Do Azure Application Proxy Users require an Entra ID P1/P2 license in Passthrough-Mode?

Yep - AFAIK, from a strict legal compliance standpoint, the per-user licensing requirement still applies to every user accessing the application. However, from a practical and technical standpoint, enforcement and auditing behave differently depending on how those users are defined in relation to your organization.

Microsoft’s licensing terms state that a license is required for any user who intends to benefit from the service. Because Entra Application Proxy is classified as a Premium P1/P2 feature, any traffic routed through that infrastructure requires the backend user to be covered under a P1 or P2 license. The fact that Entra ID does not actively perform authentication in Passthrough mode does not waive the licensing requirement for using the proxy architecture.

For internal users, if the users are employees or corporate contractors accessing an internal application remotely, each user should be covered by an Entra ID P1 or P2 license, either directly or through a suite such as Microsoft 365 E3 or E5.

For external users, such as customers or partners, the applicable model is External Identities Monthly Active Users. Under this model, the first 50,000 unique external users per month are free, and they can use the applicable Entra capabilities of the tenant. Note that Passthrough mode creates a technical distinction because the users authenticate directly to the backend application rather than through Entra ID. Consequently, those users do not generate Entra sign-in activity that can be used for MAU tracking.

Microsoft's technical enforcement of Application Proxy is primarily tenant-level. At least one user in the tenant must have an Entra ID P1 or P2 license to enable the Application Proxy service and configure the Private Network Connectors. Once the service is enabled, the proxy can route traffic for users regardless of whether those individual users are being authenticated by Entra ID. In Passthrough mode, there is no Entra identity token associated with the incoming request that could be used to dynamically evaluate the user's license.

Effectively, licensing compliance is separate from the technical ability to use the service. Microsoft can address licensing compliance through contractual licensing reviews or audits rather than relying solely on a technical block. In an audit, Microsoft could examine the Application Proxy configuration and then review the application's own access records, such as IIS, Apache, or application database logs. Those records could establish which users or accounts are actually accessing the application through Application Proxy.

Switching from Passthrough to Entra ID Pre-Authentication changes the authentication and identity flow, but it does not by itself eliminate every licensing consideration. External users can authenticate through Entra External ID and their activity can be associated with Entra's external-user model, including MAU measurement where applicable. It also provides Entra-based authentication and an Entra audit trail before the request reaches the published application.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin