Microsoft Entra Application Proxy

This section documents how to publish a Peek deployment through Microsoft Entra Application Proxy so that the Peek field app (iOS and browser) authenticates via Entra ID before reaching the internal Twisted backend.

Architecture:

iOS App / Browser
    |  HTTPS / WSS (Authorization: Bearer <token>)
    v
Microsoft Entra Application Proxy  (Azure cloud)
    -> validates bearer token with Entra ID
    -> injects X-MS-CLIENT-PRINCIPAL header
    |
    v
AADApplicationProxyConnector  (Windows VM in DMZ)
    |  internal HTTPS / WSS
    v
Peek Linux server (Angular PWA + Twisted backend)

Contents:

• Azure Proxy — App Setup
  • Prerequisites
  • Option A — PowerShell (Microsoft Graph)
  • Option B — Entra Admin Portal (UI)
  • Verification
  • Troubleshooting
  • Reference Configurations
• Azure Proxy — Connector VM
  • VM Requirements
  • Install the Connector
  • Register the Connector
  • Internal URL Hostname Workaround
  • Health Checks
• Peek Field App — OAuth2 Settings
  • Defaults Asset
  • MDM Overrides (iOS)
  • iOS Bundle ID and URL Scheme
  • Angular Build Configuration
  • Browser / PWA Build
  • Xcode Cloud Build
  • Troubleshooting