Microsoft DirectAccess: Deprecation, Support, and Migration

Microsoft DirectAccess is a remote access solution first introduced in Windows Server 2008 R2. It was a paradigm shift for remote access, providing seamless, transparent, always-on corporate network connectivity for managed Windows devices without any user interaction. DirectAccess was widely deployed for more than a decade, but Microsoft has now deprecated it, and organizations still using it should be planning their migration.

Last updated: November 9, 2026

Deprecation Status

DirectAccess is at the end of its life. The key milestones are as follows.

DirectAccess remains supported on current Windows Server and Windows client releases for now, but there will be no new features, and the platform has no future. Organizations running DirectAccess on older servers face an even more urgent deadline: Windows Server 2016 reaches end of extended support in January 2027.

How DirectAccess Works

Although DirectAccess is often described as a VPN, it works differently from traditional VPN solutions in the following ways.

IPsec Without a VPN Client

DirectAccess doesn’t use the Windows VPN client. Instead, it uses the connection security rules feature of Windows Firewall with Advanced Security to establish IPsec tunnels between the client and the DirectAccess server. Clients establish an infrastructure tunnel before the user signs in, providing access to domain controllers and management servers, and a user tunnel after sign-in.

IPv6 Only

DirectAccess is an IPv6 technology. Clients communicate with the DirectAccess server exclusively over IPv6. When internal resources are reachable only over IPv4, the DirectAccess server uses DNS64 and NAT64 to translate client traffic.

IPv6 Transition Technologies

Because IPv6 wasn’t widely available on the public Internet when DirectAccess was introduced, it relies on IPv6 transition technologies to carry IPv6 traffic over the IPv4 Internet. DirectAccess supports the following three.

  • 6to4. Encapsulates IPv6 in IPv4 using IP protocol 41. It only works when both the client and server have public IPv4 addresses, and it doesn’t work behind NAT.
  • Teredo. Encapsulates IPv6 in IPv4 using UDP port 3544. It works when the client is behind NAT, but the server must have two consecutive public IPv4 addresses.
  • IP-HTTPS. Encapsulates IPv6 in an HTTPS (TLS) connection on TCP port 443. It works through nearly any firewall and is the most commonly used transition technology, especially when the DirectAccess server is behind an edge firewall or load balancer.

Requirements

DirectAccess has several requirements that limit where it can be used, including the following.

  • The Remote Access server role with the DirectAccess and VPN (RAS) role service on Windows Server
  • Domain-joined DirectAccess servers and clients
  • Windows Enterprise edition on clients
  • Active Directory Group Policy for server and client configuration
  • A public key infrastructure (PKI) for computer certificates in most production deployments, and a trusted TLS certificate for IP-HTTPS

Why DirectAccess Is Being Retired

DirectAccess is built on legacy technologies that don’t align with modern, cloud-centric environments. Its limitations include the following.

  • Requires domain-joined servers and clients and Active Directory Group Policy
  • Depends on NTLMv2 for authentication, which Microsoft is phasing out
  • Relies on complex IPv6 transition and translation technologies that can affect performance and are difficult to troubleshoot
  • Doesn’t support modern management with Microsoft Intune
  • Doesn’t integrate with Microsoft Entra ID or Entra Conditional Access
  • Doesn’t provide fine-grained, per-application (Zero Trust) access control
  • Doesn’t support Windows Pro or non-Windows devices

Migrating from DirectAccess

Microsoft offers two replacements for DirectAccess. The right choice depends on your identity platform, device management, and security requirements.

  • Always On VPN. Provides a DirectAccess-like always-on experience using the native Windows VPN client, with support for Intune and Entra Conditional Access. It’s the most direct replacement for DirectAccess.
  • Microsoft Entra Private Access. A cloud-delivered Zero Trust Network Access (ZTNA) solution that provides per-application access with Entra Conditional Access.

For help choosing between them, see Always On VPN vs. Entra Private Access: Choosing the Right Access Model. DirectAccess and Always On VPN can coexist on the same clients, which makes a phased migration possible.

Popular DirectAccess Guides

Many organizations continue to operate DirectAccess while they plan their migration. These are some of my most popular DirectAccess guides.

Recent DirectAccess Posts

My most recent DirectAccess posts cover certificates and security updates, including the following.

You can also browse all older DirectAccess posts in the archive.

For in-depth guidance, see my book, Implementing DirectAccess with Windows Server 2016. My DirectAccess video courses on Pluralsight have been retired; current courses are listed on my training page.

How I Can Help

I’ve deployed DirectAccess for organizations worldwide since its introduction, and I now help those organizations move on. My services include the following.

Learn more about all of my consulting services.

Additional Information

Microsoft DirectAccess Formally Deprecated

Windows Server 2025 Marks the End of Microsoft DirectAccess

DirectAccess (Microsoft Learn)

Always On VPN: Secure Remote Access for Windows

Enterprise VPN and Secure Remote Access Consulting

Start a Conversation

Still running DirectAccess? Tell me about your environment and migration goals, and I’ll follow up, typically within one business day.

← Back

Thank you for your response. ✨