Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,795 questions
Azure P2S VPN Not Prompting for Password on Subsequent Logins with Azure Entra ID Authentication
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(291.2, 21%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKM%3C/text%3E%3C/svg%3E)
krutibasa majhi
25
Reputation points
Hello everyone,
I am currently using Azure P2S VPN configured with Azure Entra ID authentication. After successfully connecting for the first time, I noticed that the VPN client does not prompt for my password on subsequent logins. Instead, it connects automatically without requiring any credentials.
However, I would like to ensure that the VPN prompts for my password every time I attempt to connect for added security.
Could anyone provide guidance on how to configure the VPN client or Azure AD settings to force a password prompt on subsequent logins? Additionally, are there any methods to clear cached tokens or credentials related to this?
Thanks
krutibasa
Azure VPN Gateway
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 59%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
ChaitanyaNaykodi-MSFT 27,481 Reputation points Microsoft Employee Moderator2025-01-03T20:50:17.64+00:00 Welcome to Microsoft Q&A.
I understand you wish to ensure that the VPN prompts for your password every time you attempt to connect.I think this can be done by setting cachesigninuser to false in client profile. You can change the <cachesigninuser>true</cachesigninuser> to <cachesigninuser>false</cachesigninuser> and then import the profile.Below is an example of where this can be done in client profile.
<type>aad</type> <aad> <issuer>https://sts.windows.net/xxxxxxxx/</issuer> <tenant>https://login.microsoftonline.com/xxxxxxx</tenant> <audience>xxxxxxxxxxxxxxxxxxxx</audience> <cachesigninuser>false</cachesigninuser> </aad> </clientauth>As alternate way I think you can also to use enabling Sign-in Frequency for Entra ID as described here.
Please let me know if the issue still persists. Thank you!
-
krutibasa majhi 25 Reputation points
2025-01-06T12:12:49.47+00:00 Hi @ChaitanyaNaykodi-MSFT Thank you for your response. I tried the caching option, but it does not work. what could be the reason its related to the client file or Entra ID ?
-
krutibasa majhi 25 Reputation points
2025-01-06T12:16:09.82+00:00 Hi @ChaitanyaNaykodi-MSFT Thank you for the response. I tried the caching option, but it does not work.
-
ChaitanyaNaykodi-MSFT 27,481 Reputation points Microsoft Employee Moderator
2025-01-15T19:32:03.5033333+00:00 @krutibasa majhi Thank you for getting back and apologies for the delay here.
Can you please if you have configured MFA for your VPN connection here?
https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-mfaAlso, if you tried the Configure adaptive session lifetime policies approach, I had mentioned above.
Thanks!
Sign in to comment
Sign in to answer