# Application Proxy applications require preauthentication to block anonymous access
Without Microsoft Entra preauthentication configured on Application Proxy applications, threat actors can directly reach the internal URL of published…
Source: https://maester.dev/docs/tests/ZTA.25401
## Overview
Without Microsoft Entra preauthentication configured on Application Proxy applications, threat actors can directly reach the internal URL of published on-premises applications without first proving their identity. When you use passthrough authentication, Application Proxy forwards traffic without validating the requestor, and all authentication responsibility falls to the internal application.
If you don't configure preauthentication on Application Proxy applications:
- Threat actors can access internal application endpoints without identity verification, enabling reconnaissance and exploitation of backend vulnerabilities.
- Conditional Access policies can't be enforced, so you can't require multifactor authentication, evaluate sign-in risk, or apply location-based restrictions.
- You can't integrate with Microsoft Defender for Cloud Apps for real-time session monitoring and control.
## Remediation
- [Configure Microsoft Entra preauthentication for Application Proxy applications](https://learn.microsoft.com/entra/identity/app-proxy/application-proxy-add-on-premises-application?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#add-an-on-premises-app-to-microsoft-entra-id) by changing the Pre-Authentication method from **Passthrough** to **Microsoft Entra ID**.
- [Use Microsoft Graph API to programmatically update Application Proxy settings](https://learn.microsoft.com/graph/application-proxy-configure-api?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | Network |
| Category | Application Proxy |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Applications |
| Area | Applications and workload identities |
| ATT&CK | [T1190](/docs/tests?mitre=T1190) Exploit Public-Facing Application |
| Licence | AAD_PREMIUM, AAD_PREMIUM_P2 |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.