Azure P2S VPN with Entra tenant configuration

Question

Azure P2S VPN with Entra tenant configuration

Alex 495

Hello,

How to use Azure RBAC with Azure P2S VPN configuration using Microsoft Entra tenant?

As far as I understand and configured, anybody (users/groups) who have access to that tenant will be able to use that VPN, right?

I believe we can control the access to that VPN resource through RBAC, but I am looking to control at the Tenant level, so that even if someone gets the VPN client configuration, they will not be able to authorize because they will not have access to that tenant.

Correct me if my understanding is wrong.

Thank you.

Accepted answer

0 additional answers

Your answer

Answer 1

KapilAnanth-MSFT 49,611 Microsoft Employee Moderator

@Alex

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Can you please specify what exactly you mean by "access".

In terms of accessing the VPN Gateway and in turn updating the P2S Configuration on the Azure Portal,

Yes, all users would be by default have access to the VPN Gateway for CRUD operations in the Azure Portal.
However, you can use RBAC to limit the permissions assigned to an user to control their access level for CRUD operations in the Azure Portal for VPN Gateway (or any Azure resource for that matter)
Assign Azure roles
Create or update Azure custom roles

In terms of connecting to the VPN Gateway for P2S (Data transfer) from a remote computer,

If you are using Azure AD Authentication for P2S, then yes, every user in the tenant will be able to authenticate and connect to the P2S by default.
You can also Configure P2S access based on users and groups, please refer here. (this is not RBAC)

To address your question, "even if someone gets the VPN client configuration, they will not be able to authorize because they will not have access to that tenant."

Yes
A malicious actor outside your tenant will not be able to authenticate and thus, will not be able to connect.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Alex 495 Reputation points

2023-12-11T07:33:44.04+00:00
@KapilAnanth-MSFT , thank you for the quick response. Below are my comments,

RBAC/CRUD restriction to the VPN gateway resource itself, is clear. No doubts on that.

VPN Gateway P2S configured with Azure AD authentication - I have successfully configured this, but as you said, all the users in that tenant by default can authenticate and connect to the VPN. I am looking to restrict that, something like an additional option in the below window to select the users/groups of that tenant who can authenticate to the P2S.
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-12-11T08:01:17.04+00:00
@Alex ,

Yes, we can do that.

When you follow the document : Configure P2S for access based on users and groups ,

Under the step, Assign users to applications

You will get the option to add the specified users who can have access.

You must do this under Enterprise applications and in the application you registered.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.
Alex 495 Reputation points

2023-12-11T11:20:32.3566667+00:00

Thanks @KapilAnanth-MSFT for the quick responses. I will verify and come back if any more questions.
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-12-11T13:01:04.6066667+00:00

@Alex

Sure, you are most welcome.

Cheers,

Kapil

Share via

Azure P2S VPN with Entra tenant configuration

0 additional answers

Your answer