Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,796 questions
Microsoft Azure VPN to connect to SharePoint
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(230.39999999999998, 66%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDA%3C/text%3E%3C/svg%3E)
David Arshakyan
0
Reputation points
Hi everyone,
I need to set up a VPN to provide some employees access to SharePoint only through this VPN. The VPN should work as a default gateway since this is the only way to create a Conditional Access Policy and give an encrypted channel from the employee's PC to SharePoint. I tried to set up Azure VPN P2S Gateway but it only provides routes to the Azure local subnets. Is there any way to create a VPN service that matches our needs? Thanks in advance.
Azure VPN Gateway
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(192, 15%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPB%3C/text%3E%3C/svg%3E)
Praveen Bandaru 5,520 Reputation points Microsoft External Staff Moderator2025-02-21T11:54:58.25+00:00 Hello David Arshakyan
Greetings!
To restrict SharePoint access through a VPN, you can use Azure VPN with a Conditional Access Policy to limit access to specific IP ranges.You can try using Conditional access policy where you can allow Azure VPN IP range for access only. You can refer below URL: -
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition
https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-mfa
Additionally, you might explore third-party VPN solutions that offer a default gateway and meet your secure access needs for SharePoint.
Kindly check the reference documents:
https://learn.microsoft.com/en-us/answers/questions/119632/sharepoint-online-via-vpn
Hope the above answer helps! Please let us know do you have any further queries.
Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
-
David Arshakyan 0 Reputation points
2025-02-21T15:52:34.7533333+00:00 Hello @praveen Bandaru
Thank you for your instant reply. I have already set up Azure VPN Gateway (P2S). However, it provides me only local routes and as I understand I can't create a Conditional Access policy based on private IP ranges. I have read all documentation regarding VPN Gateway and Conditional Access and didn't find any method to use the VPN as a default gateway or create a Conditional Access policy based on private IP ranges. When I check the "Sign-in logs", I see that my user is connected to Azure services by my ISP's public IP address, while I am connected to the Azure VPN.
-
Praveen Bandaru 5,520 Reputation points Microsoft External Staff Moderator
2025-02-24T16:56:44.26+00:00 Hello David Arshakyan
Greetings!
By default, split tunneling is enabled on the P2S VPN clients.
This means public traffic will use the ISP IP, and only private traffic will go to the VPN gateway.
Could you please let me know if the SharePoint server and VPN gateway are both in the same VNET or in different VNETs?
Setting up a VPN to restrict employee access to SharePoint only
- Configure VPN Gateway with Forced Tunneling
• Set up Point-to-Site (P2S) VPN.
• Enable Forced Tunneling with the default route (0.0.0.0/0).
Docs: https://learn.microsoft.com/en-us/azure/vpn-gateway/about-site-to-site-tunneling
- Restrict Traffic to SharePoint Online
• Deploy Azure Firewall or use Network Security Groups (NSGs).
• Allow outbound traffic only to SharePoint’s IP ranges and URLs.
Docs: https://learn.microsoft.com/en-us/azure/firewall/protect-office-365
- Configure Conditional Access in Azure AD
• Set up a Conditional Access policy to restrict SharePoint access to VPN users only.
Docs: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network
- Get SharePoint Online IP ranges and URLs
• Ensure your firewall and Conditional Access policies use Microsoft’s official SharePoint Online endpoints.
Hope the above answer helps! Please let us know do you have any further queries.
Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
-
Praveen Bandaru 5,520 Reputation points Microsoft External Staff Moderator
2025-02-25T10:09:06.4033333+00:00 Hello David Arshakyan
Greetings!
Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.
Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.
-
Praveen Bandaru 5,520 Reputation points Microsoft External Staff Moderator
2025-02-26T13:19:08.0633333+00:00 Hello David Arshakyan
Greetings!
Following up to see if the above suggestion was helpful. Additionally, please note that Azure VPN is only used for connecting VNETs and connected resources, not for M365 services.
Azure VPN does not support connections to M365 services.
Hope the above answer helps! Please let us know do you have any further queries.
Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
-
David Arshakyan 0 Reputation points
2025-02-27T08:55:36.8866667+00:00 We use Microsoft Azure SharePoint Online. I need to set up a P2S Azure VPN Gateway and create a Conditional Access Policy to restrict some users from connecting to SharePoint Online only through this VPN. For this purpose, I need to go to the Internet with this VPN, since Conditional Access Policy only works for Public IP addresses. Which solution will you suggest for this purpose? If I am right Azure VPN Gateway doesn't provide a default gateway to users. I tried to create a NAT Gateway also but I couldn't connect the NAT Gateway to the P2S VPN Gateway clients' IP range. Thank you for the detailed answers but I tried many ways without any result.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 82%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVV%3C/text%3E%3C/svg%3E)
Venkat V 2,545 Reputation points Microsoft External Staff Moderator2025-03-03T13:24:04.95+00:00 Hi @David Arshakyan
To enforce conditional access for SharePoint Online via VPN, you can use Azure Firewall with Forced Tunneling. When P2S VPN clients connect to the Azure VPN Gateway, all their traffic is routed through the Azure firewall instead of going directly to the internet.
The Azure Firewall NATs outbound traffic using a fixed public IP, ensuring that all requests to SharePoint Online originate from a controlled address. A conditional access policy is then configured to allow access only from this public IP, ensuring that users can access SharePoint only through the VPN. This setup enhances security and compliance by restricting access based on a trusted network path.
Reference: Azure Firewall forced tunneling
-
Venkat V 2,545 Reputation points Microsoft External Staff Moderator
2025-03-04T15:44:37.52+00:00 Hi @David Arshakyan
I just wanted to follow up and see if you had a chance to review my response in the comment to your question.
Please let us know if it was helpful, and feel free to reach out if you have any further queries.
Sign in to comment
Sign in to answer