Question
You have an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure Active Directory (Azure AD) tenant.
You have an on-premises web app named WebApp1 that only supports Kerberos authentication.
You need to ensure that users can access WebApp1 by using their Azure AD account. The solution must minimize administrative effort.
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Explanation
In Azure AD: The Azure AD Application Proxy service — the cloud-side Application Proxy service is what you enable and configure in the Azure AD tenant; it publishes WebApp1 at an external Azure AD URL, pre-authenticates the user with their Azure AD account, and then forwards the request down to your network. Web Application Proxy is a Windows Server (Remote Access) role service that runs on-premises, not something you configure in Azure AD, and the connector is likewise an on-premises component.
On-premises: The Azure AD Application Proxy connector — the lightweight connector agent is installed on a domain-joined Windows Server inside your network, where it makes outbound-only connections to the Application Proxy service and performs Kerberos constrained delegation (KCD) on the user's behalf so WebApp1, which only supports Kerberos, receives a valid Kerberos ticket. Deploying Web Application Proxy instead would require an AD FS infrastructure plus inbound firewall openings and a DMZ server, which is far more administrative effort than the connector.
