A company hosts a legacy internal web application on an on-premises IIS server that uses Integrated Windows Authentication (Kerberos). Employees now work primarily from home and connect over the internet. The security team requires that access be protected by Azure AD (Microsoft Entra ID) with Conditional Access and MFA, without deploying a VPN and without exposing the application directly to the internet. Users must experience single sign-on to the application. Which solution should you recommend?