A different policy - for example, one requiring X.509 certificates or SAML tokens - could be defined in, and enforced by, the Azure fabric.
The local client program that had been accessing the service - first directly, then by way of the Azure cloud - was adapted for the same kind of secure access.