Quick Note — Recommend a Solution for Authorizing Access to On-Premises Resources
AZ-305 › Unit 1: Design identity, governance, and monitoring solutions › Design authentication and authorization solutions › Recommend a solution for authorizing access to on-premises resources
Quick Note — Recommend a Solution for Authorizing Access to On-Premises Resources
Organizations rarely enjoy a greenfield cloud environment. Decades of on-premises investment — SharePoint, SAP, Oracle EBS, custom line-of-business web apps, Windows file shares — anchor identity to Active Directory. When users shift to remote work, mobile devices, and SaaS, the architect's question becomes: how do we let an Entra ID-authenticated user reach a Kerberos-only app sitting on a Windows Server in the Toronto datacentre, without giving everyone a VPN and opening the attack surface wide?
Retrieval target
- Recommend a Solution for Authorizing Access to On-Premises Resources
- Closed-book recall
- 5 minutes
- Open the full lesson after a miss
Decision anchors
| Prompt | Compact answer |
|---|---|
Entra ID Application Proxy | An Entra ID feature that publishes on-prem web apps to the internet through an outbound reverse-proxy connection. Users hit a *.msappproxy.net URL, authenticate to Entra ID, and Entra forwards the request to the on-prem app. No inbound firewall hole, no VPN, and Conditional Access applies — same controls as cloud apps. |
Application Proxy connector | A lightweight Windows service installed inside the on-prem network that makes only outbound connections to Entra's App Proxy service. It receives forwarded user requests, talks to the on-prem app, and returns the response. Deploy two or more per connector group for HA. Connector groups also let you route different apps to different sites or DMZs. |
Pre-authentication (App Proxy) | App Proxy can authenticate the user at Entra ID before forwarding the request (mode: Entra ID pre-auth) or pass the request through to the on-prem app to authenticate (mode: Passthrough). Pre-auth is strongly preferred — it lets you apply MFA and Conditional Access, blocks unauthenticated scanners, and is required for SSO modes to work. |
Enterprise application (Entra ID) | The service-principal-backed entry in your tenant for any app you've integrated for SSO and provisioning — gallery SaaS, custom-developed, or on-prem (via App Proxy). Per-app you can assign users / groups, configure SSO mode, enable SCIM provisioning, attach Conditional Access policies, and view sign-in logs. Distinct from the global application object created via app registration. |
Read the answers once, then cover the right-hand column and reconstruct each one from the prompt. A useful answer names the requirement, the recommended control or service boundary, and the nearest alternative it rejects. If you can only recognize the answer after seeing it, retrieval is not yet secure.
Ninety-second explanation
Without notes, explain:
- What requirement signals this learning objective rather than a neighbouring one?
- Which two solution families are most likely to be compared?
- Which hard constraint eliminates the strongest distractor?
- What identity, network, data, or failure boundary must appear in the design?
- Which operational test would prove the recommendation works?
Then compare your explanation with the full lesson. Record the missing decision rule—not merely the missed product name—in your error log.
When to open the full lesson
Open the curriculum-linked lesson when you cannot explain a comparison, when a scenario depends on a numeric limit or SKU feature, or when the service is on a retirement path. Use current Microsoft Learn documentation for availability, limits, pricing, naming, and migration milestones; the quick note is intentionally compact.
Source and freshness
Derived from the linked AZ-305 lesson and retrieval deck, grounded in both attached course sources. Reviewed 2026-08-02. Current Microsoft documentation controls changing product contracts.