Join Proxy is a Primary Server or a Satellite with the Join Proxy role that acts as a proxy by accepting and maintaining connections from Windows managed devices that are in a private network.
Join Proxy when used for remote management operations joins two connections together. The first connection being the one that the managed device maintains with the proxy server while the second one is the connection that comes from the viewer machine of the administrator.
In ZENworks, Join Proxy is a role that is by default assigned to the Primary Servers while you can also assign this role to Satellites. If you choose a Primary Server for the Join Proxy role, there is no need to further configure the server. If you choose a Satellite, then you need to assign the Join Proxy role to the Satellite server.
When a Join Proxy is used, the ZENworks Agent first connects to the Join Proxy server if its location is configured with a Join Proxy server. The agent then initiates a TCP connection to the Join Proxy Server and then periodically checks in to keep the connection alive. The ZENworks administrator will be able to remotely manage the device only If the Join Proxy server is reachable by both the ZENworks administrator and the managed device.
For example, if a device is located in a hotel room behind a NAT (Network Address Translation) the administrator cannot directly contact the machine. In this context, the administrator can only use the Join Proxy to reach the managed device.