Windows 10 Always On VPN is the replacement for Microsoft’s popular DirectAccess remote access solution. It provides the same seamless, transparent, always on remote connectivity as DirectAccess. Where DirectAccess relied heavily on classic on-premises infrastructure such as Active Directory and Group Policy, Always On VPN is infrastructure independent and is designed to be provisioned and managed using a Mobile Device Management (MDM) platform such as Microsoft Intune.

Intune and Always On VPN

Until recently, provisioning Windows 10 Always On VPN connections involved manually creating a ProfileXML and uploading to Intune using a custom profile. This has proven to be challenging for many, as the process is unintuitive and error prone.

A recent Intune update now allows administrators to create a basic Windows 10 Always On VPN deployment. Although it still has its limitations, it will go a long way to making the adoption of Always On VPN easier.

Prerequisites

Certificates must first be provisioned to all clients before deploying Windows 10 Always On VPN using Intune. In addition, if using a third-party VPN client, the VPN plug-in software must be installed prior to deploying the VPN profile.

Test VPN Connection

It is recommended that a test VPN connection be created on a client machine locally before deploying an Always On VPN profile using Intune. This allows the administrator to test connectivity and validate Extensible Authentication Protocol (EAP) settings. Once complete, run the following PowerShell commands to extract the EAP configuration settings to a file for later publishing with Intune.

$Vpn = Get-VpnConnection -Name [Test VPN connection name]
$Xml = $Vpn.EapConfigXmlStream.InnerXml | Out-File .\eapconfig.xml -Encoding ASCII

Deploying Always On VPN with Intune

Follow the steps below to deploy an Always On VPN connection using Intune.

Create a VPN Profile

1. Open the Microsoft Intune management portal.
2. Click Device configuration.
3. Click Profiles.
4. Click Create profile.

1. Enter a name for the VPN profile.
2. Enter a description (optional).
3. From the Platform drop-down menu select Windows 10 and later.
4. From the Profile type drop-down menu select VPN.
5. In the Settings section click Configure.

Define VPN Profile Settings

1. Click Base VPN.
2. Enter a name for the connection.
3. Enter a description and provide the Fully Qualified Domain Name (FQDN) of the VPN server. If it will be the default server select True and click Add.
4. Enter a description and provide the FQDN for any additional VPN servers, as required.
5. From the Connection type drop-down list choose the preferred connection type.
6. In the Always On section click Enable.
7. Select Enable to Remember credentials at each logon (optional).
8. Click Select a certificate.
9. Choose a client authentication certificate and click Ok.
10. Paste the contents of eapconfig.xml (saved previously) in the EAP Xml field.
11. Click Ok.

Define Additional Settings

You can also configure the following optional VPN settings using Intune.

• Apps and Traffic Rules
• Conditional Access
• DNS Settings
• Proxy
• Split Tunneling

After configuring any required additional settings, click Create.

Assign VPN Profile

1. Click Assignments.
2. From the Assign to drop-down menu choose Selected Groups.
3. Click Select groups to include.
4. Choose an Azure Active Directory group to apply the VPN profile and click Select.
5. Click Save.

Limitations

Although the ability to provision Always On VPN using Microsoft Intune without using a custom profile is welcome, it is not without its limitations. At the time of this writing, only Always On VPN user profiles can be configured. A device tunnel, which is optional, must be configured manually using a custom profile. In addition, the Intune user interface lacks the ability to define settings for the following parameters:

• Custom IKEv2 cryptography policy
• Exclusion routes
• Lockdown mode

To make changes to the default settings for any of the above parameters, a ProfileXML must be created manually and provisioned with Intune using a custom policy.

Additional Information

Windows 10 Always On VPN Device Tunnel Step-by-Step Configuration using PowerShell

Windows 10 Always On VPN Certificate Requirements for IKEv2

Windows 10 Always On VPN and the Name Resolution Policy Table (NRPT)

Windows 10 Always On VPN Hands-On Training