Use case: contractor to internal appGuided onboarding

Give contractors selected internal web apps, not a network route

A contractor, partner or support engineer needs access to selected internal web apps: CRM, an admin panel or a partner portal. BusinessProxy publishes those apps through controlled addresses and portal-launched sessions.

Request access

Real-world situation

An implementation partner needs one customer installation for a month: a staging admin panel and a reporting portal. The customer does not want to expose a VPN profile, internal DNS or private ranges, but still needs a way to revoke the session and prove what access was granted.

What buyers worry about

The partner needs the app, not the surrounding network.
The internal hostname, private IP and connector placement should not become part of the user-facing URL.
If the connector or app is unavailable, access should close instead of falling back to a broader path.

What you control

Publish selected app addresses, bind each app to a workspace connector, set access by role or group policy, define the session lifetime and keep revoke available to administrators.

What stays outside

The user opens the BusinessProxy portal, chooses an app granted to them, and receives an app-scoped browser session. They do not receive a route to your VPC and do not see the internal hostname or private IP.

The App Gateway path operates at the web layer — see what this access path sees.

Review

What administrators can verify

Users launch only the apps assigned to them from the portal.
Each app session has a limited lifetime, is scoped to that app and can be revoked.
The connector resolves the internal address inside your network; users do not see internal hostnames or private IPs.
If an app is disabled or the connector is unavailable, access closes instead of falling back to another route.
The web-layer path carries method, path, query, headers and bodies only in transit; bodies are not logged or stored.

Success signals

The partner opens only the assigned app through its public app address.
The customer can revoke the active app session and remove future launch rights from the group.
Internal topology stays out of the user-facing URL and sanitized errors.

Rollout

What the workflow looks like

Publish the selected internal app and assign the workspace connector that can reach it.
Grant the partner group access to the app and set the app-session lifetime.
Have the partner launch the app from the portal and verify the public app address flow.
At the end of the engagement, revoke active sessions and remove the group access rule.

When to use

External contractors or partners need selected internal web apps.
The app runs over HTTP/HTTPS and works behind a reverse proxy.
You can run a connector close to the app.
You want app session lifetime, revoke and audit instead of broad network reachability.

When not to use

Use another channel for SSH/RDP, database tunnels or non-HTTP applications.
Review a separate high-availability design when the app needs several connectors.
Review onboarding when the app needs custom TLS behavior or unusual proxy semantics.

App Gateway is connected with guided onboarding. We confirm the app, connector, public app address, diagnostics and revoke checks before enabling regular access.

Related use cases