Azure Application Proxy - Best Solution to Publish Internal Web-Based Application

Azure AD Application Proxy is a new feature of Azure AD Premium and Azure AD Basic. It allows publication of internal web-based application to provide Internet access to authorized users in the corporate domain

[CB-ntfj]

So how do you address http header injection for apps? Since App Proxy doesn't secure them and allows any client to inject say a Group header that gets ADDED (not rewritten) my header apps can't trust them...if they do then possible impersonation or elevation of privilege.

[benaissaelbestani]

Does it work with service principals? Like accessing the Application from postman or something like using client credentials and pass the account to the proxy to use kerberos? All examples that i see are with interactions

[sharatthkumar]

After configuration, can a user just launch the url and get access without entering the credentials??