SSO for IIS web server in Azure over Application Proxy

Hello,

in Azure there is a VM on which an IIS server with Windows Authenticatiob (NTLM) authentication is installed.

This server has membership in an on-prem domain, which is also a VM in Azure.

Azure has an Application Proxy configured to publish to this local IIS server. Application Proxy has SSO enabled and the Header-Based method. Configured via Microsoft Entra ID and header "user.userprincipalname".

Essentially, of course, SSO does not work, the user enters Entra ID credentials, and then on-prem credentials.

Between Azure Entra ID and on-prem ADDS synchronization is not configured and is not planned, the maximum that can be enabled is pass-through authentication, without synchronizing users.

My own question: I would like to make the application accessible from the outside and use Entra ID authentication, which offers MFA (this is the key reason). But so that you can authenticate once, without having to enter an on-prem login and password.

I understand that:

1. Different Indentity providers, of course there is no synchronization yet, these are all different users in different databases (EntraID and on-prem).
2. IIS is not designed to work with EntraID and it does not have a provider to work with EntraID.
3. The best way is to transfer the application to Azure Application Service and enable Entra ID authentication there, install AD Connect with the SSO option so that on-prem users can gain access (if required).

But perhaps there are other options, to do SSO like this?

For example user Azure Active Directory and trust with on-prem ADDS. I don`t know :(

Thank you.