Security Question regarding AzureAD Applicatin Proxy for Internal NDES Services

ChrisK 21 Reputation points
2020-10-27T06:14:07.967+00:00

Dear All,
Hopefully I post this in the correct forum.

I want to deploy certificates to our mobile devices managed by Intune / Endpoint Protection.

For this I used these guides to

Everything works so far, but I'm having little security concerns.
Publishing NDES Services requires to set Pre-Authentication to "Passthrough".
Means everyone with the Application Proxy URL can get access to the NDES Webserver.
Since Microsoft descripes this setup in an official document, it should be secure. But I would like to unterstand it :)

Could it happen that someone only with the URL can enroll a certificate?
How does Azure avoid this?

Thanks a lot for your feedback and discussion.

Chris

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,420 questions
0 comments
Accepted answer
  1. VipulSparsh-MSFT 16,271 Reputation points Microsoft Employee
    2020-10-27T08:02:42.517+00:00

    @ChrisK Thanks for reaching out.

    To get a certificate via NDES, NDEs verify the request using a challenge response method. The Intune Connector helps to get the challenge and deliver that challenge to the mobile devices using Intune service. (In Intune you will actually deploy a SCEP profile to devices)

    So when the devices reach out to the NDES via this URL, they already have a challenge which is known to NDES Service and gets verified during the process.
    Any other random device/service wont be able to get that challenge and hence cannot proceed further even if they have the URL.

    If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community.

    1 person found this answer helpful.
    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. ChrisK 21 Reputation points
    2020-10-30T08:16:42.133+00:00

    @VipulSparsh-MSFT

    Thank you very much for your reply.
    Guess I understood it now :)

    Regards,
    Chris

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.