Enterprise Applications and Application Proxy

What it is

An enterprise application is an application that your tenant uses, with its own settings for sign in, access and consent. It is the service principal that represents the app in your tenant. You can add software as a service apps from the gallery, apps you build, and on premises web apps published through Application Proxy.

Managing enterprise applications means setting up single sign on, deciding who can use the app, controlling consent, and organising apps for users.

How it works

Single sign on methods

Configuring SAML for a gallery app

Adding a gallery app and enabling SAML involves the following.

1. In Basic SAML Configuration, enter the vendor's Identifier (Entity ID) and the Reply URL, also called the assertion consumer service URL. A sign on URL and relay state are optional.
2. Review Attributes and claims, which decide what information goes in the token, such as email or group claims.
3. Take the SAML signing certificate details and the Federation Metadata XML, and give them to the vendor so it trusts Entra ID.
4. Assign users and groups, then test the sign in.

The vendor's identifier and reply URL go into Basic SAML Configuration. The federation metadata goes to the vendor. Creating an app registration is not part of configuring a gallery SAML app.

Controlling who can use the app

• Assignment required? When set to Yes, only users and groups assigned to the app can sign in. When No, any user in the tenant can.
• Users and groups. Assign a user or group, and for apps that define app roles, choose the role. Assigning groups to an application needs Entra ID P1.
• Visible to users. Decides whether the app appears in My Apps.
• Owners can manage the app without being administrators.

Two administrator roles manage enterprise apps. The Cloud Application Administrator manages them but cannot manage Application Proxy settings. The Application Administrator can also manage Application Proxy.

User consent and admin consent

When an application asks for permission to access data, a user or an administrator may need to consent. In Consent and permissions you choose the policy.

• An admin consent workflow lets users request consent when they cannot give it, and designated reviewers approve or deny.
• Grant admin consent for the tenant approves the permissions for everyone.
• Permission classifications mark permissions as low impact, so users may consent to them under the middle setting.
• Users can register applications, in User settings, is a different setting. It controls whether ordinary users may create app registrations. Turn it off to stop that.

Application collections

In My Apps, users see their applications. An administrator can create collections that group apps, for example Finance or HR, so users find them easily. Collections can be assigned to specific users and groups.

Microsoft Entra Application Proxy

Application Proxy publishes an on premises web application to remote users without a VPN or a firewall opening for inbound connections.

• A connector is a small agent installed on a Windows server in the corporate network. It makes only outbound connections, over ports 80 and 443, to the Application Proxy service.
• Connectors are placed in connector groups to serve different apps, sites or regions.
• You set an internal URL, which the connector uses, and an external URL, which users use.
• Pre-authentication can be Microsoft Entra ID, where users sign in first and Conditional Access applies, or Passthrough, where the app handles it.
• Single sign on to the on premises app can use Kerberos constrained delegation for integrated Windows authentication, header based methods or password based.

Application Proxy needs Microsoft Entra ID P1. It suits apps such as internal portals and SharePoint on premises. It is not needed for a SaaS app that supports SAML.

Automatic provisioning

Many gallery apps support provisioning, using the SCIM standard, so Entra creates, updates and removes users in the app automatically. The Provisioning logs show what happened.

Choosing the approach

A worked scenario

A company adds a SAML gallery app for expenses. The admin enters the vendor's identifier and reply URL in Basic SAML Configuration, downloads the federation metadata for the vendor, sets Assignment required to Yes and assigns the Finance group. Under consent settings, user consent is limited to verified publishers for low risk permissions, and an admin consent workflow lets users ask for more. An internal HR portal is published with Application Proxy, using two connectors in a connector group and Entra pre-authentication, so Conditional Access applies. Both apps are placed in an HR collection in My Apps.