Single-tenant workforce sign-in with Microsoft Entra ID. Azure App Service built-in authentication (Easy Auth), HTTPS, and server-directed login.
Inbound mode: Azure Firewall DNAT → Application Gateway/WAF → private endpoint → Web App. The Web App public endpoint is disabled. Requests, callbacks and responses use this ingress route.
Outbound mode: VNet integration + outbound application routing + UDR → the same Azure Firewall. Browser navigation to Entra itself remains outside the Azure application network.
App Proxy mode (alternative ingress): Microsoft Entra application proxy publishes the external URL and pre-authenticates users with Entra. A private network connector in vnet-web relays requests to the App Service private endpoint. Easy Auth still runs, completing its sign-in by single sign-on and using the external URL as its redirect URI. Front Door and inbound DNAT are turned off in this mode.
Data tier (optional): after sign-in, the app reads a Key Vault secret and queries Azure SQL Database. Both services disable public network access and are reached from VNet integration through private endpoints in snet-data-endpoints, resolved by privatelink.vaultcore.azure.net and privatelink.database.windows.net. Managed identity mode uses an Entra token for SQL (no password) and Key Vault for an app secret. SQL password mode stores the SQL login password in Key Vault and resolves it with a Key Vault reference. Key Vault AuditEvent and SQLSecurityAuditEvents go to azure-resource-logs; managed identity sign-ins go to the Entra sign-in stream.
Resource groups are organisational scopes, not network isolation boundaries. This demo creates no Azure resources and accepts no credentials.