Allow user from external Azure AD to connect to on-premise resource using the their external Azure AD account

Nicholas Palmer 81 Reputation points


I'm trying to figure out if something is possible. Here is my current setup. I have my on-premise AD successfully connected to my Azure AD using Azure AD connect. I've successfully published on premise resources like a web server that requires a login to Azure and I'm able to access this web server from the MyApps page and using the application proxy and the SSO option for Enterprise applications I'm able to access this resource without having to provide credentials. This all works great.

So now I'd like to allow external users to be able to access this same resource and not have to provide credentials. I've invited a guest user to my Azure AD and given that user the required Azure permission to access the published web server in their MyApps page. When they connect the MyApps page they can see the app and launch it. But when the SSO process starts, it doesn't work for them because the user account that they are using is not present in my on-premise AD so they can't login.

Is there any way to make this work? I've thought about creating a new UPN suffixes in my on-premise AD and creating the accounts for the external users. But I'm not sure how Azure AD connect would handle that during the sync, and having to manage creating new UPN suffixes would be a headache.

Any ideas?


Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,150 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
17,536 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Limitless Technology 43,231 Reputation points

    Hello there,

    If your on-premises app uses SAML-based authentication, you can easily make these apps available to your Azure AD B2B collaboration users through the Azure portal using Azure AD Application Proxy.

    Grant B2B users in Azure AD access to your on-premises applications

    This article compares options for integrating your on-premises Active Directory (AD) environment with an Azure network.

    Hope this resolves your Query !!

    --If the reply is helpful, please Upvote and Accept it as an answer--

    0 comments No comments

  2. Nicholas Palmer 81 Reputation points


    Thanks for the response. It was helpful. The link had a possible option - "Create B2B guest user objects through an Azure AD B2B script" that I tested out, but it didn't quite work.

    The on-premise app that I am trying to publish is an RDWeb server. As I said, I've got SSO working for users that are in my on premise AD/Azure AD, but when I try and login with a guest Azure AD user the SSO fails. I've setup SSO for the RDWeb server using this technique

    I believe the reason the external SSO fails is because the external user has a Azure login ID of This translates to the following ID in our Azure AD of Based on the powershell script in the above link, I tried creating an on premise AD user with the account ID of I'm able to create the account, but when I try and access the MyApps site with the external user account, the SSO process still fails.

    The problem is that when I go to access the RDWeb server published thru MyApps and connect with the account that is ok. Then when I launch the app for the RDWeb server I'm taken to the RDWeb login page and instead of trying to login with the account, the login account is using the account and so the SSO process fails.

    One way that I can think to make this work is to create the user in my on-premise AD. But I'm not sure I can create an on-premise user account with the UPN. Do you know if this is possible?


    0 comments No comments