How to make my SharePoint 2013 intranet (Host named site collection) to be accessible from internet. I will implement 2FA with the help of any 3rd party and will take care of authentication. Can i just create an alternate access mapping keeping the same windows claims authentication and move forward.


You should set up a ReverseProxy with Preauthentication in front of your SharePoint Farm like WebApplicationProxy.

WAP provides a lot of useful stuff:

Implementing ADFS+WAP is not the easiest task, but it's absolutely worth it.

  • Hi, Thank you so much for your valuable suggestion on enhancing security to the application. It was really worth to understand these things. Can you also help me with a high level idea of how to enable my intranet to be accessed from outside the network (Same set of users as in intranet , same domain users). – Sreejith Apr 5 '17 at 2:37
  • This can also be achieved with WebApplicationProxy with Kerberos-Authentication. But you have to think about your existing AlternateAccessMappings. If they are "internal" (e.g. sharepoint.company.local), you have to get an public URL linke sharepoint.company.com. My recommendation: Get rid of your "local" URL and only use public Domain. Makes more migration-work, as users have to change all URLs. But it's worth the effort in the long term. – MHeld Apr 5 '17 at 6:50

At the WebApp level you will need to edit your authentication settings to enable Anonymous authentication.

Then, set the Anonymous Access Policy for the web app to define what anonymous permissions are available.

Finally, in the site collection itself, grant the required permissions to the anonymous user (it's in the ribbon when on the permissions page).

  • I don't require anonymous access. Users would be given login page and they will be authenticated using 2FA. What should i do in this case. (I know about extending the web application to internet zone , but then it will be 2 set of user tokens for the same user, & 2 set of permissions . That will not work) – Sreejith Apr 4 '17 at 6:11
  • Then you should edit your question to remove the "made public" and "public facing" wording. What you're describing is either an Extranet or still an Intranet, just accessible from the outside but not "publicly" accessible. – Greg W Apr 4 '17 at 6:13
  • Sorry Greg for the confusion. It's like my intranet users have to access the site from outside the network. Yes you are right. How can i do it. Can i use windows claims for authentication as well. – Sreejith Apr 5 '17 at 2:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.