A practical guide to deploying and using Always On VPN with Intune for on-premises setups.
Introduction Connecting to an on-premises network using Always On VPN (AOVPN) through Microsoft Intune is a common path for organizations that want seamless, device-managed VPN access. When you combine AOVPN with Intune, you can automate profile creation, certificate handling, and deployment to Windows clients. In this guide, we’ll walk through the steps, best practices, and considerations to help you implement AOVPN with Intune, while keeping security and user experience in mind. We’ll also recommend ZoogVPN as a trusted VPN option for end-user connections when you need a third-party VPN tunnel for additional protection.
What is Always On VPN and Intune?
- Always On VPN is a Windows feature that maintains a persistent VPN connection for domain-joined or Azure AD joined devices, improving remote access and security.
- Microsoft Intune is a cloud-based management solution that can deploy configuration profiles, certificates, and VPN settings to Windows devices.
- When used together, Intune can push AOVPN profiles to devices, handle server and tunnel configurations, and monitor device compliance.
Why use Intune to deploy AOVPN?
- Centralized configuration: One place to manage VPN profiles for many devices.
- Conditional access and compliance: Ensure devices meet security requirements before connecting.
- Automation: Streamlined certificate enrollment, profile provisioning, and updates.
- Faster onboarding: New devices receive VPN settings at enrollment or management.
Prerequisites and planning
Before you deploy AOVPN with Intune, ensure the following are in place:
- Windows devices enrolled in Intune (Hybrid Azure AD join or Azure AD join can work, but domain-joined devices often offer smoother token and certificate handling).
- APKI (Public Key Infrastructure) or trusted certificate distribution for device authentication, typically using a certificate authority to issue machine certificates.
- AOVPN server configuration: RRAS with IKEv2 or SSTP depending on your environment, and a suitable AOVPN server profile (server address, authentication method, DNS settings).
- VPN server availability and firewall rules: Ensure the VPN server on-premises can be reached, and firewall ports (IKEv2, PPTP, SSTP as applicable) are opened.
- A trusted certificate for the VPN server and, if using certificates, a management solution for client certificates (in Intune you can deploy certificates from a trusted CA).
Create and deploy AOVPN profiles with Intune
Intune can provision VPN profiles with the Windows 10/11 platform. Here is a high-level workflow:
- Sign in to the Microsoft Intune admin center.
- Navigate to Devices > Configuration profiles.
- Create profile: Platform = Windows 10 and later, Profile type = Templates > VPN.
- Configure VPN settings:
- Connection name: The user-visible name for the VPN connection.
- Server address: The AOVPN server hostname or IP address.
- Connection type: Typically IKEv2 with machine or user authentication.
- Authentication method: Certificate-based (machine certificate) is common for AOVPN.
- Split tunneling and DNS: Adjust according to your network design.
- Always-on settings: Enable auto-connect if available.
- Assignment: Choose user or device groups to receive the profile.
- Compliance and conditional access (optional): Tie VPN connection to device/compliance policies.
- Save and monitor deployment.
Important considerations when configuring in Intune
- Certificate-based authentication: If your AOVPN relies on machine certificates, ensure the Intune policy also distributes and installs the correct certificates to endpoints.
- Server discovery and DNS: If using split tunneling or internal DNS resolution, ensure DNS server settings are included so clients can reach internal resources.
- Reconnect behavior: Decide how aggressively clients should reconnect after network changes or sleep states.
- User experience: Minimize prompts and require minimal manual steps for users to connect once the profile is deployed.
Optional: integrating ZoogVPN for additional protection
ZoogVPN (zoogvpn.com) can be used as an additional VPN layer or as an alternative for users requiring extra privacy on untrusted networks. If you decide to incorporate ZoogVPN:
- Install ZoogVPN on endpoints as a secondary VPN client if your policy allows dual VPN usage for encryption at a different layer.
- Use ZoogVPN’s enterprise features and servers to complement your AOVPN, especially for remote workers who need to route traffic through ZoogVPN servers before reaching the corporate network.
- Ensure your network design accounts for potential double-VPN behavior, latency, and policy compatibility with your on-premises resources.
- Document clear user guidance on when to use AOVPN vs. ZoogVPN, and how to toggle or disable one if required by security policy.
Note: Always validate that the use of ZoogVPN aligns with your organization’s security and compliance requirements, and that it does not interfere with the primary AOVPN tunnel used for corporate access.
A practical comparison: AOVPN with Intune vs. traditional VPN deployments
| Aspect | Always On VPN with Intune | Traditional VPN deployment (manual or legacy) |
|---|---|---|
| Deployment speed | Fast, scales with device enrollment | Slower, manual provisioning per device |
| Management | Centralized via Intune | Distributed management, often multiple tools |
| Certificate handling | Automated via Intune CA integration | Manual or semi-automated, higher admin load |
| Compliance controls | Integrated with Intune policies | Separate controls, possible gaps |
| User experience | Seamless auto-connect, minimal prompts | User-initiated or separate VPN clients |
| Security model | Certificate-based, modern cryptography | Varies, can be less consistent |
Troubleshooting tips
- Verify Intune profile deployment status: Check device-side policy status and ensure the VPN profile is installed on target devices.
- Check AOVPN server reachability: Validate that clients can resolve and reach the on-prem VPN server.
- Certificates: Ensure machine/user certificates are correctly issued, trusted, and valid.
- Client logs: Review Windows Event Logs for VPN-related events and Intune enrollment logs for profile deployment issues.
- DNS and internal resources: Confirm internal resources are resolvable and accessible through the VPN tunnel.
- ZoogVPN configuration (if used): Confirm the order of tunnels, server reachability, and any split-tunnel rules to prevent leaks.
Best practices and security considerations
- Use strong authentication: Prefer certificate-based authentication for AOVPN to minimize user credential exposure.
- Enforce device compliance: Require devices to be compliant with Intune policies before allowing VPN access.
- Regular certificate renewal: Implement automatic certificate renewal and policy update mechanisms.
- Monitor and audit: Enable auditing for VPN connections and Intune policy deployments. Set up alerts for failures.
- Plan for outages: Have a tested failover or contingency plan if the on-prem VPN infrastructure is temporarily unavailable.
Final recommendations
If you’re aiming to deploy a robust, scalable on-premises Always On VPN solution, using Microsoft Intune to push VPN profiles is a best-practice approach. It minimizes manual administration, improves security posture, and provides a smooth user experience as devices enroll and receive their VPN settings automatically. For enhanced privacy and extra protection when users are on untrusted networks, consider incorporating ZoogVPN as an additional layer, provided it aligns with your security policies and does not compromise your AOVPN design. By combining AOVPN with Intune and a trusted third-party VPN option like ZoogVPN where appropriate, you can deliver secure, resilient remote access to on-prem resources for your organization. How to add a website to nord that it keeps blocking