Azure AD App Proxy allows you to publish an internal website to the internet. It is easy to set up and does not require inbound firewall rules. Traditionally, you would publish a website with the help of a reverse proxy, for example with Citrix Netscaler/ADC, KEMP Loadbalancer or F5.

In the Azure AD Portal (aad.portal.azure.com) open Application Proxy and firstly install the software on a server in the corporate network. Domain join is not a requirement, but is needed if you use Kerberos authentication.

You will need to log in with your tenant admin (or a M365 user that has the appropriate role).

After the installation, you should see the server in Azure AD App Proxy:

To then publish your site, select + Configure an app

Provide the internal URL along with the protocol (HTTPS or HTTP). You could select Azure AD in Pre Authentication and work with conditional access policies and require MFA for example. This example is using Passthrough Authentication.

Also some basic settings can be changed. To publish the site, hit + Add

After a few minutes, your site should be available:

You can also configure custom domains by verifying your domain(s) in Microsoft 365 by uploading your public certificate with the private key (pfx) and configuring the appropriate DNS record. For detailed information, check out the Microsoft docs below.

References:

https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy

If you are syncing local AD users to Azure AD and using Seamless Sign-On (see https://www.ajni.it/2021/05/configuring-azure-ad-connect-for-user-synchronization/ and https://www.ajni.it/2021/05/configure-seamless-sign-on-for-microsoft-365-login-with-azure-ad-connect/), there is an awesome registry key that automatically creates the Outlook profiles without user interaction.

HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Outlook\AutoDiscover

DWORD ZeroConfigExchange 1

Alternatively, you can add the DWORD ZeroConfigExchangeOnce 1 key to automate the creation of the first profile. Successful profiles have to be created manually.

References:

https://docs.microsoft.com/en-us/outlook/troubleshoot/profiles-and-accounts/let-zeroconfigexchange-automatically-create-first-profile

The first step in the journey to the cloud is to install and configure Azure AD Connect. This will synchronize users in local Active Directory to Azure AD and will allow you to use cloud services like OneDrive For Business, Sharepoint Online, Exchange Online, or Microsoft Teams.

Before installing the service itself, we have to set an alternate UPN suffix as in Azure AD. In Active Directory Domains and Trusts add a new UPN suffix. The suffix should be equal to the custom domain name in Azure AD.

Users synchronizing to Azure AD should have that UPN suffix set:

In the Azure AD panel, select Azure AD Connect and then "Download Azure AD Connect"

Start the installer and select "Customize"

Hit install

Select Password Hash Synchronization and login with your Azure AD global admin

Select Create new AD Account and enter Enterprise Admin credentials. The tool will automatically set the correct permission on the OU without adding Domain Admin rights to the user.

You will notice that a new user named MSOL_xxx has been created.

This is just a warning. We already set the correct UPN suffix.

Deselect the top checkbox and select the OU containing AD Users. Service users should not be synchronized.

Leave everything else on default settings and then hit install.

With the synchronization service you can check what objects have been synced and the last time a sync ran.

In Azure AD the synced user should show up. You can see that the correct UPN has been configured on the user.

If you want to manually start AD Sync, in Windows PowerShell enter this command:

Start-ADSyncSyncCycle -PolicyType Delta

When using User/Device licensing in Citrix, licenses are occupied for up to 90 days, which is a long time if you have a limited amount of licenses. If you need to release them, here is how you can do it:

• Stop the service Citrix Licensing Service, Citrix License Config Service and Citrix Support Service
• Delete the following folder (or rename it, just to be sure): "C:\Program Files(x86)\Citrix\Licensing\LS\resource\cache"
• Start the service Citrix Licensing Service, Citrix License Config Service and Citrix Support Service
• Enjoy

References:

https://ulrikchristensen.com/how-to-release-unused-citrix-user-or-device-licenses/

On a Windows Server with RDS feature enabled, you might encounter an issue with Windows Update Coordinator being stuck at "Please wait while the application is preparing for the first use" during a program installation. This problem is very easy to resolve with Group Policy Editor (either locally through gpedit.msc or Domain Group Policy).

Navigate to Computer configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Application Compatibility and enable the setting "Turn off Windows Installer RDS Compatibility".

After installing the program, I would recommend re-enabling Windows Update Coordinator by disabling the GPO setting or leaving it at "Not configured".