COMMAND EVERYTHING.

Add-WebApplicationProxyApplication

Publishes a web application through Web Application Proxy.

PowerShell · Risk: High · Documentation Verified

Last verified: 2026-10-26

Microsoft WebApplicationProxy reference: Publishes a web application through Web Application Proxy. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.

Add-WebApplicationProxyApplication [-Name] <String> [-ExternalPreauthentication <String>]
 [-ClientCertificateAuthenticationBindingMode <String>] [-BackendServerCertificateValidation <String>]
 -ExternalUrl <String> [-ExternalCertificateThumbprint <String>] [-EnableSignOut]
 [-InactiveTransactionsTimeoutSec <UInt32>] [-ClientCertificatePreauthenticationThumbprint <String>]
 [-EnableHTTPRedirect] [-ADFSUserCertificateStore <String>] [-DisableHttpOnlyCookieProtection]
 [-PersistentAccessCookieExpirationTimeSec <UInt32>] -BackendServerUrl <String>
 [-DisableTranslateUrlInRequestHeaders] [-DisableTranslateUrlInResponseHeaders]
 [-BackendServerAuthenticationSPN <String>] [-ADFSRelyingPartyName <String>] [-UseOAuthAuthentication]
 [-CimSession <CimSession[]>] [-ThrottleLimit <Int32>] [-AsJob] [<CommonParameters>]

Copied 0 times

Required permissions

Use an account with the target resource permissions documented for Add-WebApplicationProxyApplication. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.

Supported environments

Windows / WebApplicationProxy · Windows Server 2025 documentation; feature/module prerequisites apply

Parameters

-ADFSRelyingPartyName: Specifies the name of the relying party configured on the AD FS federation server.
-ADFSUserCertificateStore: Specifies the certificate store for a AD FS user.
-AsJob: Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete.
-BackendServerAuthenticationSPN: Specifies the service principal name (SPN) of the backend server. Use this parameter if the application that the backend server hosts uses Integrated Windows authentication.
-BackendServerCertificateValidation: Specifies whether Web Application Proxy validates the certificate that the backend server presents with the WAP configuration per application. The acceptable values for this parameter are: - None - ValidateCertificate
-BackendServerUrl (required): Specifies the backend address of the web application. Specify by protocol and host name or IP address. Include the trailing slash (/). You can also include a port number and path. The following examples show the form of an address: - http://AccountingApp.Contoso.com/ - http://Mail.Contoso.com/Remote/ - http://Portal/
-CimSession: Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a New-CimSession or Get-CimSession cmdlet. The default is the current session on the local computer.
-ClientCertificateAuthenticationBindingMode: If this parameter is set to ValidateCertificate then the browser sends a certificate with each request and validates that the device certificate thumbprint from the certificate is included in the token or the cookie. The acceptable values for this parameter are: - None - ValidateCertificate
-ClientCertificatePreauthenticationThumbprint: Specifies the certificate thumbprint, as a string, of the certificate that a client supplies for the preauthentication feature. The thumbprint is 40 hexadecimal characters. This parameter is only relevant when you specify the value of ClientCertificate for the ExternalPreauthentication parameter.
-DisableHttpOnlyCookieProtection: Indicates that this cmdlet disables the use of the HttpOnly flag when Web Application Proxy sets the access cookie. The access cookie provides single sign-on access to an application. Important: by default, HttpOnly is enabled to help ensure network protection. If you disable HttpOnly flag protection, the browser may share this cookie with other components on the client device, such as ActiveX, Java Applets and JavaScript, so they can access this application without the need to perform additional preauthentication.
-DisableTranslateUrlInRequestHeaders: Indicates that Web Application Proxy does not translate HTTP host headers from public host headers to internal host headers when it forwards the request to the published application. Specify this parameter if the application uses path-based information.
-DisableTranslateUrlInResponseHeaders: Indicates that Web Application Proxy does not translate internal host names to public host names in Content-Location, Location, and Set-Cookie response headers in redirect responses. If the proxy does not translate host names in the Content-Location or Location response headers, subsequent client requests resolve incorrectly. If the proxy does not translate the host name in the Set-Cookie response header, the published web application might not use cookies properly.
-EnableHTTPRedirect: Indicates that this cmdlet enables HTTP redirect for Web Application Proxy.
-EnableSignOut: Indicates whether to enable sign out for Web Application Proxy.
-ExternalCertificateThumbprint: Specifies the certificate thumbprint, as a string, of the certificate to use for the address specified by the ExternalUrl parameter. The thumbprint is 40 hexadecimal characters. The certificate must exist in the Local Computer or Local Personal certificate store. You can use a simple certificate, a subject alternative name (SAN) certificate, or a wildcard certificate.
-ExternalPreauthentication: Specifies the preauthentication method that Web Application Proxy uses. The acceptable values for this parameter are: - ADFS - ClientCertificate - PassThrough - ADFSforRichClients - ADFSforOAuth - ADFSforBrowsersAndOffice
-ExternalUrl (required): Specifies the external address, as a URL, for the web application. Include the trailing slash (/).
-InactiveTransactionsTimeoutSec: Specifies the length of time, in seconds, until Web Application Proxy closes incomplete HTTP transactions.
-Name (required): Specifies a friendly name for the published web application.
-PersistentAccessCookieExpirationTimeSec: Specifies the expiration time, in seconds, for persistent access cookies.
-ThrottleLimit: Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer. Do not specify a value for this parameter greater than 1.
-UseOAuthAuthentication: Indicates that Web Application Proxy provides the URL of the federation server that performs Open Authorization (OAuth) when users connect to the application by using a Windows Store app.

Prerequisites

Windows with the WebApplicationProxy module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.

Security considerations

This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.

Examples

Example 1: Publish a web application

Add-WebApplicationProxyApplication -Name "Contoso App" -ExternalPreauthentication ADFS -ExternalUrl https://ContosoApp.Contoso.com/ -ExternalCertificateThumbprint "69DF0AB8434060DC869D37BBAEF770ED5DD0C32A" -BackendServerUrl http://ContosoApp:8080/ -ADFSRelyingPartyName "ContosoAppRP"

This command publishes a web application that specifies the value of AD FS for the ExternalPreauthentication parameter. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.

Sources

https://github.com/MicrosoftDocs/windows-powershell-docs/blob/b7645dd8c687139b28e845119da30ec670526507/docset/winserver2025-ps/WebApplicationProxy/Add-WebApplicationProxyApplication.md

https://learn.microsoft.com/powershell/module/webapplicationproxy/add-webapplicationproxyapplication?view=windowsserver2025-ps

Personal collections

Explain or customize this command with AI

Related commands