Are Attackers "Passing Through" Your Azure App Proxy?

TL;DR: A demo shows that Azure Application Proxy configured with Pre Authentication set to “Passthrough” can unintentionally expose internal web resources by forwarding unauthenticated traffic to an on-premises server. The report documents forced browsing to discover paths, access to a customer portal and a Basic Auth prompt, and successful authentication using default/weak credentials, highlighting that Passthrough effectively behaves like opening a firewall port and can expose legacy apps and sensitive endpoints.