JUMP TO SECTIONChoose a lesson section
Visibility, access and enforcement are not the same control.
Publishing an application gives people a route to it. A My Apps collection gives them a way to find it. Application roles describe what a user or service can do. Terms of Use can require acknowledgment before an app is accessed. Treat these as four independent administrative decisions, not one setting.
Which control answers the ticket?
Application Proxy
Can a remote user securely reach an internal web app?Publish an on-prem web app behind Entra preauthentication and a private network connector that maintains outbound connections to Microsoft. Conditional Access can protect the cloud sign-in, while backend reachability and SSO remain separate.
VERIFY: Pilot external URL, connector health, internal DNS/TLS and optional KCD, plus permitted/denied user tests.My Apps collections
Can users find the apps they're already entitled to use?Admin-managed collections group launch tiles into task-oriented tabs. They filter and organize applications that users can already access; they do not grant membership in an app, change Conditional Access or add API permissions.
VERIFY: Review collection audience separately from enterprise app assignment and actual app access.Exposed application roles
What is the user or daemon allowed to do inside the app?Developers define roles in the app registration; administrators assign roles through the enterprise application or client app permission grants. Tokens can include a roles claim, but the API is responsible for validating and enforcing it.
VERIFY: Check member type, assignment/consent, token audience/claims, and real API behavior.Terms of Use
Did the intended user accept the policy before app access?A PDF Terms of Use statement becomes an enforceable sign-in control only when required by a scoped enabled Conditional Access grant. Approval, version changes, language and guest/device support all affect real results.
VERIFY: Check CA sign-in evaluation, acceptance/decline report, audit records and session re-prompt behavior.Entra can protect remote entry without an inbound firewall hole.
Microsoft Entra Application Proxy is for remote access to supported on-premises web apps. With Entra preauthentication, applicable Conditional Access evaluates access before the cloud proxy forwards to the private network connector. The connector initiates outbound service connections and then reaches the internal URL; there is no need to publish inbound listener ports from the Internet to the connector.
Inventory the legacy application
Document internal URL, DNS, certificate, authentication type, users, web-client assumptions, headers and business dependencies. Microsoft recommends Application Proxy for remote rather than unnecessary internal hairpinning.
Install and validate private network connectors
Install supported Windows Server connectors on the appropriate internal network. Allow outbound cloud connections and connector-to-app reachability. Use connector groups for application routing, resilience and separation; avoid inbound Internet firewall openings.
Publish external and internal URLs
Create an on-premises application through Entra Enterprise apps; select the connector group, internal URL and external URL. Custom domains need appropriate DNS and public TLS certificates.
Use Entra preauthentication for protected remote entry
Set Pre-Authentication to Microsoft Entra ID, configure assigned users/groups and Conditional Access. Passthrough intentionally bypasses Entra preauthentication at the proxy; don't describe it as protected by the same CA sign-in requirement.
Configure and validate backend SSO
For Windows Integrated Authentication, consider Kerberos Constrained Delegation and correct service principal names, identities, domain joining/trust. Test app-specific behavior; preauthentication alone doesn't make the backend accept the user.
Validate, monitor and prepare rollback
Confirm allowed/denied remote access, connector failover, diagnostics, backend authorization and operations ownership. Keep a supported fallback path and document impact before broadening users.
Entra sign-in blocked
User denied before reaching the connector
Check CA outcome, enterprise app assignment, authentication and intended policy scopeProxy service / connector unavailable
Cloud sign-in works, backend request fails
Check connector service, group, outbound egress, internal DNS and network reachabilityInternal application returns 401/403
Connector reaches the app but SSO/authorization fails
Validate KCD, SPNs, identity mapping and web app permissionsRemote app slow or intermittently failing
Connector capacity or app dependencies
Check telemetry, connector health, backend performance and remote-network pathPassthrough exposes a route without Entra preauthentication at the proxy entrypoint. A backend app may still authenticate users itself, but do not claim that Entra's preauth Conditional Access protected that request. Likewise, backend Kerberos SSO requires correct SPNs/delegation, not just a healthy cloud sign-in.
Application Proxy fault isolation
Work through three decisions. Review the available evidence, choose an action, and explain why it is safer than the alternatives. Fictional environment; no live tenant access.
External authentication works; the internal app does not load.
- The employee passes Microsoft Entra preauthentication.
- The browser receives a gateway or upstream connection error.
- The on-premises app is reachable from a server on the internal network.
What evidence should the operator gather next?
Organize what users already have. Don't grant access by rearranging tiles.
Microsoft Entra My Apps collections are user-facing app launcher groupings—for Finance, Support, Sales or another workflow. With Entra ID P1/P2 and suitable administration rights, create them at Entra ID → Enterprise apps → App launchers. The collection controls grouping and availability of launch tiles. It does not create new application assignments or API authorization.
Create a named collection
Entra ID → Enterprise apps → App launchers → New collection. With P1/P2 and suitable permissions, choose a clear name such as Finance Workbench, not a duplicate of the default Apps list.
Select only useful launch tiles
Add existing enterprise applications, order them sensibly and review whether each application is visible to the intended user. A collection doesn't create an application or assign it.
Set collection owners and audience
Choose a delegated collection owner and users/groups who should see the collection. The audience controls visibility of this grouping, not authorization to each underlying app.
Verify two types of access
Test whether the collection shows up, then test whether the user is independently allowed to sign in to each app. Use enterprise app assignment and audit records to diagnose mismatches.
In a Northstar Finance Workbench collection, a user sees only launchable applications they're entitled to access. If a tile is missing, verify the enterprise application's assignment, app visibility, SSO and user access. Making a new collection does not fix a denied API call.
The app declares the role. The API must enforce it.
App registrations define a resource application's roles. The enterprise app service principal is its tenant instance, where an admin can assign users and groups to those roles. Separately, roles with Applications as allowed member types can become app permissions for service principals—after appropriate admin consent. An assigned role can appear in the token's roles claim, but this does not automatically implement authorization within a web API.
Define resource roles
In the app registration's App roles section, define a stable GUID, display name, value (e.g. Invoice.Approver), description, enabled state, and allowed member types. Values should match what the API expects.
Choose who can receive each role
Users/Groups roles are assigned on the enterprise app; Applications roles expose app permissions for service principals and unattended clients. Those are not interchangeable login models.
Grant the appropriate entitlement
For users or groups, manage Users and groups on the enterprise app. For daemon clients, select the API application permission and obtain required tenant administrator consent.
Validate token and resource authorization
The resource may receive a roles claim reflecting the assignment. Validate issuer, audience, expiry and roles in the intended token; the application/API must reject unauthorized operations, even if the portal reports a role assignment.
Invoice.Approver is an application-specific authorization value, not the tenant's User Administrator or Global Administrator role. Likewise, an unattended service principal with an application permission has a different consent and token flow from a signed-in employee. Inspect the correct token audience, permissions and application's enforcement code.
A PDF is not an enforced policy until Conditional Access requires it.
Microsoft Entra Terms of Use can require users, including supported B2B guests, to acknowledge approved policies at interactive sign-in. Prepare an accessible PDF and configure language versions, expiration or reacceptance as needed. Then create or enable a scoped Conditional Access policy whose grant control requires that specific Terms of Use policy.
Approve and upload the PDF
Entra ID → Conditional Access → Terms of use. Requires Entra ID P1 and appropriate Conditional Access permissions. Use the approved PDF and create language versions when necessary.
Choose appropriate user experience
Set display name, optionally require expanding the terms, and decide whether to use expiration or new-version reacceptance. Per-device consent requires registered devices and is not supported for B2B guests.
Enforce through scoped Conditional Access
Use a custom CA policy targeted to appropriate users/groups and modern-auth applications, requiring the specific Terms of Use grant. Report-only doesn't enforce it. Exclude service accounts and preserve emergency access.
Validate accept and decline paths
Test a permitted interactive user and a declined flow. The decline should block the targeted app. Check sign-in Conditional Access logs and Terms of Use accepted/declined records.
Update document and inspect version evidence
When legal changes the PDF, upload a new version and select Require reaccept where needed. A current session may delay the next prompt; history and audit reporting provide evidence. Deleting a policy removes its associated acceptance records.
Standard Terms of Use can apply to B2B guest sign-in, but requiring consent separately on every device is unsupported for B2B. Per-device consent is also unsupported for the Microsoft Intune Enrollment app. Exclude noninteractive service accounts from CA policies that require interactive acceptance. A declined required agreement blocks targeted access.
Sign-in logs may show an interruption followed by success when acceptance is completed. Use ToU accepted/declined history and audit logs as evidence. Updating a PDF can require renewed acceptance, but a still-valid session might delay the next prompt. Confirm behavior with a real pilot sign-in before claiming compliance.
What happens after the user clicks the app?
Test three Application Proxy route gates, then resolve four fictional Northstar tickets: remote payroll failure, missing My Apps entitlement, an unenforced API role, and a guest Terms of Use requirement.
The proxy publishes the URL. Is the app actually protected and reachable?
Toggle the three checks for a fictional remote Payroll application. These gates illustrate the route; they don't replace real backend SSO and authorization tests.
Next, validate backend SSO/KCD, the actual app authorization, and sign-in logs for allow and deny cases.
Four application incidents. Four different enforcement layers.
Trace the evidence through the right boundary before selecting a fix.
Entra signs in. The legacy app still refuses the connection.
AVAILABLE EVIDENCE
- The published finance application is using Microsoft Entra preauthentication.
- The connector group reports one offline connector and an unverified internal DNS record.
- The backend uses Integrated Windows Authentication.
Verify the control's actual scope before publishing it.
App Proxy, SSO, My Apps, app roles and Terms of Use have different prerequisites and licensing constraints. Use Microsoft's current documentation when implementing these controls in a real tenant.
Visible doesn't mean authorized.
Practice 021 features 16 original flashcards, 16 explained questions and two multi-step Northstar enterprise application incidents.