Question

Contoso runs a legacy on-premises web application that relies on HTTP header-based authentication. The application cannot be modified to support modern protocols such as SAML or OpenID Connect. Contoso wants to publish this application to remote employees securely, enforce Microsoft Entra Conditional Access with MFA, and avoid deploying a VPN. Which solution should you recommend?

Accepted Answer

Publish the application through Microsoft Entra application proxy configured with header-based single sign-on and Microsoft Entra pre-authentication

Answer

Publish the application through Microsoft Entra application proxy using Pass-through pre-authentication

Answer

Register the application in Microsoft Entra ID as an OpenID Connect confidential client and enable SSO

Answer

Deploy Azure AD B2C with a custom policy to translate tokens into HTTP headers for the application