Application Proxy

Application Proxy allows access to on-prem web applications after sign-in to Entra ID. Application proxy has following components:

– Endpoint - This is the external URL that the users browse to access the on-prem application. External users must authenticate to AAD

– Application Proxy Service - This services runs in the cloud and passes the token provided by Entra ID to the on-prem connector

– Application Proxy Connector - This is an agent that runs on the on-prem infrastructure and acts as a communication agent between the cloud proxy service and on-prem application. It also communicates with the on-prem AD in case of SSO

– On-prem application - The application that is exposed using application proxy

1

Enumerate the applications that have application proxy

C:\AzAD\Tools\Get-MgApplicationProxyApplication.ps1

Output of the above command

Get the Service Principal (Enterprise Application)

Get-MgServicePrincipal -Filter "DisplayName -eq 'Finance Management System'

Output of the above command

2

Find users and groups assigned to the application

C:\AzAD\Tools\Get-MP7GHiKeVCbKTgEhuyuUnkGg6HdQt5oKyX.ps1 Get-ApplicationProxyAssignedUsersAndGroups -ObjectId ec350d24-e4e4-4033-ad3f-bf60395f0362