Object of this document

Size: px

Start display at page:

Download "Object of this document"

Hester McDowell
6 years ago
Views:

1 Publish applications using Azure AD Application Proxy It s imperative that I clear what application means in this context. A lot of people are confused application with mobile applications and other applications running in the office. Applications It could be your intranet website running in your organization It could be your internal E-leave system It could be your HR portal It could be your on-premise Exchange OWA It could be your on-premise SharePoint portal It could be any internal applications Object of this document In this document we are trying to accomplish to publish an Intranet portal so that users would be able to access it from wherever they are, whichever devices they use and without evening needing to access through VPN yet securely and with single identity. To enhance the security, better yet, Microsoft Azure AD also provides Multi-Factor Authentication (MFA). Pre-requisite 1. An application to be published. 2. You subscribed to Azure AD Premium or at least Basic Edition. 3. Your organization has either Directory sync with Password Sync using DirSync or AAD Sync or Federation/SSO with Office365 or any of Office365 subscription plans. 4. Windows 2012 R2 ( domain joined or non-domain joined all supported) 5. AADApplicationProxyConnectorInstaller that you can download from Azure AD portal and to be installed on Windows 2012 R2 server, I ll detail more in the following document.

1. First of all, have ready a Windows 2012 R2 machine, be it virtual or physical machine, it is internet connected and your Internet firewall is open to port 443 incoming and outgoing (almost all

Later we ll download AADApplicationProxyConnectorInstaller from Azure portal and install it on that Widows 2012 R2 server. 3.

2 1. First of all, have ready a Windows 2012 R2 machine, be it virtual or physical machine, it is internet connected and your Internet firewall is open to port 443 incoming and outgoing (almost all organization is already open port 443 by default) and you don t need a public IP for this server and no NAT or particular Firewall rule required. 2. Later we ll download AADApplicationProxyConnectorInstaller from Azure portal and install it on that Widows 2012 R2 server. 3. Test from that Windows 2012 R2 server machine that it s able to resolve and reachable to an application, in my case an Intranet site, Currently, if our users want to access this Intranet site, they must be residing in the office or if outside, use our office VPN to connect this Intranet site. After publishing this Intranet site through AAD Application Proxy connector, we should be able to access this Intranet site securely wherever we are from any devices, using Active Directory login credentials without needing to go through VPN connection.

4. Login to Azure Portal https://manage.windowsazure.

3 4. Login to Azure Portal with your administrator username and password. Click on your organization s name -> Click on Applications

4 5. Click ADD and choose Publish an application that will be accessible from outside your network.

5 Name: A descriptive name, just a name. Internal URL: URL that we use to access our Intranet Portal, (no need to be publicly accessible name) just type your Intranet portal URL or application URL, etc. Pre-authentication Method leave default, Azure Active Directory

6 6. Ensure that Enable Application Proxy is enable and click Download a Connector Tick I accept and click Download and copy it to the Windows 2012 R2 server you prepared early.

7 7. Double-click on the downloaded AAD Application Proxy Connector, click Install and follow the wizard and complete the installation.

8 Click Azure AD/Office365 Administrator name and click Continue, and type AD/Office365 Administrator name and password and click Sign In.

9 You should see the Setup Successful windows as shown. At Services, you should see Microsoft AAD Application Proxy Connector is Running.

10 8. Go back to Azure Portal and click on Assign Accounts as shown. This step is to assign users or groups to access the published Intranet, we did in the previous steps. You could choose by users or groups, in my case, I am going to assign one user, thetnaing@thetnaing.com to access the published Intranet, Click on the user you want to assign permission to access the Intranet site.

11 9. Testing, at the Configure tab, take note of the external URL, Go to a client s PC, open a browser and type the URL.

complete email address and password that you

12 You ll be redirected to the Microsoft Online login page as follow, and type the user s complete address and password that you assigned to access this published Intranet site.

13 As you can see in the URL, I am able to access our organization s Intranet site through Microsoft Azure Application Proxy connector. I don t need any VPN connection, I can access it from everywhere and any devices securely with single identity!!! So now, you can start assigning more users and groups to access this published Intranet site. If you may notice that the external URL to access the published Intranet site is not representing our organization s name. Because you would need to provide the URL to the users and it should reflect your organization s name, for example, intranet.thetnaing.com. What you can do in this case is, create a CNAME record in your public DNS server that points CNAME intranet-radcomms.msappproxy.net points to intranet.thetnaing.com After that your users will be able to access it instead.

14 10. To enhance security, you can turn on MFA for this published Intranet site. At the Configure tab, turn it ON and click Save.

15 Click Set it up now to proceed with mobile phone verification steps and authentication. Once it s done, MFA is enforced the next time the user(s) login.

Use EMS to protect your mobile data and mobile app

Use EMS to protect your mobile data and mobile app Peter Daalmans Senior Consultant, Enterprise Mobility MVP CTGlobal. pds@ctglobalservices.com PETER DAALMANS Enterprise Mobility MVP @ CTGlobal Blog: https://peterdaalmans.com