The two big questions I have about using Azure AD Application Proxy is as follows:

  1. Can the Active Directory in Azure be used for outside emails aka (@gmail, @yahoo, ect. ect.)

  2. Will the people picker be populated with using Azure AD Application Proxy? This is a show stopper.

Stay tuned because if this is not answered we are having a POC to try to accomplish this. Yes we know we will have to pay for the per user with Azure AD Premium.

2 Answers 2


Azure AD Application Proxy is part of the Azure AD Premium P1 license (see Pricing).

To your questions: Unfortunately you didn't specify what you want to achieve.. Do do want externals to access OnPremises SharePoint or should it be avoided? i'll try to answer, but you might include more details to your question.

Question 1:

  • The simpliest way to publish OnPremises SharePoint via Azure AD Application Proxy is via Kerberos Constrained Delegation. Those implementations will not make you able to invite people by their E-Mail address. SharePoint PeoplePicker only resolves people from your local ActiveDirectory. You can control access to the application in AAD-Proxy - this is done via Azure AD Accounts. So set up your Azure AD Connect properly.
  • As mentioned by Trevor, you can configure SharePoint as SAML application instead of Kerberos for Single-Sign-On. This will enable you to invite Azure AD users. But be aware that enabling SAML will also bring you a bunch of drawbacks you have to consider when building your solution (link is for FBA, applies also for SAML as all of them work as trusted identity providers).

Question 2:

  • PeoplePicker will act via Azure AD Application Proxy like it behaves OnPremises if you configure AAD-Proxy via Kerberos.
  • If you want to grant access to external users via Kerberos, you must create a User in OnPremises ActiveDirectory and it is synced via AAD-Connect to your AzureAD.
  • Advantage: You have a full-featured user without any drawbacks from a trusted identity provider.
  • Disadvantages: (1) PeoplePicker will resolve all users from AD which might show the external users unwanted details. Can be limited via PeoplePicker-Property, but this is not very practicable. (2) External users can enter your office and login to any Computer with their DomainAccount. This can effectively be limited with the "Log On To..." setting in AD (fills userWorkstations AD-attribute).
  • MHeld in this solution the internal aka corporate folks are all required to login via using a VPN so that is covered with on-premise AD. This is for outside individuals doing work with our company that we need to grant access for them in a separate CLOUD AD, but the people picker has to be used because we have to keep them separate from our infrastructure AD.
    – Moojjoo
    Apr 9, 2018 at 20:27
  • You could implement a SAML-Solution and improve it with ldapcp.com. This will make PeoplePicker work, but all other SAML-Drawbacks still apply. If you do not want these drawbacks, you need an AD-Account and SharePoint PeoplePicker needs to reach this AD. Best solution here: Create a separate "External"-AD. Create a Two-Way-Trust between "Internal" and "External" AD. Limit the Externals access to SharePoint by configuring a Selective Trust with Allowed to Authenticate (microsoftpressstore.com/articles/…).
    – MHeld
    Apr 10, 2018 at 5:40
  • We already have a solution that utilizes okta another third party that does this and a custom application that handles all the 3rd party contractor requests. This is the correct solution.
    – Moojjoo
    Apr 10, 2018 at 17:09

The Azure AD App Proxy is simply a vehicle to let you access a resource behind a corporate firewall -- it is a "reverse proxy as a service" so to speak. It has no impact on the People Picker nor the ability to invite people from external resources.

You may be thinking of Using Azure AD for SharePoint Server Authentication. In this case, it is similar to any other SAML provider -- the People Picker will allow you to input any value as there is nothing to "resolve" against.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.