Abstract: An example method of remote access to on-premises software executing in a data center by a cloud service executing in a public cloud includes: sending a request from the cloud service to a connection service executing in the public cloud, the request being for delegated access to the on-premises software in the data center; creating, by cooperation between the connection service and a connection agent executing in a gateway of the data center, a connection over a network between the public cloud and the data center; establishing a first local connection between the cloud service and the connection service; establishing a second local connection between the connection agent and the on-premises software; and exchanging data between the cloud service and the on-premises software over a tunnel comprising the first local connection, the connection over the network, and the second local connection.