Question

Your company hosts an internal expense-tracking web application on Windows Server that uses Integrated Windows Authentication (IWA). You have published the app externally through Microsoft Entra application proxy. Remote users successfully reach the application's sign-in prompt through the external URL, but after authenticating to Microsoft Entra ID they are prompted again for their on-premises domain credentials by the backend server. You need to eliminate the second prompt so users get seamless single sign-on to the backend. What should you configure?

Accepted Answer

Set the application proxy Single Sign-On mode to Windows Integrated Authentication (Kerberos constrained delegation) and specify the backend server's SPN and delegated login identity.

Answer

Change the pre-authentication method on the application proxy connector to Passthrough.

Answer

Configure a SAML-based single sign-on setting in the enterprise application and upload the app's signing certificate.

Answer

Enable header-based single sign-on and map the user's UPN to a custom HTTP header sent to the backend.