How to publish on-premises Office Online Server using Azure AD Application Proxy

David Sass 7 Reputation points
2021-08-18T07:35:57.19+00:00

How to publish on-premises Office Online Server using Azure AD Application Proxy?

I've a Lab set up, where I have SharePoint Server 2019 integrated with Azure AD following this tutorial:
https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/sharepoint-on-premises-tutorial

And I used Azure AD Application Proxy to publish SharePoint to the internet following this guide:
https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-integrate-with-sharepoint-server-saml

I also have Office Online Server deployed, which works just fine when I'm accessing SharePoint Server from inside this Lab environment. (However, I have no clue why would OOS work, when I didn't do anything to make it support SharePoint which was federated with AzureAD, odd)

But clearly, publishing OOS to the internet using Azure AD Application Proxy isn't as easy, and I didn't find any documentation on this subject either.

Is this even possible?

Microsoft Entra

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Susan Barnes 21 Reputation points
    2022-11-09T18:07:27.22+00:00

    If anyone is still searching for a solution, we get this to work by setting up a 2nd AAD proxy for the OOS farm. So we have an AAD proxy for SharePoint 2019 and one for OOS.

    We did not extend the SP application, but rather pointed the AAD proxy to the same URL as the web app that is behind the firewall. In this way, users will go to the same URL whether or not they are logged into the VPN. We point the SP to the OOS external URL. So, the commands would look something like this for document rendering:

    OOS proxy (OOS server)

    $Internal=<AAD proxy url>
    $External=<URL to which SP is pointed>
    $cert=<Friendly name of current cert>
    New-OfficeWebAppsFarm -InternalUrl $Internal -ExternalUrl $External -CertificateName $cert -EditingEnabled

    SharePoint WOPI (SP app server)

    New-SPWOPIBinding -ServerName $External

    This works great for Windows users. However, we have had a ticket open with Microsoft for months now for Mac users. They get thrown into an infinite loop of authentication with JAMF, InTune & Conditional Access. So, if you only have Windows users, this should work for you.