---
title: Configuring applications for dual access with PingAccess for Azure AD
description: Configure applications for secure access both from inside and outside the network.
component: pingaccess
version: 9.0
page_id: pingaccess:token_providers:pa_apps_for_dual_access_with_azure_ad
canonical_url: https://docs.pingidentity.com/pingaccess/9.0/token_providers/pa_apps_for_dual_access_with_azure_ad.html
revdate: May 6, 2024
section_ids:
  steps: Steps
  example: Example:
  example-2: Example:
  example-3: Example:
---

# Configuring applications for dual access with PingAccess for Azure AD

Configure applications for secure access both from inside and outside the network.

## Steps

1. Configure an application for secure external access using [Microsoft Entra ID (formerly Microsoft Azure AD)](https://docs.microsoft.com/en-us/azure/active-directory/application-proxy-ping-access) and [PingAccess for Azure AD](pa_get_started_with_pa_for_azure_ad.html).

2. Ensure that the application is functioning as expected by signing on using the application's external Uniform Resource Locator (URL) *(tooltip: \<div class="paragraph">
   \<p>Identifies a resource according to its internet location.\</p>
   \</div>)*.

   ### Example:

   For example, http\://app-tenant.msappproxy.net/.

3. In PingAccess, [create a new virtual host](../pingaccess_user_interface_reference_guide/pa_creating_new_virtual_hosts.html) that maps to the PingAccess host.

   ### Example:

   For example, `<PingAccessServerName>:3000`.

4. Assign the new virtual host to the application in addition to the virtual host specified for Microsoft Entra ID access.

5. In Microsoft Entra ID, go to the **App Registrations** window and select the application.

6. Click **Reply URLs** and add the internal PingAccess reply URL.

   ### Example:

   For example, `<PingAccessServerName>:3000/pa/oidc/cb`.

   |   |                                                                                                                                                                                                                                                                                                                                                              |
   | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
   |   | If you have the **Use context root as reserved resource base path** check box enabled on your PingAccess application, enter the application's context root before the reserved application context root.Using the previous example, the reply URL would be `<PingAccessServerName>:3000/myApp/pa/oidc/cb` if your application had a context root of `myApp`. |

7. Save the changes and test the configuration by signing on using the application's local URL.