Since the introduction of Windows 11, there have been numerous reports of issues with Always On VPN when deployed using Microsoft Endpoint Manager/Intune. Specifically, administrators have been reporting that Always On VPN profiles are being deleted, then later reappearing. Obviously, this is highly disruptive to users in the field.
Update January 25, 2022: Microsoft has released a fix for the issues described in this article. It is included with KB5008353 (build 22000.469).
Causes
According to Microsoft, there are several causes for deleted VPN profiles.
Changes to an Existing Profile
Missing Always On VPN profiles commonly occurs when updating settings for an existing VPN profile applied to Windows 11 endpoints. In this scenario, the VPN profile is deleted but not immediately replaced. Synchronize the device with Microsoft Endpoint Manager/Intune once more to return the VPN profile.
Multiple Profiles
Issues with Always On VPN profiles may also occur if two new VPN profiles are applied to the endpoint simultaneously.
Remove and Replace
Removing and replacing an Always On VPN profile at the same time will also result in connectivity issues.
Reference: https://docs.microsoft.com/en-us/mem/intune/configuration/vpn-settings-configure
Workaround
There is no known workaround for these issues at this time. Microsoft is aware of the problem and is working on a fix, and until then, rolling out Windows 11 with Always On VPN should be avoided.
Additional Issues
There have been reports of other known issues with Windows 11 and Always On VPN. For instance, my PowerShell script that removes an Always On VPN connection doesn’t work with Windows 11. I’m working to resolve that issue as we speak.
Are you experiencing any issues with Always On VPN on Windows 11? Please share them in the comments below!
