How setup Azure VPN P2S for for dev/test/prod?

@Raghul Kannan

To set up separate P2S VPN connections for your Dev, Prod, and Stage environments, you can create multiple IP address pools for Azure Virtual WAN. This will allow you to assign different groups of users different pools of IP addresses, and then define rules on the integrated Azure Firewall to restrict users or groups based on their assigned P2S IP address pool. By dividing your P2S users into different groups based on network access requirements, you can differentiate them at the network level and ensure that they can access only a subset of the internal network.

To configure Microsoft Entra authentication for your VPN gateway, you can follow the steps outlined in the "Configure P2S for access based on users and groups - Microsoft Entra authentication" section of the Azure Virtual WAN documentation. You will need to sign in to the Azure portal as a user that is assigned the Global administrator role, grant admin consent for your organization, and then authorize the Azure VPN application.

References:

• Apply Zero Trust principles to an Azure Virtual WAN deployment - Step 6: Secure your P2S users
• Configure P2S for access based on users and groups - Microsoft Entra authentication

AI Note: This answer is generated using the Microsoft Q&A AI Assist.

@Raghul Kannan

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Can you please elaborate your architecture?

I assume that you are having 3 different VPN Gateways? (for each Dev, Prod and Stage)

• If so, as stated by @msrini-MSFT, you can create individual Root and Client certificates for the three VPN Gateways and distribute across users.
• The same can be achieved with Microsoft Entra - only a specific group of users will have access to a VPN Gateway based on users and groups
  • See : P2S for access based on users and groups

Please let me know in case you are having a single VPN Gateway for all the three environments.

Cheers,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

@Raghul Kannan

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil