I'm looking for a way to require Entra ID authentication before users reach the applications behind an Azure Application Gateway or Azure Front Door instance. The goal is to authenticate visitors as early as possible, before they reach any app infrastructure. I'd happily buy a carton of beer for someone who can provide a solid solution or working configuration.
4 Answers
You could put Microsoft Entra Application Proxy in front of the service. That gives you pre-authentication before the request reaches the application, although the fit depends on your network layout and whether the apps are suitable for Application Proxy.
Another approach is to use an API gateway to validate Entra ID tokens and enforce claims before requests reach the backend. If you use Front Door directly, a rule could check for the expected authentication cookie and redirect users when it’s missing, but that’s more of a custom workaround and needs careful handling of token validation and redirects.
Application Gateway has JWT validation features that can inspect Entra-issued tokens before forwarding requests. It’s currently a preview capability, but it can handle token validation and claims checks at the gateway. Make sure to test the preview behavior carefully before relying on it in production.
If the apps are hosted on Azure App Service, Easy Auth is probably the simplest option. It handles Entra ID sign-in and token validation at the App Service layer, so you don’t have to build the authentication flow yourself.
That sounds promising. Does the gateway also redirect unauthenticated users to an Entra sign-in page, or does it only validate a token that the client already has?