Application Proxy applications require preauthentication to block anonymous access

Overview

Without Microsoft Entra preauthentication configured on Application Proxy applications, threat actors can directly reach the internal URL of published on-premises applications without first proving their identity. When you use passthrough authentication, Application Proxy forwards traffic without validating the requestor, and all authentication responsibility falls to the internal application.

If you don’t configure preauthentication on Application Proxy applications:

• Threat actors can access internal application endpoints without identity verification, enabling reconnaissance and exploitation of backend vulnerabilities.
• Conditional Access policies can’t be enforced, so you can’t require multifactor authentication, evaluate sign-in risk, or apply location-based restrictions.
• You can’t integrate with Microsoft Defender for Cloud Apps for real-time session monitoring and control.

Remediation

• Configure Microsoft Entra preauthentication for Application Proxy applications by changing the Pre-Authentication method from Passthrough to Microsoft Entra ID.
• Use Microsoft Graph API to programmatically update Application Proxy settings.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Medium
Pillar	Network
Category	Application Proxy
Product	Entra ID
Feature	Applications
Area	Applications and workload identities
ATT&CK	T1190 Exploit Public-Facing Application
Licence	AAD_PREMIUM, AAD_PREMIUM_P2
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.