When deploying Windows 10 Always On VPN, administrators can configure Trusted Network Detection (TND) which enables clients to detect when they are on the internal network. With this option set, the client will only automatically establish a VPN connection when it is outside the trusted network. Trusted network detection can be configured on both device tunnel and user tunnel connections.
TND Operation
When trusted network detection is configured, the VPN client will evaluate the DNS suffix assigned to all physical (non-virtual or tunnel) adapters that are active. If any of them match the administrator-defined trusted network setting, the client is determined to be on the internal network and the VPN connection will not connect. If the DNS suffix is not present on any of these adapters, the client is determined to be outside the internal network and the VPN connection will establish automatically.
TND Configuration
Trusted network detection is defined in the Intune UI or in ProfileXML as a string that matches the DNS suffix assigned to clients on the internal network. In this example, the DNS suffix on the internal network is lab.richardhicks.net.
Note: Your organization might have more than one DNS suffix. Ensure that the trusted network detection configuration includes all DNS suffixes in use in the environment to ensure reliable operation.
Intune
Follow the steps below to configured trusted network detection in Microsoft Intune.
- Open the Intune management portal (https://devicemanagement.microsoft.com/).
- Navigate to Devices > Configuration Profiles > [Profile Name] > Properties > Settings.
- Click on Trusted Network Detection.
- Enter the DNS suffix(es) used on the internal network.
ProfileXML
To define Trusted Network Detection in ProfileXML, add the TrustedNetworkDetection element as follows.
Caveats
In some instances, an Always On VPN client connection may persist, even if the client is connected to the internal network. A common scenario is when a client device connects to a Wi-Fi network that is not connected to the corporate network (for example guest Wi-Fi), then connects to the internal network with Ethernet via a docking station. If the Wi-Fi connection is still available, the Always On VPN connection will persist, even though the machine is connected to the internal network. This is expected and by design.
Workaround
To address this specific scenario, administrators can implement changes via group policy to the way Windows handles multiple connections to the same network. For example, beginning with Windows 10 1709, group policy can be configured to ensure that Windows 10 clients prefer wired Ethernet network connections over Wi-Fi, and to ensure that Wi-Fi connections disconnect when an Ethernet connection is detected.
GPO Configuration
Open the Group Policy management console (gpmc.msc) and perform the following steps to create the required group policy objects.
- Create a new Group Policy Object (GPO).
- Right-click the new GPO and choose Edit.
- Expand Computer Configuration > Administrative Templates > Network > Windows Connection Manager.
- Double-click the policy Minimize the number of simultaneous connections to the Internet or a Windows Domain.
- Select Enabled.
- From the Minimize Policy Options drop-down list choose 1 = Minimize simultaneous connections. Optionally you can choose to disable Wi-Fi whenever connected to Ethernet by choosing 3 = Prevent Wi-Fi when on Ethernet.
- Click Ok.
- Double-click the policy Enable Windows to soft-disconnect a computer from a network.
- Select Disabled.
- Click Ok.
A while back I wrote about 
The Internet Key Exchange version 2 (IKEv2) VPN protocol is the protocol of choice when the highest level of security is required for Always On VPN connections. It uses IPsec and features configurable security parameters that allow administrators to adjust policies to meet their specific security requirements. 
