AZ-305 Practice Question 22: Legacy App Remote Access
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 3 · question 2 of 10
An engineering firm runs an internal expenses application on an on-premises IIS server that uses Integrated Windows Authentication against Active Directory. After closing its offices, the firm needs 3,000 remote staff to reach the application from home. The design must:
- require no VPN client on user devices, - open no inbound port on the corporate firewall and add no perimeter network, - enforce the firm's existing Conditional Access and multifactor authentication policies before a request reaches the application, - preserve single sign-on to the application without modifying its code.
What should you recommend?
Show answer and explanation
Answer:
Application proxy is built precisely for this case: it provides secure remote access to on-premises web applications, and Microsoft describes it as replacing VPNs and reverse proxies for remote users accessing internal resources. The private network connector uses only outbound connections over ports 80 and 443, so no inbound firewall ports and no perimeter network are needed. Preauthentication happens in Microsoft Entra ID, which means Conditional Access and multifactor authentication apply before traffic reaches the back end, and for applications that use Integrated Windows Authentication the connector performs Kerberos constrained delegation so single sign-on works without changing the application.
Option B meets the security bar but not the usability one: it requires a VPN client to be deployed and supported on 3,000 remote devices, and it places the whole corporate network, not one published application, within reach of every connected endpoint.
Option C is the legacy pattern the firm is trying to avoid. It builds and maintains the perimeter network and edge servers explicitly ruled out, exposes the application server to inbound traffic, and Front Door's WAF inspects requests without providing the identity preauthentication or the Kerberos single sign-on the application needs.
Option D is a migration project, not a remote-access design. Rewriting the authentication of a working line-of-business application violates the "no code change" requirement and takes months, where application proxy publishes the existing application as-is.
Reference: Publish on-premises apps with Microsoft Entra application proxy