Azure Relay ' s Hybrid Connections feature is designed specifically to expose an on-premises application, such as App1, to the internet without opening any inbound ports on the on-premises firewall: a small Hybrid Connection Manager agent installed on-premises establishes an outbound-only connection to the Azure Relay service, and internet clients then reach the on-premises app through that relay, so Firewall1 needs no new inbound rules at all -- the connection is entirely outbound-initiated from the on-premises side. Hybrid Connections also natively supports WebSockets-based traffic, matching how internal users already connect to App1. Microsoft Application Request Routing (ARR) is an IIS extension for reverse-proxying and load-balancing HTTP(S) traffic; using it to expose App1 to the internet would still require opening an inbound port on Firewall1 for the reverse proxy to receive traffic, unless combined with something like Azure Relay, so it does not meet the " minimize inbound ports " requirement on its own. Web Application Proxy is an on-premises AD FS/pre-authentication reverse proxy role that also requires an inbound-facing listener and open firewall ports to accept traffic from the internet. Azure Application Gateway is an Azure-hosted load balancer/WAF that operates on resources already reachable from Azure (such as VMs or on-premises endpoints reachable via VPN/ExpressRoute); it does not eliminate the need for inbound connectivity to an on-premises firewall the way Azure Relay ' s outbound-only model does. Therefore, Azure Relay (Hybrid Connections) is the correct inclusion.