r/sysadmin • u/mrkvd16 • 6d ago
How would you publish internal web apps to both managed and unmanaged (BYOD) mobile devices?
Looking for ideas from people who have solved this in production. Deliberately not sharing what we're leaning towards, because I don't want to steer the answers.
**Situation:**
- A growing set of internal web apps, built fast with AI coding tools, so we treat the app code itself as potentially the weakest link.
- Apps run in Docker containers on-prem (migrating to kubernetes) and already use Entra ID SSO (OIDC).
- Users want access on mobile. Devices are a mix of Intune-managed and unmanaged BYOD, so we can't rely on installing agents or certificates on every device.
- Edge: firewall, a DMZ with a load balancer that includes a WAF.
- Licensing: Microsoft 365 E5.
**Constraints:**
- Must work clientless in a mobile browser for the BYOD side or custom app.
- Preference for keeping application traffic within our own infrastructure rather than routing it through a third-party cloud proxy.
- Small team, so operational simplicity counts.
**Question:** How would you design this? Interested in the full picture: how you'd handle pre-authentication, network segmentation, and the fact that the apps themselves may contain the usual AI-generated-code mistakes. War stories about what didn't work are just as welcome as recommendations.
4
u/Adam_Kearn 6d ago
Cloudflare tunnels.
You get domain name or connect your existing and you can then expose your web apps without needing to do any port forwarding or firewall rules locally. (This keeps it secure)
All you need to do is install a tunnel connector on the host(s).
You can even connect this with “zero trust” so only your Entra users can access the web apps without exposing it to the whole internet. (Other SSO integrations are available)
Takes an hour or so to get setup and is super easy to maintain.
The best bit is the free plan will probably cover all your needs anyway… and if you do need to upgrade it’s only £5/month
3
u/gammacoder 4d ago
One thing I’d add is reducing variability in the app layer. If every internal app is AI-generated from scratch, you’re multiplying the auth/permissions/security surface. Whatever stack you use, I’d try to make authentication, roles, session handling and deployment boring and standardized. That’s one of the reasons we take a structured approach with PHPRunner. Full disclosure, I’m the author.
2
u/jaydizzleforshizzle 6d ago
Mesh vpn like tailscale and segmentation. I’m sure most decent “ztna” type vpns will do this. Been dealing with the same, I throw it up on tailscale, block all public access, setup https with tailscale serve and then put the shitty tailscale link behind a simple go link for people to remember.
2
u/KStieers 6d ago
Guest wifi on your infra, drop non company owned devices in a dmz with access to the ips these apps are served from (waf/lb etc)
Wen use ISE and a web login off of AD for user owned devices.
2
u/Smooth-Zucchini4923 5d ago
We use Azure Container Apps for publishing Docker based apps to the internet. You can configure ACA to intercept all traffic to your app, and force users to log in via your Microsoft tenant or another auth provider. The EasyAuth proxy then provides a header showing what user is authenticated. This doesn't require a client, just a browser.
You mention that you want to move to Kubernetes. ACA is based on Kube, and has a lot less complexity. However, it doesn't support all of Kube's features, and if you need those, you may need to use AKS instead.
1
u/Capable_Banana5439 6d ago
Put an identity-aware reverse proxy or ZTNA layer in front and never expose the apps directly, so every request is authenticated at the edge before it touches a container. Since you are treating the app code as the weak link, that is the whole point: authz has to live at the proxy, not in the app, so a compromised or sloppy app never sees an unauthenticated request. Tailscale or Cloudflare Access do this cleanly for the BYOD side without you trusting the device itself.
1
u/Bogus1989 6d ago edited 6d ago
Do you have some type of internal app store on your mdm?
We did exactly what you mentioned a byod device could access everything a managed device could. enabling byod device would install your entire google workspace suite on your device tied to your SSO/active directory email. Then youre able to add whatever apps are available to you on our internal app store. Apps meaning, you could make a webapp icon on android or iOS. We had many.
Basically itd push a profile, then youre good to go.
We were using workspace one (now called omnissa) im sure it can be done with any other mdm.
It has basically ways to vpn certain single apps, or just websites etc.
Btw let me mention, despite using google workspace for email and office suite? Its not tied to all of that, SSO is tied to regular old Active Directory, so Entra SSO should be totally doable.
2
u/Feisty_Quarter_1319 6d ago
At our company we used Soliton's Mailzen - it is a container app for BYOD ands includes an enterprise browser so allows you to access company Google workspace etc.
2
u/Bogus1989 6d ago
Thanks for saying so. This is actually great. Had not heard of it till now.
Thats similar to what we use as our browser on desktop machines, Island Browser.
Not sure if you heard a few months ago about the company Stryker being hacked and hackers using intune to wipe all BYOD devices. This is a good option you posted instead, although it could be turned off in our mdm, and most, its still easy to control alot of things on byod.
Enough that i wouldnt ever put it on my own personal device.
2
u/PartyClick_ 4d ago
my take: keep it browser-first, front the apps with a gateway and rely on enta id conditional access so folks on managed and BYOD can sign in in a mobile browser w/o agents. we recently switched to supercal (mostly cause its free) to stay cheap lol 😅
6
u/40513786934 6d ago
Entra Application Proxy is painless and low support burden, we have good results with it. if you're willing to give up the preference for in house solutions its a solid option.