You must publish an on-premises HR web application that uses Integrated Windows Authentication to the internet. Users should authenticate with Microsoft Entra ID and get single sign-on to the app using their Kerberos identity. The organization has two datacenters and wants to minimize latency by using connectors closest to the app servers. What should you do? (Select three)

To publish an on-premises application with Microsoft Entra ID preauthentication and Kerberos-based single sign-on, specific configurations are needed. Installing at least one Application Proxy connector in each datacenter, creating separate connector groups, and assigning the HR app to the closest connector group ensures high availability and minimizes latency by directing traffic to the nearest connector. Setting Preauthentication to Azure Active Directory (now Microsoft Entra ID) enables users to authenticate with their Microsoft Entra credentials. Configuring Kerberos constrained delegation (KCD) on the connector server's computer account to the HTTP Service Principal Name (SPN) of the backend HR app allows the connector to obtain a Kerberos ticket on behalf of the user for seamless single sign-on to the on-premises application. "Configure the app for Passthrough preauthentication" is incorrect because it bypasses Microsoft Entra ID authentication, which is a requirement. "Enable forms-based SSO" is incorrect because the application uses Integrated Windows Authentication (Kerberos), not forms-based authentication.