Microsoft recently introduced Entra Private Access, an identity-centric Zero Trust Network Access (ZTNA) solution to provide secure remote access to on-premises resources. With Entra Private Access, administrators can leverage Entra Conditional Access to enforce policy-based access control for network access. However, Entra Private Access isn’t for everyone. It does not provide full feature parity with Always On VPN, and there are also licensing considerations. However, for those organizations using Always On VPN, the good news is that you can integrate Entra Conditional Access with Always On VPN today to gain some of the security benefits it provides.
Conditional Access
Microsoft Entra Conditional Access is a security feature that enables administrators to create and enforce policies that specify how users can access resources. In the specific case of Always On VPN, conditional access is critical to ensuring legitimate access to authenticated users on authorized devices.
Signals
Conditional access policies use a wide variety of signals for policy enforcement, such as:
- User Identity: Who is making this access request?
- User Properties: Is this user a member of a specific group?
- Location: Where is this access request originating?
- Device Management: Is this device joined to Entra ID?
- Device State: Is this device compliant with security policies?
- Device Platform: Is this a Windows device?
- Risk Level: Is this login considered risky?
Access Control
Based on these signals, administrators can design a conditional access policy to enforce granular access control, such as:
- Grant access only from managed devices
- Deny access from untrusted locations
- Require additional context-based authentication (e.g., multifactor authentication)
- Enforce specific authentication types (e.g., phishing-resistant credentials)
- Allow access only from specific device platforms (e.g., Windows only)
- Require Entra hybrid-joined device
- Block access when a device is not compliant with security policies
Always On VPN
Entra Conditional Access works with Always On VPN by issuing a special, short-lived user authentication certificate once the user has been authorized. The Always On VPN infrastructure can be configured to use this certificate to grant access to the VPN. Integrating conditional access with Always On VPN can significantly improve the security posture of organizations using this feature.
Deployment Guide
I’ve published a detailed, step-by-step deployment guide to configure Entra conditional access for Always On VPN. In addition, I have posted a demonstration video for enabling Entra conditional access with Aways On VPN on YouTube.
Naz
/ February 10, 2025I do leverage AOVPN for multiple reasons ( autopilot hybrid-join), update caches password … ,however as long as I know ,CAPs cannot be enforced for device tunnel architecture.
Richard M. Hicks
/ February 10, 2025That’s correct. Entra Conditional Access for Always On VPN applies only to the user tunnel. The device tunnel is authenticated using only the device certificate and does use Entra ID at all.
Ed Morgan
/ February 10, 2025Does this mean we can set AOVPN to only connect from explicit geographical locations? Or deny from others?
Richard M. Hicks
/ February 10, 2025Yes. Most anything you can do with Entra Conditional Access policy works with Always On VPN. 🙂