Azure VPN server not available on GCC High

Question

Azure VPN server not available on GCC High

Christopher Harris 0

I need assistance provisioning the Azure VPN Server application in my Azure Government (GCC High) tenant. This application is required for enabling Azure VPN Gateway authentication using Entra ID.

In GCC High, the Azure VPN Server application does not exist by default, and the platform does not allow creating an App Registration with the required fixed App ID. Attempts to create the app manually fail because the appId property is read‑only in Azure Government and cannot be overridden.

Please provision the following service principal in my tenant:

Application Name: Azure VPN Server
Sign-in audience: AzureADMyOrg
Required for: Azure VPN Gateway AAD authentication in Azure Government

This is a standard request for GCC High tenants where the Azure VPN Server app is missing. Once provisioned, I will complete the API permission assignment and gateway configuration.

Christopher Harris 0 Reputation points

2026-02-25T14:16:37.3066667+00:00

where, who or what can I do to resolve this issue?
Venkatesan S 4,735 Reputation points Microsoft External Staff Moderator

2026-02-25T15:36:47.25+00:00
Hi Christopher Harris,

Thanks for reaching out in Microsoft Q&A forum,

In Azure Government GCC High environments, the Azure VPN Server application must be provisioned manually as a service principal since it is not pre-available, and the portal restricts overriding the read-only appId during custom registrations. This step is essential for enabling Entra ID authentication on Point-to-Site VPN Gateways, a common requirement in compliant GCC High tenants.

Key Provisioning Steps:

Sign into the Azure Government portal (portal.azure.us) with Cloud Application Administrator or Application Administrator privileges.

Navigate to Microsoft Entra ID > Enterprise applications > New application, search for "Azure VPN Server," or create custom with Name: "Azure VPN Server," Sign-in audience: "AzureADMyOrg."

If portal creation fails due to appId restrictions, use Microsoft Graph PowerShell:
Connect-MgGraph -Environment USGov New-MgServicePrincipal -AppId "******" -DisplayName "Azure VPN Server"

After provisioning, configure API permissions (e.g., Microsoft Graph: User.Read, Directory.Read.All) under the enterprise app and grant admin consent. Then, in your VPN Gateway's P2S configuration, select Entra ID authentication and set the Audience to the specified App ID.

Official Documentation:

Configure P2S VPN gateway for Microsoft Entra ID authentication

Kindly let us know if the above helps or you need further assistance on this issue.

Please “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Christopher Harris 0 Reputation points

2026-02-25T19:38:00.6533333+00:00

The Azure VPN Server app is missing in GCC High, and cannot be created manually because the AppId is read‑only and cannot be overridden. so your suggestion does not fix my problem i ran your command with no success. Only Microsoft Support can fix it by injecting the Azure VPN Server application into the GCC High tenant. please do so ASAP
Christopher Harris 0 Reputation points

2026-02-25T19:38:39.2966667+00:00

Only Microsoft Support can fix it by injecting the Azure VPN Server application into GCC High tenant.
Venkatesan S 4,735 Reputation points Microsoft External Staff Moderator

2026-02-26T02:17:13.0766667+00:00

Hi Christopher Harris,

We are checking with internal and will get back to you as soon as possible.