What’s the safest way to publish internal web apps to managed and BYOD mobile devices?

I’d put an identity-aware reverse proxy or ZTNA gateway in front of everything and make sure the applications are never directly reachable. The gateway should authenticate the user before forwarding any request, enforce Entra-based access policies, and ideally apply MFA and device or risk conditions where available. That way, a vulnerable app is not responsible for deciding whether an unauthenticated request should be allowed. Keep the containers on private network segments, allow the proxy to reach only the specific app backends it needs, and still treat authorization inside each application as necessary defense in depth.

A mesh VPN with subnet and service-level segmentation is another practical option. You can keep the applications completely off the public internet and publish only the required HTTPS services through the VPN layer. This works well when the organization is comfortable with users opening a browser through a managed access path, but BYOD usability and onboarding need careful testing. I’d avoid relying on a memorable VPN URL as a security control; use proper identity policies, short-lived sessions, logging, and a clear separation between user access and administrative access.

A cloud access gateway or tunnel is usually the simplest operationally. It can publish internal services without inbound firewall exposure and apply Entra authentication before traffic reaches the applications. The tradeoff is that requests pass through a third party, which conflicts with your stated preference and introduces another dependency, so I’d treat it as a deliberate exception rather than the default. If you choose this route, review data processing, logging, outage behavior, vendor access, and whether the licensing and free-tier terms are appropriate for production.

If keeping the traffic on-premises is the priority, use the existing DMZ load balancer and WAF as the public edge, but add a dedicated pre-authentication layer rather than forwarding directly to the apps. Put the proxy and WAF in the DMZ, keep application containers on isolated internal networks, and permit only narrowly defined east-west flows. For BYOD, authenticate with Entra ID and enforce MFA, session timeouts, conditional access, and restrictions on downloads or copy/paste where the tooling supports it. Managed devices can receive stronger device-compliance policies, while unmanaged devices should get a more limited access profile.

Whatever edge design you choose, don’t assume pre-authentication makes unsafe code safe. Run the apps with least-privilege service accounts, isolate namespaces and workloads, restrict outbound traffic, keep secrets outside images, scan dependencies and container images, and add centralized logging and alerting. Test for broken authorization, IDOR, injection, SSRF, insecure file handling, and overly broad API permissions. The gateway should reduce exposure, but each application still needs its own authorization checks because users may be authenticated yet not entitled to every function or record.