5. Conditional access DirectAccess & automatic VPN Desktop Virtualization

7. Backend Server AD FS Backend Server Config. Store Web Application Proxy DMZ AD FS Proxy FirewallLoad Balancer Firewall Active Directory Domain Controller Client (browser, Office client or modern app) Corporate NetworkInternet HTTP/S AuthN Config. API over HTTPS AuthN Web UI Claims, KCD, OAuth, MSOFBA, or pass-through Obtain KCD ticket for IWA AuthN

10. Users can register their devices to gain access to corporate data and apps and single sign-on through device authentication Conditional access with multi-factor pre- authentication is provided on a per- application basis, leveraging user identity, device registration & network location Published applications AD FS provides rich authentication and authorization capabilities including multi-factor and federation. Publish any standard Web/HTTP server. Single Sign On using Kerberos, claims, Office or OAuth New Windows Server 2012 R2 role service under RRAS server role, integrated into Windows Server Manager and RRAS admin experience (PSH + UI).

11. http://lob https://sts.fabrikam.com WAP

12. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com https://sts.fabrikam.com

13. http://lob WAPLOB https://sts.fabrikam.com https:/lob.fabrikam.com https://sts.fabrikam.com

14. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com ? 302 https://sts.fabrikam.com

15. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com ? ?

16. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com Edge Policies Application Policies

17. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com https://sts.fabrikam.com

18. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com https://sts.fabrikam.com

19. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com https://sts.fabrikam.com

20. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com https://sts.fabrikam.com Query String Query String

21. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com https://sts.fabrikam.com Query String

22. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com https://sts.fabrikam.com ? Query String

23. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com https://sts.fabrikam.com Query String

24. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com https://sts.fabrikam.com Query String

25. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com https://sts.fabrikam.com ? 401

26. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com https://sts.fabrikam.com Kerberos Constrained Delegation

27. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com https://sts.fabrikam.com AP_REQ(tckt)

28. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com https://sts.fabrikam.com

29. http://lob https://sts.fabrikam.com WAPLOB https:/lob.fabrikam.com https://sts.fabrikam.com

30. http://lob https://sts.fabrikam.com https://enterpriseenrollment. fabrikam.com DRS WAP https://enterpriseenrollment. fabrikam.com LOB https:/lob.fabrikam.com

39. Azure Active Directory Corporate Network DMZ

40. Once started, the connectors open HTTP requests to the WAP service. The requests remain waiting until user request arrives or timeout AAD-AP Connector AAD-AP Connector AAD-AP Cloud Service

41. User sends a request to the public address of the service that is unique per tenant and per application. E.g. https://app1-contoso.cwap.net/ AAD-AP Connector AAD-AP Connector AAD-AP Cloud Service

42. The WAP service selects one of the pending connector requests and send the user request as payload. AAD-AP Connector AAD-AP Connector AAD-AP Cloud Service

43. The connector sends the user request to the backend application and once there is a response, it sends it to the server as a new request AAD-AP Connector AAD-AP Connector AAD-AP Cloud Service

44. The cloud service returns the response to the client request AAD-AP Connector AAD-AP Connector AAD-AP Cloud Service

45. User sends a new unauthenticated request to applications that is configured to require preauthentication. AAD-AP Connector AAD-AP Connector AAD-AP Cloud Service

46. WAP redirects the user to the Azure AD STS address with information on the application that needs preauthentication. Nothing is sent to the backend. AAD-AP Connector AAD-AP Connector AAD-AP Cloud Service

47. User is authenticating to Azure AD STS. This process may involve other systems depending on tenant configuration. E.g. 2FA and federation. Once done, user is redirected back to the WAP service with a token AAD-AP Connector AAD-AP Connector AAD-AP Cloud Service

48. The user request arrives again but now with a valid authentication token. Once the token is validated, the request is sent to the backend application AAD-AP Connector AAD-AP Connector AAD-AP Cloud Service

51. www.microsoft.com/learning http://microsoft.com/msdn http://microsoft.com/technet http://channel9.msdn.com/Events/TechEd