Entra Application Proxy vs SSOGEN: What Each Product Documents

Entra application proxy vs SSOGEN comes down to where the proxy runs and who the identity provider is: Microsoft runs the proxy service in the cloud with Entra ID, while SSOGEN gives you a gateway you run, with SSOGEN as the identity provider. The table below sets out what each publishes.

Request a Quote

Entra application proxy vs SSOGEN is a choice of who runs the proxy tier. Microsoft Entra application proxy and the SSOGEN Gateway both let remote users reach internal web apps without opening your network to everyone.

With SSOGEN, you run the gateway and SSOGEN is a complete identity provider. The same gateway publishes web apps, opens remote servers in the browser and reaches your directory.

The table sets each capability side by side, row by row, with the Microsoft source and the date we read it. This page does not rank the products and says nothing about pricing or quality.

To plan a move or a second path, the Entra application proxy alternative page walks through it step by step.

Capability table

Last compared 2026-10-09. Vendors change their products; check the sources for the current state. “Not described on the pages read” means only that. It does not mean the capability is missing.

Capability	Entra application proxy (Microsoft documentation, read 2026-10-09)	SSOGEN (own documentation)
Where the proxy runs	A cloud application proxy service plus a private network connector, a lightweight agent on a Windows Server inside your network (overview).	You run the gateway. The Gateway runs on Linux (Enterprise Linux and Debian-family packages), as a container image, or on Kubernetes.
No inbound firewall rule	Connectors make outbound connections over ports 80 and 443 and need no inbound firewall ports (overview).	The Outbound Connector dials out to an SSOGEN-operated relay and keeps the connection open, so the app needs no public hostname and the firewall no inbound rule (Outbound Connector routes). The App Proxy needs a listener your users or load balancer can reach.
Identity provider	Entra ID (overview).	A complete identity provider with local users, LDAP, SAML and OpenID Connect sources.
Pre-authentication	For apps configured with preauthentication, traffic without a valid token does not reach the back end (overview).	Selecting an application’s tile starts a sign-in under its policy. The App Proxy forwards only signed-in, allowed requests and refuses them if it cannot get a decision.
Policy and MFA	Microsoft says on-premises applications can use Conditional Access and multifactor authentication, and that Conditional Access gives policy controls before connections to the network are established (overview).	Per-application sign-in policy. A hostname can follow its own policy, and policy rules can use network zones.
Windows-authenticated apps	Integrated Windows Authentication through Kerberos constrained delegation (overview).	Kerberos constrained delegation with protocol transition, so each person appears as their own Windows account. Back-end Kerberos runs on the Enterprise Linux RPM and on the container image that includes the Kerberos helper (guide).
Form-based sign-in	Form-based apps are supported (overview).	Form login using each person’s own saved password or a shared account.
Apps that read identity from headers	Uses PingAccess, a non-Microsoft partner service (overview).	The gateway sends seven fixed identity headers itself, carrying the user name, email, groups and four other values, with no partner service.
Password-based and SAML sign-in to the app	Supported “with non-Microsoft partners in specific configuration scenarios” (overview). Microsoft’s SAML single sign-on is Entra ID authenticating to the app.	Form login with saved passwords is in the row above. An application that speaks SAML 2.0 or OpenID Connect connects to SSOGEN directly as the identity provider, with no proxy in the path.
Remote Desktop Services, APIs, native clients	Remote Desktop Services, web APIs and native client apps built with the Microsoft Authentication Library (overview).	Remote Access opens SSH, RDP and VNC in the browser for the servers you list, with approvals, file transfer rules and session limits. The Gateway also carries MCP tool calls from AI agents and checks each call against the scopes the agent holds.
Hostnames	Users reach an app through an external URL or an internal application portal (overview).	Own certificate per exact hostname. Each route hostname is exact; a wildcard belongs on the certificate.
High availability	Microsoft’s connectors page says to use at least two connectors in each group for high availability (private network connectors page).	A connector group is the set of gateway instances serving the same private routes, so one failing does not stop the app. The console shows each gateway’s health and certificate expiry.
Intended users	Microsoft says it replaces VPNs or reverse proxies for remote users and is not designed for internal users on the corporate network (overview).	Each listener is internal or external, so one gateway serves employees on the corporate network and remote users.

Where each runs

Microsoft runs the service. Microsoft documents the proxy as a service it runs. The connector is the only piece inside your network.
With SSOGEN, every gateway is yours, except the relay the Outbound Connector uses. You control updates, certificates and capacity.
Placement. The gateway sits wherever you put it, and it reaches a directory or a remote server as well as web apps.
The choice. The choice is who runs the proxy tier: Microsoft, or your own team.

Reaching an app with no inbound rule

Both products document an outbound-only path.

Microsoft. The connector calls out to the cloud service.

SSOGEN Outbound Connector. A Gateway feature that calls out to a relay SSOGEN operates. SSOGEN gives you the relay address and its key file.

SSOGEN App Proxy. The other mode. It listens inside your network, so users or a load balancer must be able to reach it.

When to choose the App Proxy. Choose it when inbound traffic is acceptable and you want the shortest path to the app.

Signing in to the app itself

Windows-authenticated apps. Both use Kerberos constrained delegation.
Headers. Microsoft’s page names PingAccess as the route. The SSOGEN gateway sets its own fixed headers, with no partner service in the path.
Before you cut over. If your app reads one user-name header, confirm that the names and values match what it expects.

Where Entra application proxy fits

Entra ID is already your identity provider and your Conditional Access policies exist.
Your apps are browser-based and Windows-authenticated, and you want Microsoft to run the proxy tier.
You publish through Remote Desktop Services.
You expose APIs or native client apps built with the Microsoft Authentication Library.
The connector host has to be Windows Server.

When SSOGEN fits

You want identity that does not depend on one cloud provider. Apps move over one at a time on new hostnames.
You want one gateway for web apps, remote servers, a directory connection and AI agent tool calls.
Your apps are Oracle systems or older web apps that suit an agent or header approach. See Oracle EBS SSO.
You want identity headers without a partner service.

SSOGEN has run in production since 2016, and Microsoft lists it in the Microsoft Entra gallery. For the proxy feature itself, see identity-aware proxy. For a wider comparison, read single sign-on software.

Questions people ask

Does SSOGEN need inbound ports?

Not for the Outbound Connector. The App Proxy needs a reachable listener.

How does a move from Entra application proxy work?

One app at a time: each app is published through SSOGEN on a new hostname.

Which costs less?

This page makes no pricing claims.

About this comparison. SSOGEN Corporation prepared this page from Microsoft’s public documentation and web pages, last read on 2026-10-09.

We took care to be accurate, but products, plans and prices change, and we may have misread or missed something, so some statements may be wrong or out of date.

This page is for general information only and comes without any warranty.

SSOGEN is not responsible for errors, omissions or decisions made from it. Check the vendor’s own pages and test the products yourself before you decide.

If you see a mistake, tell us and we will correct it.

Microsoft, Microsoft Entra, Entra ID, Entra application proxy, Conditional Access, Microsoft Authentication Library, Windows Server, Remote Desktop Services, Kerberos, PingAccess, Apache, Oracle and Oracle HTTP Server are trademarks of their respective owners.

SSOGEN is an Oracle partner, but Oracle has not reviewed or endorsed this page. Except for Oracle, the owners named are not affiliated with, endorsed by or sponsored by SSOGEN.

Sources, all read 2026-10-09: What is application proxy, Global Secure Access connectors.