A security engineer is implementing Microsoft Entra ID Application Proxy for an internal AI dashboard application. The application uses OAuth 2.0 for authentication. The engineer needs to configure pre-authentication so that only authenticated Entra ID users can reach the application. Which Application Proxy pre-authentication mode should be configured?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you want Microsoft Entra ID pre-authentication because it forces users to authenticate with Entra ID, and satisfy Conditional Access, before Application Proxy forwards anything to the internal AI dashboard. That keeps unauthenticated users from reaching the app.
Full Explanation
Microsoft Entra ID pre-authentication is correct because it requires users to authenticate with their Entra ID credentials, and satisfy any Conditional Access policies, before the Application Proxy service forwards the request to the internal application. This means unauthenticated users never reach the internal AI dashboard, and Conditional Access can enforce additional controls such as device compliance and multi-factor authentication at the Application Proxy layer. The passthrough pre-authentication mode, as the application handles its own OAuth 2.0 authentication, is incorrect because it forwards all requests to the internal application without requiring Entra ID authentication at the Application Proxy layer; this reduces security because the internal application's authentication is the only gate. The header-based authentication approach using X-Forwarded-For headers from Application Proxy connectors is incorrect because header-based authentication is a method for passing user identity attributes to applications that accept headers, not a pre-authentication mode for Application Proxy. The certificate-based pre-authentication approach using client certificates validated by Application Proxy is incorrect because certificate-based pre-authentication for Application Proxy is not a standard configuration option; Application Proxy supports Entra ID pre-authentication and passthrough modes.