A company wants to publish a supported on-premises web application using Entra preauthentication without opening an inbound internet path to the application server. Which capability fits?

1. Storage geo-replication
2. Microsoft Entra Application Proxy with the appropriate connector setup
3. A public DNS record alone
4. A shared administrator password emailed to users