Journalist 
Yes, Intune can create VPN profiles for managed devices. In this guide, you’ll get a practical, step-by-step approach to building and deploying VPN profiles with Microsoft Intune Endpoint Manager across Windows, iOS, and Android, plus a look at Always On VPN for Windows 10/11. You’ll find real-world tips, best practices, troubleshooting, and templates you can copy-paste into your environment. If you’re testing VPN in your environment, you might also want extra protection during setup—check out NordVPN through this badge:
Introduction: what you’ll learn and why it matters
- A concise, step-by-step path to create and deploy VPN profiles in Intune
- Platform-specific guidance for Windows 10/11, iOS, and Android
- How to handle certificates, VPN server configuration, and authentication methods
- Best practices for rollout, monitoring, and troubleshooting
- Ready-to-use templates and settings you can adapt to your network
Useful URLs and Resources text only
https://learn.microsoft.com/en-us/mem/intune/
https://learn.microsoft.com/en-us/mem/configmgr/vpn
https://learn.microsoft.com/en-us/mem/intune/protect/certificates-use
https://docs.microsoft.com/en-us/mem/intune/fundamentals/vpn
https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-access-vpn/119723-what-is-vpn.html
https://support.apple.com/guide/iphone-enterprise-accounts/welcome/ios
https://developer.android.com/work/devices/emulator
https://www.examplevpnserver.com/docs
Body
What is a VPN profile in Intune and why it matters
Intune enables you to centrally configure and deploy VPN connections to enrolled devices. This means you can enforce consistent settings, control who can access corporate networks, and simplify the user experience with automatic VPN connections when endpoints come online. A VPN profile in Intune is essentially a set of configuration parameters that the device applies to establish a secure tunnel to your VPN gateway. You can push these profiles to Windows 10/11 devices including Always On VPN, iOS devices, and Android devices. The key is aligning the VPN server capabilities IKEv2, L2TP/IPsec, SSTP, etc. with the device platform and certificate strategy.
Key benefits
- Centralized management and compliance
- Faster onboarding of remote workers
- Reduced help desk tickets for manual VPN config
- Stronger security posture through certificate-based or strong pre-shared key authentication
- Granular targeting by user groups and device platforms
Prerequisites and planning
Before you jump into Intune, do a quick sanity check so your rollout goes smoothly.
- VPN server readiness
- Windows RRAS Routing and Remote Access for Windows Always On VPN is a common option, or your preferred third-party VPN gateway that supports IPsec/IKEv2, SSL VPN, or other standards.
- Ensure server load balance, certificate enrollment, and client access policies are in place.
- Certificate infrastructure
- For certificate-based authentication, you’ll need a PKI setup an internal CA or an enterprise PKI. You’ll issue client certificates to devices, or configure EAP-TLS for Windows and iOS/Android where supported.
- Licensing and permissions
- Ensure you have the appropriate Microsoft 365/Intune licenses for device management and app protection policies.
- Network considerations
- Split-tunnel vs full-tunnel, DNS resolution, and firewall rules for VPN gateway accessibility.
- Security posture
- Decide on device compliance checks, conditional access integration, and whether VPN should be automatic on connect or user-initiated.
- Platform specifics
- Windows: Always On VPN or VPN profile
- iOS/Android: Built-in VPN profiles with IKEv2/L2TP or third-party VPN apps if needed
- Testing plan
- Create a pilot group, verify connection, disconnect behavior, and roaming transitions before broad rollout.
Step-by-step: creating a Windows VPN profile Always On VPN in Intune
Windows Always On VPN is a popular choice for seamless corporate connectivity. Here’s a practical flow.
- Prepare the VPN server and certificates
- Set up RRAS or your VPN gateway with a valid server certificate
- Issue and distribute client certificates or prepare EAP-TLS if your environment supports it
- Confirm the VPN server supports IKEv2 with certificate-based auth recommended for SSO
- In Intune, create a VPN profile
- Sign in to the Microsoft 365 admin center and open the Endpoint Manager admin center
- Go to Devices > Configuration profiles > Create profile
- Platform: Windows 10 and later
- Profile type: VPN
- Name and description: Clear, business-focused name e.g., “Corp VPN – Always On – IKEv2”
- Configure the profile settings
- Connection name: Your corporate VPN name
- Server: VPN gateway FQDN or IP
- VPN type: IKEv2 or IKEv2 with certificate
- Authentication method: Certificate-based or EAP-TLS if you’ve set it up
- Identity certificate: Map to the client certificate template you issued to devices
- Client constraint/app rules: Optional, to limit when the VPN can start
- Per-app VPN: Optional for application-based routing
- Split tunneling: Choose according to policy split for performance, full-tunnel for complete security
- Use existing certificates: Point to your PKI trust chain or root CA
- Assign and deploy
- Assign the profile to a user or device group
- Consider a pilot group first, then expand to the broader organization
- Ensure devices are enrolled in Intune and compliant before deployment
- Monitor and verify
- Use Intune reporting to confirm deployment status
- On a test device, verify automatic VPN initiation on network change and reconnection after sleep
- Check the VPN tunnel status via Windows settings or VPN client logs
- Post-deployment tips
- Consider adding a Conditional Access policy that requires VPN for certain apps or data access
- Provide end-user guidance for troubleshooting common issues certificate renewal, gateway reachability, etc.
Step-by-step: creating VPN profiles for iOS and Android
iOS and Android devices typically use built-in VPN clients configured via Intune profiles or, if needed, a native/third-party VPN app. F5 big ip edge vpn client download mac complete macOS guide for download, install, configure, troubleshoot, and optimize
-
IOS IKEv2/L2TP with certificate or shared secret
- Platform: iOS/iPadOS
- Profile type: VPN
- Connection type: IKEv2 or IPsec L2TP/IPsec
- Server address: VPN gateway
- Authentication: Certificate preferred or Shared Secret
- User authentication: Certificate-based if you have client certs
- Identifier/Domain: As required by your VPN server
- On-demand rules: Optional, to auto-connect when certain domains are accessed
- Certificates: Ensure the device trust store has the server CA and client certificate if used
-
Android IKEv2/L2TP or SSL VPN depending on gateway
- Platform: Android
- Connection type: IKEv2 or L2TP/IPsec
- Authentication: Certificate-based preferred or PSK/Username-password if allowed
- CA certificate: Upload and assign to devices
- Client certificate: If certificate-based auth is used
- Routing: Split or full-tunnel configured per policy
- Proxy: If using a proxy for VPN, configure as needed
Important notes
- Always test with a variety of devices different OS versions to ensure compatibility
- For iOS, keep in mind that managed app configuration and device enrollment flow can impact VPN behavior
- For Android, some devices require additional steps due to OEM customizations. ensure your enrollment and VPN certificate distribution aligns with device policies
Certificates and authentication: the backbone of secure VPN
- Certificate-based authentication is stronger and scales well with large deployments
- You’ll need:
- A server certificate on the VPN gateway
- A CA certificate trusted by clients
- A client certificate issued to each device or dynamically provisioned
- If you use EAP-TLS or EAP-MS-CHAPv2, ensure your RADIUS or authentication server supports the chosen method
- For simpler setups, some environments opt for pre-shared keys PSK but that’s generally less secure and harder to rotate
Best practices for deployment and governance
- Start with a pilot group and collect feedback on reliability and performance
- Use descriptive names and consistent naming conventions for VPN profiles
- Keep certificate lifetimes reasonable e.g., 1-2 years and set up automatic renewal if possible
- Implement Conditional Access to restrict VPN access to compliant devices
- Document your VPN topology, gateway IPs, and certificate templates for future audits
- Consider per-app VPN or traffic segmentation to minimize exposure
- Enable auditing and logging on both the VPN gateway and the Intune side
- Prepare a rollback plan in case a new VPN profile causes issues
Troubleshooting common VPN deployment issues
- Issue: VPN profile fails to apply on device
- Check device enrollment status and Intune policy application status
- Verify certificate availability and trust chain on the device
- Confirm the VPN gateway is reachable from the device network
- Issue: VPN connection drops after sleep or roaming
- Review VPN keepalive settings and reauth timers
- Ensure the certificate is still valid and not expired
- Issue: Certificate-based auth fails
- Validate client certificate installation and mapping to the correct template
- Check the server-side CA revocation lists and CRL/OCSP status
- Issue: On iOS, VPN config shows “No VPN client installed”
- Ensure the device has the built-in VPN client enabled and not restricted by device policies
- Issue: Android devices fail to auto-connect
- Verify per-device/per-user assignment and ensure the VPN type matches gateway support
- Check device policy sync intervals and ensure the VPN profile is active
Security and privacy considerations
- Use certificate-based authentication whenever possible for stronger security
- Apply Conditional Access to ensure only compliant devices can access corporate resources
- Minimize data exposure by using split tunneling only when appropriate for your security model
- Regularly rotate certificates and keys and monitor for unusual VPN activity
- Document data retention policies for logs generated by VPN gateways and Intune
Performance and user experience tips
- Test VPN throughput with representative workloads to ensure your gateway can handle the load
- Consider a multi-region VPN gateway strategy if you have global users
- Use split tunneling strategically to balance security and performance
- Communicate clearly with users about VPN behavior auto-connect, roaming, and credentials handling
- Provide lightweight VPN status indicators in the user guide to reduce help desk calls
Templates and sample configurations you can adapt
- Windows Always On VPN profile IKEv2 with certificate
- Connection name: Corp VPN
- Server: vpn.corp.example.com
- VPN type: IKEv2
- Authentication: Certificate-based
- Client certificate: ClientAuth
- Split tunneling: Enabled
- Remember credentials: No certificate-based
- iOS IKEv2 profile
- Connection name: Corp VPN iOS
- IKEv2: Certificate-based
- Client certificate: iOSClientCert
- On-demand rules: Always connect for corporate domains
- Android IKEv2 profile
- Connection name: Corp VPN Android
- Type: IKEv2
- Client certificate: AndroidClientCert
- Route: All traffic
Common pitfalls and how to avoid them
- PITFALL: Not aligning VPN type with gateway capabilities
- Do a quick capability check of your gateway: IKEv2 vs L2TP vs SSL, and choose the matching profile type
- PITFALL: Certificate renewal gaps
- Set up automatic renewal reminders and test renewals in a staging group
- PITFALL: Inconsistent device enrollment states
- Use a staged rollout with clear enrollment prerequisites and a fallback plan
- PITFALL: Too many manual steps for admins
- Create reusable templates and leverage Intune’s recommended configuration steps to minimize mistakes
How rollout fits with broader security policies
- VPN is a gateway to internal resources. ensure it’s covered by data loss prevention DLP rules and access controls
- Align VPN deployment with your organization’s remote work policy and incident response plan
- Use device compliance status and conditional access to enforce MFA where it makes sense, especially for high-risk apps
Real-world testing and validation
- Validate in a controlled environment with a mix of devices Windows, iOS, Android and users
- Confirm policy propagation times by checking Intune device configuration status reports
- Run a simulated outage test to verify fallback behavior and user impact
- Collect logs from VPN gateways and Intune for audits and troubleshooting
Summary for admins and IT teams
- Intune can effectively manage VPN profiles for Windows, iOS, and Android
- Start with a solid plan: choose gateway type, certificate strategy, and a pilot group
- Use Always On VPN for Windows when seamless connectivity is a priority
- For mobile devices, rely on platform-native VPN profiles with strong authentication
- Continuously monitor, test, and adjust based on user feedback and security requirements
Frequently Asked Questions
How do I create a VPN profile in Intune for Windows 11?
To create a Windows 11 VPN profile, open Endpoint Manager, choose Devices > Configuration profiles > Create profile, select Windows 10 and later, VPN, and configure the connection name, server, VPN type, and authentication certificate-based is recommended. Assign to the target group and monitor deployment. Checkpoint vpn edge comprehensive guide for enterprise remote access, site-to-site VPN, and security features
Can Intune create VPN profiles for iOS and Android devices?
Yes. You can create VPN profiles for iOS and Android using built-in VPN types IKEv2 or L2TP/IPsec and assign them to device or user groups. Ensure certificates or PSKs align with your gateway.
What VPN types are supported in Intune?
Intune supports IKEv2 and L2TP/IPsec VPN profiles across Windows, iOS, and Android. For Windows, Always On VPN is a common pattern. Some third-party gateways may offer SSL VPN profiles that can be deployed via Intune if supported.
Do I need a PKI to deploy Always On VPN via Intune?
Certificate-based authentication is highly recommended for Always On VPN. This typically requires a PKI to issue and manage client certificates and server certificates.
How do I assign VPN profiles to devices in Intune?
Create your VPN profile, then assign it to a user or device group. It will be pushed to enrolled devices that match the target scope. Use a pilot group first to validate before a broader rollout.
How can I test VPN profile deployment?
Test on multiple devices Windows, iOS, Android with a small user group. Verify auto-connect behavior, proper certificate installation, gateway reachability, and reconnection after roaming or sleep. Ubiquiti edgerouter x sfp vpn setup guide for secure site-to-site and remote access with EdgeRouter X SFP
What troubleshooting steps help if VPN doesn’t connect?
Verify enrollment and policy application, certificate validity, gateway reachability, and correct VPN type settings. Check device logs, gateway logs, and ensure conditional access isn’t blocking access due to compliance failures.
How do I update a VPN profile after deployment?
Edit the profile in Intune, update the necessary fields certificate, server, or routing, and reassign the updated profile. Devices will pull the new settings on next policy refresh.
How can I monitor VPN usage and performance from Intune?
Use Intune’s configuration profile deployment status, and combine with VPN gateway logs and network monitoring tools. Consider adding Conditional Access logs to trace access events tied to VPN sessions.
Is it secure to deploy VPN profiles via Intune?
Yes, when combined with certificate-based authentication, proper PKI, and Conditional Access. Centralized management helps enforce security policies and simplifies revocation and certificate rotation.
Can I deploy per-user VPN profiles or per-device profiles?
Intune supports both models. Per-user profiles apply to users across devices, while per-device profiles tie to devices. Choose the approach that best fits your device ownership model and security requirements. Ipsec edgerouter x: A Comprehensive Guide to IPsec VPNs on EdgeRouter X for Site-to-Site, Remote Access, and Performance
How does Conditional Access interact with VPN access?
Conditional Access can require device compliance, location constraints, or MFA before allowing VPN access to sensitive apps or data. This adds an extra layer of security on top of the VPN profile.