A security engineer needs to implement Microsoft Entra ID Application Proxy to publish an internal AI web application securely for remote workers, without requiring a VPN. The AI application uses Windows Integrated Authentication (WIA) for on-premises users. How should Kerberos Constrained Delegation (KCD) be configured for Application Proxy?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because for Kerberos Constrained Delegation with Microsoft Entra Application Proxy, the Application Proxy connector server's computer account (or a dedicated service account) must be configured in Active Directory with constrained delegation rights to the target application's Service Principal Name (SPN). This is done in AD Users and Computers on the connector machine's account properties, Delegation tab.
Full explanation below image
Full Explanation
A is correct because for Kerberos Constrained Delegation with Microsoft Entra Application Proxy, the Application Proxy connector server's computer account (or a dedicated service account) must be configured in Active Directory with constrained delegation rights to the target application's Service Principal Name (SPN). This is done in AD Users and Computers on the connector machine's account properties, Delegation tab. B is incorrect because while the Entra admin center Application Proxy settings can specify the Internal Application SPN (used to configure KCD), the actual KCD permission must be granted in on-premises Active Directory, not just in the Entra admin center. C is incorrect because Microsoft Entra Kerberos for cloud Kerberos trust is for enabling passwordless or FIDO2 authentication to on-premises resources, not for Application Proxy KCD scenarios. D is incorrect because certificate-based authentication would change the authentication method for all users, not preserve WIA for existing internal users.