Well I just wrote a multi-page post here referencing my entire architecture, troubleshooting attempts made, guides read and then got an internal server error when I tried to post it so I'm not going to go through that again, I'll just simplify my question-
Has anyone gotten Azure AD Proxy in pre-authentication mode to work with RDS 2019 in an environment where you alter the published name to prevent certificate warnings due to split domains?
I have everything setup exactly as is described here-
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-proxy-integrate-with-remote-desktop-services
Internal address points to an internal DNS record that points to my connection broker/rd gateway server.
This all works fine for the RD Web Access Portal, I can login to the external address, get prompted by azure for login, get to the internal portal without errors, login there and can see my session host collection. When I click that collection though I get"logon attempt failed"
This is using Internet Explorer, with the MsRdpClientShell Class addin enabled.
The gateway works perfectly inside of my network, using the DNS address or the server FQDN (though this way will give cert warnings).
I've tried disabling HTTP redirection on the IIS server on the connection broker. I've set the RAP to allow connections to all resources and when that did not work I specifically added the DNS name to the resource list.
Mostly I just need to know if this is even possible or if Azure AD proxy will not work with the RD Gateway using a changed published address like this.
Thanks!
---
Edit- Also I cannot find any failed connections in the logs, so it doesn't appear as if the connection attempt is actually hitting the broker or gateway