Prepare the Azure VPN Gateway.

Action: Deploy a VPN gateway in the hub VNet or use an existing one.
*
Explanation:

• P2S connections terminate here.
• Supports multiple authentication types.
• The Gateway SKU must support P2S (VpnGw1 or higher is recommended for production, and it also supports the OpenVPN protocol).

Note: Enable the OpenVPN protocol, which is supported on most modern OSes and integrates with Entra ID by choosing SKU VpnGw1AZ or higher.

1. Go to Hybrid connectivity and click Create VPN gateway.

*

2. Fill up the details as follows.

Note: You usually don’t need active-active for P2S.

What Active-Active Actually Means. (Azure VPN Gateway).

Active-Passive (default)

• 1 active VPN instance.
• 1 standby instance.
• One public IP (two total for S2S).
• If active fails → brief reconnection.

Active-Active

• 2 active VPN instances.
• Both handle traffic at the same time.
• Multiple public IPs.
• Higher availability + throughput.

Disable BGP if:

• You are using Point-to-Site (P2S) only.
• You have simple hub-and-spoke VNets.
• You do not have on-prem routers exchanging routes.

Enable BGP if:

• You are using Site-to-Site (S2S) or VNet-to-VNet.
• You want dynamic route exchange.
• You expect networks to change over time.

*

3. Enable the OpenVPN protocol, which is supported on most modern OSes and integrates with Entra ID.

• Go to Virtual network gateway.
• Point-to-site configuration.
• Configure now.

*

4. Fill up point-to-site configuration settings.

Address Pool

• The private IP range is assigned to VPN clients after they connect.
• Used as the source IP when accessing Azure resources.

Important: Must not overlap with any:

• Azure VNets
• On-premises networks
• Peered VNets

Example format: 172.16.100.0/24

Tenant ID.

• Your Microsoft Entra (Azure AD) Tenant ID.
• Can be found in Azure Portal → Microsoft Entra ID → Overview
• Format: https://login.microsoftonline.com/<TenantID> (copy)

Audience.

• The app registration, or well-known GUID, that represents the VPN as a trusted resource.
• Use Microsoft's default GUID (recommended): 41b23e61-6c1e-4545-b367-cd054e0ed4b4
• Or your custom App Registration Application ID URI: api://<Your-App-GUID> (copy)

*
Issuer

The URL representing the token issuer (Entra ID).

Used by VPN Gateway to verify that the token is from your tenant.

Format: https://sts.windows.net/<TenantID> (copy)

*
Recommended method.

If you don't want to register your own application, then use the default Microsoft GUID (41b23e61-6c1e-4545-b367-cd054e0ed4b4) as the audience in your P2S VPN configuration.

This Audience ID is fixed and standard across all Azure P2S + Entra ID deployments.

You do not need to create a custom app registration if you use the default Microsoft GUID (41b23e61-6c1e-4545-b367-cd054e0ed4b4) as the audience.

Note: When you use Microsoft’s default GUID, you do NOT need to add api://

*

5. Use your app registration ID only if you want to use a custom app for authentication.

Note: api:// is not strictly required, but it is the recommended format when creating a custom Application ID URI in Microsoft Entra ID.

*

Assign Users or Groups.

1. Go to Entra ID → Enterprise applications → [Your P2S-VPN app] → Users and groups.

*

• Assign the users/groups allowed to connect to the VPN.
• Only these accounts can log in via OpenVPN.

*

• Click Assign.

*

*

Configure Conditional Access (Optional, Recommended)

Since your P2S VPN uses Azure AD authentication, you can control who can connect, from where, and under what conditions using Conditional Access (CA) policies.

Refer to this guide to configure conditional access.

*

Step 1: Go to Conditional Access

• Open Azure Portal → Entra ID → Security → Conditional Access.
• Click New policy and give it a descriptive name, e.g., P2S VPN Access Policy.

Step 2: Assign Users/Groups

• Under Assignments → Users and groups, select:
• The users/groups allowed for the VPN.
• Usually, this is the same group you assigned in the P2S VPN app.

Step 3: Assign Cloud App

• Under Assignments → Cloud apps or actions → Include, select:
• Select apps → pick your VPN gateway enterprise app (the one you registered).
• This ensures the CA policy applies only when logging in to the VPN.

Step 4: Configure Conditions (Optional)

• You can fine-tune access with conditions such as:
• Sign-in risk: Block risky sign-ins.
• Locations: Only allow from trusted IPs (e.g., office/home).
• Device platform: Restrict to Windows/macOS/iOS/Android.
• Client apps: Limit to browser, mobile apps, or other clients if needed.

Step 5: Access Controls

• Under Grant → Grant access, choose one of:
• Require multi-factor authentication (MFA) → strongly recommended.
• Require device to be marked compliant (if using Intune).
• Require password change or other controls as needed.
• Typically, for VPN: Grant access + Require MFA is enough.

Step 6: Enable Policy

• Under Enable policy → On, then click Create.
• Users will now be prompted for MFA when connecting via OpenVPN.

Result:

• Only allowed users can connect.
• You can enforce MFA, device compliance, or location restrictions.
• Works seamlessly with your Azure AD P2S VPN.

*

Download and configure the VPN client.

Download the VPN client

1. Go to Azure Portal → Virtual Network Gateway → Point-to-Site configuration.

• Click Download VPN client.

Note: The downloaded package contains the client configuration files (.xml).