You must publish a legacy IIS application that uses Windows Integrated Authentication to internet users via Azure AD Application Proxy. The app is hosted in two different on-premises sites. Requirements: use Azure AD pre-authentication with Conditional Access MFA, route each published app to connectors in its local site, and provide SSO to the backend via Kerberos Constrained Delegation (KCD). Which configuration should you choose?

This option correctly addresses all requirements. Creating two connector groups, one for each site, ensures that each published app routes to connectors in its local site, optimizing performance and resilience. Publishing the app per site and mapping it to the corresponding connector group allows for site-specific routing. Setting pre-authentication to Azure Active Directory enables Azure AD pre-authentication and Conditional Access MFA. Configuring SSO using KCD with the backend app SPN on the connector server's computer account provides seamless Kerberos authentication to the legacy IIS application. The other options fail to meet key requirements: Using a single connector group would not route apps to local connectors. Passthrough pre-authentication does not provide Azure AD pre-authentication or MFA. Passthrough pre-authentication and header-based SSO do not meet the Azure AD pre-authentication, MFA, or KCD requirements. Password-based SSO is not suitable for Windows Integrated Authentication and does not meet the KCD requirement. SAML-based SSO is not typically used for legacy IIS applications requiring Windows Integrated Authentication and KCD.