiring VPN. The solution must:
- Integrate with on-premises Active Directory authentication.
- Support Conditional Access policies for user device compliance and location.
- Avoid exposing the internal app directly to the internet.
The Options #
- A) Azure AD Application Proxy
- B) Azure AD Privileged Identity Management (PIM)
- C) Conditional Access Policy
- D) Azure Arc
- E) Azure AD Enterprise Application
- F) Azure Application Gateway
Correct Answer #
A) Azure AD Application Proxy
C) Conditional Access Policy
The Architect’s Analysis #
Correct Answer #
Option A (Azure AD Application Proxy) and Option C (Conditional Access Policy).
Step-by-Step Winning Logic #
Azure AD Application Proxy provides a secure, scalable solution for publishing on-premises web apps without VPN, maintaining integrated Windows authentication via Kerberos Constrained Delegation. This aligns with the Security and Operational Excellence pillars in the Well-Architected Framework by minimizing attack surface and simplifying user access.
Conditional Access protects access with policies that enforce compliant device scenarios and multi-factor authentication, supporting risk mitigation and governance objectives per the Cloud Adoption Framework.
The Traps (Distractor Analysis) #
Why not Azure AD PIM (B)?: #
PIM manages privileged identity lifecycles, unrelated to user access to legacy web apps.
Why not Azure Arc (D)?: #
Azure Arc is for hybrid management of servers and Kubernetes, not direct user access or identity.
Why not Enterprise Application (E)?: #
This is a registration artifact in Azure AD; by itself it doesn’t solve secure remote access or SSO.
Why not Application Gateway (F)?: #
App Gateway is a reverse proxy/load balancer but lacks the integrated identity and conditional access controls needed for seamless SSO with on-prem AD.
The Architect Blueprint #
- Diagram Note: Remote users authenticate against Azure AD, pass Conditional Access policies, and securely access the on-premises web app via Azure AD Application Proxy without a VPN.
The Decision Matrix #
| Option | Est. Complexity | Est. Monthly Cost | Pros | Cons |
|---|---|---|---|---|
| Azure AD Application Proxy (A) | Moderate | Low | Enables secure remote access, hybrid identity support, integrates with on-prem AD, minimal infra changes | Requires Azure AD Premium P1 license, on-premises connector installation |
| Conditional Access (C) | Low | Included in P1/P2 | Strong governance, conditional policies based on device/user risk, MFA enforcement | Needs ongoing policy tuning, user education necessary |
| Azure AD Privileged Identity Mgmt (B) | High | Moderate | Privileged identity governance | Unrelated to user remote access |
| Azure Arc (D) | High | Variable | Hybrid management for VMs & Kubernetes | No user access enablement |
| Enterprise Application (E) | Low | N/A | App registration constructs | Does not provide access or security controls alone |
| Azure Application Gateway (F) | Moderate | Moderate to High | Application-layer load balancing and WAF | No integrated AD or Conditional Access, VPN still required for IWA |
Real-World Practitioner Insight #
Exam Rule #
“For the exam, always pick Azure AD Application Proxy when a scenario involves secure remote access to on-premises apps using integrated authentication without VPN.”
Real World #
“In production, many enterprises combine Azure AD Application Proxy with Conditional Access policies tied to Intune device compliance and MFA, ensuring secure, seamless access for remote employees globally, even when VPN is impractical.”