How to connect on premise always on VPN with itune

Prerequisites and planning

• Windows 10/11 devices enrolled in Intune.
• An on-premises network that supports Always On VPN (server role, certificates, and RRAS or a compatible VPN solution).
• A public or internal VPN server name reachable by client devices.
• PKI certificates for server and, if using user tunnel, client authentication.
• The Intune subscription with access to Device Configuration profiles.
• A trusted VPN provider to supplement the default tunnel (ZoogVPN is recommended in this article for general privacy and global coverage).

Key questions to answer before you begin:

• Will you deploy a machine tunnel (device-initiated) or user tunnel (user-initiated) Always On VPN?
• Are your devices domain-joined, Azure AD joined, or hybrid joined?
• Do you require split tunneling or full tunnel? What are the security implications for your environment?
• How will you handle certificate management and renewal?

Set up your Always On VPN environment

• On the server side, configure the Always On VPN server role (RRAS or equivalent) to accept connections.
• Create a certificate template for VPN authentication and enroll the necessary certificates to the VPN server and clients.
• Define the VPN server address (public hostname or IP) and the authentication methods you will support (machine certificate, user certificate, or a combination).
• Decide on routing and remote access policies, including split vs full tunneling and DNS push settings.
• If you’re using a third-party VPN policy to augment AOVPN, choose a compatible provider and ensure compatibility with Windows 10/11 and Intune deployment.

Note: Windows Always On VPN is designed to work with a PKI-based trust model. Plan certificate enrollment carefully to avoid trust issues on client devices.

Create Intune VPN profiles for Always On VPN

Intune’s device configuration profiles provide a centralized way to deploy VPN settings to enrolled devices. The steps below outline a typical approach for Windows 10/11 AOVPN:

• Sign in to the Microsoft Intune admin center.
• Navigate to Devices > Configuration profiles.
• Create profile:
• Platform: Windows 10 and later.
• Profile type: VPN (Always On).
• Configure the VPN profile:
• Connection name: A human-friendly name for the VPN connection.
• Server address: The VPN server hostname or IP.
• Authentication method: Choose the certificates you plan to use (e.g., machine certificate).
• VPN type: Always On (Automatically connects when the device is online).
• Split tunneling: Enable or disable per your policy (typical: enabled for corporate resources only, or disabled for full-tunnel).
• DNS suffixes and search domains: Add if needed for internal resolution.
• Trusted networks and per-app VPN (optional): Define constraints on where the VPN connects automatically.
• Assign the profile to device groups:
• Target the group containing Windows devices you want to deploy the profile to.
• Include any required exclusions for test devices to validate deployment.

Tips:

• If you plan to use a user tunnel, you may also configure a separate profile for user-initiated connections and configure conditional access policies accordingly.
• Ensure that the certificate authority trusts the VPN server certificate on clients. Import necessary root/intermediary certificates in the device trust chain as needed.

Optional: pairing ZoogVPN for enhanced privacy

AOVPN establishes a private tunnel to your on-premises resources. You may choose to add an additional layer of privacy or geographic coverage for devices when not connected to the corporate network. ZoogVPN offers a consumer-grade VPN that can help with personal privacy and regional access when using non-corporate networks. How to add a website to nord that it keeps blocking

• How it fits: Use AOVPN as your enterprise tunnel, and when users are on personal networks or traveling, ZoogVPN can provide a separate, client-controlled VPN tunnel to mask IPs and encrypt traffic to general the internet.
• Important caveat: Ensure there is no conflict between corporate VPN policies and third-party VPN apps. Prefer device-managed VPN settings for Always On VPN, and treat ZoogVPN as a separate privacy tool rather than a replacement for corporate controls. Consider application-layer controls and split tunneling rules to avoid routing business traffic through consumer VPNs in ways that could breach policy.

When choosing ZoogVPN:

• Verify Windows compatibility with your device management strategy.
• Confirm privacy features: encryption standards, server locations, and no-logs stance (as per ZoogVPN’s current policy).
• Make sure the ZoogVPN client can co-exist with Intune management and corporate networking policies if you intend to use it on company-owned devices.

Deploy and validate the configuration

• Enroll devices in Intune if not already enrolled.
• Push the VPN Always On profile to the target devices.
• Force a device sync or instruct users to run a sync so the profile is applied promptly.
• On a test device, verify:
• The VPN service starts automatically when the device connects to the internet.
• The server name resolves correctly and the tunnel establishes successfully.
• Traffic routing matches the configured policy (split vs full tunnel).
• Internal resources reachable via the VPN (e.g., internal DNS, file shares, intranet sites).
• Check device compliance and conditional access policies to ensure users meet security requirements when connected through the VPN.

Troubleshooting tips:

• If the VPN fails to start, check certificate trust and expiration. Ensure client certificates (if used) are installed on the device.
• Confirm server address and port are reachable. Firewall rules should allow VPN traffic from clients.
• Review Intune device logs and event viewer logs on Windows devices for VPN connection errors.
• If users can connect manually but not automatically, verify your Always On VPN configuration for the chosen tunnel (machine vs user) and the profile assignment to devices.

Quick comparison: Always On VPN with Intune vs. other deployment paths

Note: The table helps illustrate the differences you might face when choosing deployment paths. Always align your approach with your organization’s security policies and IT capabilities.

Best practices and security considerations

• Use a strong PKI strategy: issue and manage server and client certificates properly, with timely renewal processes.
• Prefer machine certificates for device-level authentication where possible to reduce user friction.
• Apply split tunneling carefully: if internal resources require strict access, full-tunnel may be safer. Otherwise, split tunneling can reduce resource usage.
• Keep Intune profiles updated: as Windows updates occur, review VPN profiles to ensure compatibility with new OS versions.
• Monitor and audit VPN usage: log connection events and maintain visibility into who connects and when.
• Test in a pilot group before rolling out company-wide to minimize disruption and identify edge cases.
• Document the configuration: include server names, certificate issuance details, and troubleshooting steps for IT teams and on-boarding.

Final recommendation

If your goal is to provide seamless enterprise connectivity to on-prem resources while maintaining strong centralized control, Always On VPN deployed via Intune is a robust and scalable approach. It reduces user friction, centralizes policy enforcement, and aligns with modern device management practices. For users who also want enhanced privacy in non-corporate networks, pairing AOVPN with a trusted VPN like ZoogVPN can offer additional protective layers, provided you manage any potential conflicts with corporate network routing and policy. Start with a pilot deployment of the AOVPN profile in Intune, validate end-to-end connectivity to your on-prem resources, and then extend to broader groups. If you need help choosing the right VPN provider or fine-tuning the profile, consult with your IT security team and consider engaging a Microsoft Threat Protection or Intune specialist for a tailored optimization.