Is this what it meant by retiring manually registered P2S Azure VPN client?

Question

Is this what it meant by retiring manually registered P2S Azure VPN client?

Tan-9136 285

Hi everyone,

From this link below, I read that Manually Registered Azure VPN Client for P2S will be retired on 3/31/28:
https://azure.microsoft.com/en-us/updates?filters=%5B%22VPN+Gateway%22%5D&searchterms=manually+registered+azure+vpn

My understanding is the difference between Microsoft-registered and Manually-registered VPN Client for P2S is just the audience value.
Microsoft-registered is using c632b3df-fb67-4d84-bdcf-b95ad541b5c8 for Azure Public.
Manually-registered is using 41b23e61-6c1e-4545-b367-cd054e0ed4b4 for Azure Public.

Is my understanding correct that this is the only difference?

I have a follow up question after this being answered.

Thank you

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Thanmayi Godithi 10,490 Microsoft External Staff Moderator

Hi @Tan-9136,

Thank you for reaching out on Microsoft Q&A forum.

I understand your concern about the retirement of manually registered Azure VPN Clients for Point-to-Site (P2S). You’re right that the audience value is the key technical difference between manually registered and Microsoft-registered clients. To give you the full picture, here’s how they compare:

Key Differences

Audience Value
- Microsoft-registered: Uses a pre-approved App ID and audience value (c632b3df-fb67-4d84-bdcf-b95ad541b5c8) that’s automatically available in your Microsoft Entra tenant.
- Manually-registered: Requires you to manually register the Azure VPN Client app and use a different audience value (41b23e61-6c1e-4545-b367-cd054e0ed4b4).
Setup Complexity
- Microsoft-registered: No extra app registration or admin consent needed—setup is quicker and simpler.
- Manually-registered: Requires the Cloud Application Administrator role, manual registration, and explicit admin consent.
Platform Support
- Microsoft-registered: Works on Windows, macOS, and Linux.
- Manually-registered: Works on Windows and macOS; Linux requires custom audience values.
Security & Maintenance
- Microsoft-registered: Benefits from automatic updates and tighter integration with Microsoft Entra ID.
- Manually-registered: Needs ongoing maintenance and will be retired after March 31, 2028.

Recommended Next Steps:

If you’re still using manually registered VPN clients, Microsoft recommends migrating to the Microsoft-registered model. Doing this will make your setup easier to manage, keep it secure, and ensure you’re fully supported after the retirement date. You can follow this guide to migrate:

Migrate a manually registered Azure VPN Client to Microsoft-registered

We recommend completing this migration well before March 2028 to ensure a smooth transition without any connectivity issues.

Kindly let us know if the above helps or if you have any follow up questions.

Tan-9136 285 Reputation points

2025-08-20T15:41:56.65+00:00

Thank you @Thanmayi Godithi .
This is actually aligned with my follow up question.

According to this source:
https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-register-custom-app
Moving to a Microsoft-registered model could also be achieved by registering a VPN enterprise App that will use Microsoft-registered Azure VPN Client App ID (c632b3df-fb67-4d84-bdcf-b95ad541b5c8).

Is my understanding correct?
Thanmayi Godithi 10,490 Reputation points Microsoft External Staff Moderator

2025-08-20T19:35:09.1866667+00:00
Hi @Tan-9136,

Thank you for your follow-up. I understand you're asking whether migrating to the Microsoft-registered model can be achieved by registering a custom enterprise app that uses the Microsoft-registered Azure VPN Client App ID (c632b3df-fb67-4d84-bdcf-b95ad541b5c8).

Your understanding is correct.

You can register your own enterprise application in Microsoft Entra ID and configure it to use the Microsoft-registered Azure VPN Client App ID as the audience value.

This approach allows your organization to:

Maintain control over app assignments and access policies.

Benefit from the global admin consent already granted to the Microsoft-registered App ID.

Avoid the complexity of manually registering the Azure VPN Client app, which is scheduled for retirement on March 31, 2028.

Kindly let us know if the above helps or if you need further assistance.
Tan-9136 285 Reputation points

2025-08-20T20:25:16.8033333+00:00

Thank you very much @Thanmayi Godithi !
Hmm.. interesting that I don't see any "Accept Answer" button somehow but I did give a vote for your answer.
Thanmayi Godithi 10,490 Reputation points Microsoft External Staff Moderator

2025-08-21T00:27:31.28+00:00

Hi @Tan-9136,

Now you will be able to see "Accept the Answer" option. Could you please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Share via

Is this what it meant by retiring manually registered P2S Azure VPN client?

0 additional answers

Your answer