We have determined that we can open up certain API endpoints to bypass the pre-authentication of the app proxy, by creating additional app proxies for each API endpoint, but this opens up the access to ALL connections. We need to be able to open up access to certain applications for API call reasons but provide a little more security around it by only whitelisting certain IPs.

The end goal would be to have a single application proxy in Azure for a particular on-prem application which does pre-authentication and MFA for all normal users. Then, provide a whitelist of IP addresses which would bypass the pre-authentication and MFA and be allowed direct access.

Thanks.