A security engineer is implementing Microsoft Entra ID Application Proxy for an internal AI dashboard application. The application uses OAuth 2.0 for authentication. The engineer needs to configure pre-authentication so that only authenticated Entra ID users can reach the application. Which Application Proxy pre-authentication mode should be configured?

B is correct because Microsoft Entra ID pre-authentication in Application Proxy requires users to authenticate with their Entra ID credentials (and satisfy any Conditional Access policies) before the Application Proxy service forwards the request to the internal application. This means unauthenticated users never reach the internal AI dashboard, and Conditional Access can enforce additional controls (device compliance, MFA) at the Application Proxy layer. A is incorrect because Passthrough pre-authentication forwards all requests to the internal application without requiring Entra ID authentication at the Application Proxy layer; this reduces security as the internal application's authentication is the only gate. C is incorrect because header-based authentication is a method for passing user identity attributes to applications that accept headers, not a pre-authentication mode for Application Proxy. D is incorrect because certificate-based pre-authentication for Application Proxy is not a standard configuration option; Application Proxy supports Entra ID pre-authentication and passthrough modes.