Different Domains for App Server

That’s what I think most people do. Spin up a separate app server altogether for outside access or services in general, separate from your production app server… You can give it a whole different cert and FQDN if I am not mistaken? Both app servers point to the same database. And with using different app servers you can make one (the outside one) use something like Azure AD auth with multifactor or other security enhancements since you can hit it from outside. Microsoft App proxy could work too. @Mark_Wonsil might be able to chime in here. I am novice so take this whole post with a grain of salt…