Yes. A cloud identity proxy is a strong way to modernize access to legacy on-premises web apps without rewriting the applications or exposing them directly to the Internet.
The important security property is that the legacy server doesn't need an inbound Internet-facing port. For example, Microsoft Entra Application Proxy uses a cloud service plus an on-premises connector; the connector establishes outbound connections to the cloud service.
How I would implement it
1. Put the identity provider in front of the application
Users first authenticate to your cloud IdP rather than directly to the legacy application.
Depending on your environment, good choices include:
— particularly attractive if you're already using /Entra ID.
Google Cloud Identity-Aware Proxy (IAP) — useful in a Google Cloud-centric environment.
Cloudflare Access + Tunnel — useful if you want an identity-aware edge independent of your primary cloud.
All three can put an identity/policy layer in front of HTTP applications while keeping the application private. Google specifically supports an on-premises IAP connector, while Cloudflare uses Cloudflare Tunnel to create an outbound connection from the private network.
2. Make authentication modern even if the application isn't
Your legacy application might only understand:
Integrated Windows Authentication
Kerberos/NTLM
HTTP headers
forms authentication
or perhaps no authentication at all.
The proxy can handle modern authentication such as SSO and MFA at the edge, then translate that authenticated session into something the legacy application understands.
For example, Microsoft Entra Application Proxy supports Integrated Windows Authentication using Kerberos Constrained Delegation and also supports header-based SSO for applications that expect an authenticated HTTP header.
That gives you:
Modern user authentication
↓
Entra ID / Google Identity / other IdP
↓
MFA + Conditional Access
↓
Identity-aware proxy
↓
Legacy authentication mechanism
↓
Legacy application
3. Apply authorization at the proxy
Don't simply say "any authenticated employee can access it."
Create an application-specific policy such as:
Allow:
Finance-App-Users
AND
MFA satisfied
AND
device is compliant
AND
risk is acceptable
Deny:
everyone else
Microsoft Entra Application Proxy can be combined with Conditional Access and identity/risk controls, while Google IAP supports IAM policies using identity and contextual signals.
Cloudflare Access similarly evaluates Access policies before forwarding a request to the application and can use identity and device-posture signals.
4. Keep the legacy server isolated
Ideally the application server should have:
no public IP
no inbound Internet access
firewall rules permitting traffic only from the connector/proxy network
HTTPS between proxy/connector and application where practical
minimal privileges for the connector
separate connector hosts for redundancy
For Microsoft Entra Application Proxy, Microsoft specifically recommends capacity planning and redundancy for private network connectors.
5. Don't use the proxy as a substitute for application security
This is an important distinction.
An identity proxy protects access to the application, but it doesn't automatically fix vulnerabilities inside the application.
You should still:
patch the OS and web server
patch the application where possible
remove obsolete protocols
restrict backend/database access
protect administrative URLs separately
log authentication and authorization events
monitor unusual access
perform vulnerability testing
use least-privilege service accounts
Think of the proxy as adding a modern security control plane around the legacy application, not magically modernizing the application itself.
Which approach fits best?
Environment
Strong candidate
Microsoft 365 / Entra ID / Active Directory
Microsoft Entra Application Proxy
Google Cloud / Google identity
Google Cloud IAP
Multi-cloud / independent security edge
Cloudflare Access + Tunnel
App requires Kerberos/IWA
Entra Application Proxy is particularly compelling
App accepts HTTP identity headers
Entra Application Proxy or Cloudflare Access
Need device/context-based policies
Entra Conditional Access, Google IAP, or Cloudflare Access
Want to eliminate VPN access to a handful of web apps
Any of the above
Microsoft explicitly positions Application Proxy as a way to provide remote access to legacy on-premises applications without requiring application changes or inbound firewall connections.
A practical migration pattern
For a legacy application such as:
https://old-finance-app.internal
I'd use:
Inventory the app — protocol, authentication, URLs, cookies, redirects, APIs, WebSockets, file uploads, etc.
Install two or more connectors/tunnel agents in the on-premises network.
Publish the app through the identity proxy.
Require modern IdP authentication + MFA.
Restrict access to the appropriate identity groups.
Add device/risk/location policies where appropriate.
Use HTTPS externally and, preferably, internally as well.
Test legacy authentication/session behavior carefully.
Monitor proxy and application logs.
Only after successful testing, remove direct/VPN access to the application.
For an Entra environment, Microsoft's current documentation provides a direct deployment path for installing the private network connector and publishing an on-premises application.
Bottom line: for most organizations, the cleanest pattern is identity-aware proxy + outbound connector + private legacy application, rather than exposing the legacy server through a traditional Internet-facing reverse proxy or giving users broad VPN access. It provides a much smaller attack surface while allowing you to introduce MFA, SSO, conditional access, and centralized authorization without rewriting the legacy application.
You can use a cloud identity proxy (such as Google Cloud Identity-Aware Proxy or Microsoft Entra Application Proxy ) to secure legacy on-premises web applications by intercepting inbound user traffic in the cloud, enforcing multi-factor authentication and Zero Trust access policies, and securely tunneling approved requests back to your private corporate network via a lightweight on-premises connector.
Cloud identity proxies replace traditional virtual private networks (VPNs) by shifting the security perimeter from a network-level boundary to an identity-aware boundary.
How the Architecture Works
User Request: A remote user attempts to access your legacy web app via a public URL provided by the cloud identity provider.
Authentication & Policy Check: The cloud proxy intercepts the request and prompts the user to log in via single sign-on (SSO) and multi-factor authentication (MFA). It evaluates context rules like device health, location, and group membership.
Secure Outbound Tunnel: A small connector agent installed inside your on-premises data center maintains an active, outbound-only connection to the cloud service.
Local Forwarding: Once authenticated, the cloud service tunnels the traffic through this secure outbound connection to the legacy application server behind your corporate firewall without requiring risky inbound firewall ports to be opened.
Steps to Implement a Cloud Identity Proxy
Choose Your Identity Provider: Select a cloud platform matching your ecosystem, such as Microsoft Entra ID Application Proxy or Google Cloud Identity-Aware Proxy (IAP) combined with on-premises connectors.
Install the On-Premises Connector: Deploy the lightweight connector software on a local server or virtual machine within your private corporate network that has internal network reachability to your legacy web app.
Publish the Application: Register your local internal URL (e.g., http://intranet.local ) and assign a public external domain within the cloud administration console.
Configure Authentication: Enable enterprise identity features like Microsoft Entra Conditional Access or Google IAM policies to dictate precisely which users or security groups can view or interact with the application.
Test and Validate: Direct users to the new public-facing URL to verify that authentication prompts trigger properly before any data packets route through the internal connector to the legacy app.
If you'd like to proceed, let me know:
Which cloud provider you use (e.g., Microsoft Azure/Entra ID or Google Cloud Platform)
Whether your legacy app uses HTTP/HTTPS or an alternative protocol
I can provide the specific configuration steps for your setup.
Securing legacy on-premises web applications using a cloud identity proxy (such as Microsoft Entra Private Access / Application Proxy or Google Cloud Identity-Aware Proxy (IAP) ) allows you to shield internal apps behind a cloud-native Zero Trust perimeter. Instead of exposing apps via a traditional VPN, users authenticate via your cloud IdP, and validated traffic is tunneled securely to your data center.
The end-to-end implementation process follows a structured sequence:
Establish Identity Synchronization
Synchronize your on-premises active directory or user directory with your cloud identity provider (e.g., Microsoft Entra ID, Google Cloud IAM) so user identities and groups are unified in the cloud.
Deploy the On-Premises Connector/Agent
Install the vendor's lightweight connector agent (e.g., Microsoft Entra Private Network Connector or Google App/On-Prem Connector) on a local server or VM inside your corporate network.
Ensure outbound-only firewall rules are open from your local network to the cloud service (outbound HTTPS/TLS ports are typically all that's required, avoiding risky inbound firewall holes).
Register the Legacy Application in the Cloud Admin Console
Map your internal URL (e.g., http://corp.local ) to an external public-facing URL (e.g., https://yourdomain.com ) in your cloud console.
Configure pre-authentication settings so the cloud identity proxy intercepts all traffic before it hits the application connector.
Configure Access Policies and Multi-Factor Authentication (MFA)
Define granular access control policies based on user identity, device health, and risk signals.
Enforce mandatory MFA and conditional access checks (like compliant device policies) at the cloud edge before any handshake is proxied to your on-premises network.
Test and Cut Over DNS
Run diagnostic sign-on tests through the cloud administration portal to verify the connector successfully translates and forwards authenticated traffic.
Update your public DNS records (CNAME) to point the external app URL to the cloud proxy endpoint, safely deprecating old VPN-dependent access paths.
To tailor this process, let me know:
Which Cloud Identity Provider are you primarily using (e.g., Microsoft Entra ID, Google Cloud, or Okta)?
Do your legacy apps rely on Integrated Windows Authentication (Kerberos/NTLM) or basic HTTP headers?
A cloud identity proxy lets you put a modern identity/security layer in front of a legacy on-premises web application without rewriting the application first. The basic pattern is:
For example, Microsoft Entra Application Proxy and Google Cloud Identity-Aware Proxy both support this general architecture for on-premises HTTP(S) applications.
Recommended process
Inventory and classify the applications
Identify URLs, servers, authentication method, dependencies, user groups, sensitivity, and whether the app requires Windows Integrated Authentication, headers, forms-based login, etc.
Separate applications that can be modernized directly from those that need a proxy as an interim solution.
Cloud identity proxies (such as Google Cloud Identity-Aware Proxy or Microsoft Entra Application Proxy ) act as an intelligent security perimeter. They intercept incoming web traffic, handle modern authentication in the cloud, and safely tunnel verified requests to legacy, on-premises applications that were never designed for modern identity protocols.
Core Functional Steps
Interception at the Edge
The cloud proxy exposes a public-facing URL and an external load balancer on behalf of the on-premises application.
When a user attempts to reach the application, the request hits the cloud-managed edge rather than directly penetrating the corporate firewall.
Cloud-Based Authentication & MFA
Instead of prompting the user for local credentials (like basic auth, NTLM, or an aging on-prem LDAP form), the proxy pauses the request and redirects the user to the cloud Identity Provider (IdP) (e.g., Microsoft Entra ID, Okta, or Google Cloud IAM).
The IdP handles robust checks, including Single Sign-On (SSO) and Multi-Factor Authentication (MFA), device compliance verification, and risk-based conditional access policies.
Secure Outbound Tunneling (The On-Prem Connector)
Once authentication succeeds, the cloud service passes the traffic through a lightweight connector or agent installed within the internal corporate network (behind the firewall).
This connector maintains an outbound-only encrypted connection (like a persistent WebSocket or TLS tunnel) to the cloud. Because the connection is initiated from the inside out, network administrators do not need to open fragile inbound ports like 443 or 80 on their corporate firewalls.
Token Translation and Header Injection
Legacy web apps often rely on basic session cookies, IP tracking, or simple HTTP headers (like passing a username or email in a clear-text header field) to recognize who is logged in.
The cloud proxy strips away modern tokens (like SAML assertions or OIDC JWTs) and can inject the validated user identity into predefined HTTP headers or variables expected by the legacy app.
Authorization and Access Enforcement
Before the connector relays the final HTTP request to the internal legacy server, the cloud control plane evaluates fine-grained access rules (e.g., "Does this user belong to the 'Finance' security group?").
If unauthorized, the request is dropped at the cloud edge before it ever touches legacy infrastructure.
If you are planning a specific implementation, let me know:
Which cloud provider or IdP you are targeting (e.g., Microsoft Entra, Okta, Google Cloud)
The underlying auth mechanism of the legacy app (Kerberos, NTLM, header-based, or anonymous)
I can provide more targeted architectural details for your setup.
Cloud identity proxies are essentially identity-aware reverse proxies placed in front of older web applications. They let you put modern authentication and authorization in front of an application that may only understand old mechanisms such as basic authentication, NTLM, Kerberos, or even no authentication at all.
For example, Microsoft Entra Application Proxy uses a cloud service plus an on-premises private-network connector. A user visits the application's published URL, is redirected to Microsoft Entra for authentication, and the connector then reaches the internal application.
Google Cloud's IAP provides a similar model: its on-premises connector receives authenticated/authorized requests and forwards them over hybrid connectivity to the internal application.
What happens when a user connects?
1. The user goes to a normal HTTPS URL
Instead of exposing something like:
https://old-app.company.com
directly to the Internet, DNS points the user toward the proxy's public endpoint.
2. The proxy authenticates the user
The proxy redirects the browser to the organization's identity provider. This is where modern controls can happen:
SSO
MFA
group membership
device compliance
conditional/context-aware access
risk-based policies
For example, Microsoft specifically describes using Entra Application Proxy to put MFA and Conditional Access in front of legacy applications. learn.microsoft.comdocs.cloud.google.com Google IAP similarly supports identity- and context-based authorization policies.
3. The proxy makes the authorization decision
Authentication answers "Who are you?"
Authorization answers "Are you allowed to use this particular application?"
The proxy can therefore enforce something such as:
Alice is authenticated, is in the Finance group, and is using a compliant device → allow access to the payroll application.
Someone who successfully authenticates but isn't authorized for that application never reaches the legacy server.
4. The proxy connects to the private application
This is an important security advantage. The legacy server generally doesn't need to be exposed directly to the Internet.
With Microsoft Entra Application Proxy, the on-prem connector establishes the required communication with the cloud service; Microsoft documents this as avoiding the need for inbound firewall connections.
So instead of:
Internet ──► Firewall ──► Legacy server
you get approximately:
Internet
│
▼
Cloud identity proxy
│
│ authenticated/authorized request
▼
Cloud ↔ private connector
│
▼
Legacy server
The clever part: adapting modern identity to legacy authentication
This is often the main reason to deploy one.
Suppose an old application only understands a legacy mechanism such as HTTP headers. You don't necessarily have to rewrite the application to understand modern OAuth/OIDC/SAML.
The proxy can act as the translation layer:
Modern world Legacy world
Microsoft Entra / IdP
│
│ OIDC/SAML/etc.
▼
Identity proxy
│
│ legacy-compatible
│ authentication/header
▼
Old web application
Microsoft documents this explicitly for header-based applications: the intermediary authenticates the user and propagates the required HTTP headers to the destination application.
That makes the proxy a kind of security adapter around the legacy application.
Why this is useful
It lets an organization modernize access control without immediately modernizing the application.
You can consequently get:
Without proxy
With identity proxy
Application-specific passwords
Centralized SSO
Often no MFA
MFA at identity layer
Internet-facing legacy server
Private application
App-specific authorization
Centralized identity/group policies
VPN often required
Browser-based application access
Legacy authentication
Modern IdP + translation
Microsoft explicitly positions Application Proxy as a transition path for legacy on-premises applications that aren't capable of modern authentication.
One important caveat
The proxy doesn't magically make the legacy application secure.
You still need to make sure users cannot bypass the proxy and reach the application directly. Google, for example, specifically warns that backends need to be protected from direct access when IAP is being used.
And you need to decide how the proxy's authenticated identity is conveyed to the application—signed assertions/headers, Kerberos/NTLM delegation, etc.—without allowing users to forge those identity signals.
In one sentence: a cloud identity proxy puts a modern, centrally managed identity and policy enforcement point in front of a legacy application, then securely carries authorized requests from the cloud edge into the private network while translating the identity into whatever the old application can understand.
If you're interested, I can also explain how this differs from a traditional VPN, reverse proxy, and zero-trust access proxy—that's where the architectural distinction becomes especially clear.
If your organization uses Microsoft Entra ID, Microsoft Entra Application Proxy is a natural option.
In Google Cloud environments, Identity-Aware Proxy (IAP) can front on-premises HTTP/HTTPS applications using its on-prem connector.
Deploy the on-premises connector
Install the vendor's connector inside your network where it can reach the legacy application.
Prefer redundant connectors/instances rather than creating a single point of failure. Microsoft specifically recommends capacity planning and connector redundancy.
A major security advantage is that the connector can establish outbound connections rather than requiring you to expose the application server directly to the Internet. Microsoft documents this outbound-only connector model.
Publish the application through the proxy
Configure:
External URL
Internal application URL
TLS/HTTPS
Identity provider
Authorized users/groups
Pre-authentication behavior
With Microsoft Entra Application Proxy, for example, Microsoft recommends Microsoft Entra ID preauthentication when you want the identity layer to authenticate users before the request reaches the legacy application.
Put modern authentication in front of the legacy authentication
This is particularly useful because the legacy application doesn't necessarily need to understand modern authentication itself.
Configure SSO to the legacy application
This depends on what the application understands:
Integrated Windows Authentication: commonly use Kerberos-based SSO/Kerberos Constrained Delegation.
Header-based authentication: the proxy can inject identity attributes expected by the application.
Forms/username-password authentication: some proxy products support password-based SSO.
Unsupported/custom authentication: you may need an integration product or ultimately modify/modernize the application.
Microsoft documents all of these patterns for Application Proxy, including Kerberos-based IWA and header-based SSO.
Enforce access policy at the identity layer
This is where much of the security improvement occurs. Typical policies include:
MFA/phishing-resistant authentication
Require managed/compliant devices
Restrict particular applications to specific groups
Location/network restrictions
Sign-in risk policies
Session/lifetime controls
Microsoft Entra Conditional Access, for example, can apply policies based on user, location, device, application, and risk.
Remove direct Internet exposure
Once the proxy path is working, the legacy server should generally not also be directly exposed to the Internet. The proxy becomes the controlled ingress point. Microsoft describes Application Proxy as an alternative to exposing incoming firewall ports for supported scenarios.
Pilot before broad rollout
Start with one low-risk application and a small group:
Test authentication and MFA.
Test every important application function, not just the login page.
Test file uploads/downloads, WebSockets, redirects, APIs, timeouts, and legacy browser behavior as applicable.
Verify logging and incident-response visibility.
Test connector failure/redundancy.
Roll out application-by-application
Once the pattern works, migrate the applications in waves. Keep an inventory of which applications are merely protected by the proxy versus which have actually been modernized.
Important architectural point
A proxy is primarily a security/access bridge, not a replacement for application modernization. It can give a vulnerable legacy application a modern authentication and authorization boundary, but vulnerabilities inside the application itself—SQL injection, insecure business logic, outdated libraries, etc.—still need to be addressed.
Also, don't blindly use "passthrough" authentication if your goal is to enforce cloud identity controls. For example, Microsoft notes that Conditional Access doesn't apply to Application Proxy applications using passthrough preauthentication because the user isn't authenticated by Microsoft Entra first.
The key principle is "authenticate and authorize at the edge, then privately proxy to the legacy application." Over time, you can replace the proxy-protected applications with applications that natively support modern identity protocols, reducing the legacy dependency.
