Configure a VPN client for P2S OpenVPN protocol connections: Microsoft Entra authentication
This article helps you configure a VPN client to connect using point-to-site VPN and Microsoft Entra authentication. Before you can connect and authenticate using Microsoft Entra ID, you must first configure your Microsoft Entra tenant. For more information, see Configure a Microsoft Entra tenant.
Microsoft Entra authentication is supported only for OpenVPN® protocol connections.
Working with client profiles
For every computer that wants to connect to the VNet via the VPN client, you need to download the Azure VPN Client for the computer, and also configure a VPN client profile. If you want to configure multiple computers, you can create a client profile on one computer, export it, and then import it to other computers.
To download the Azure VPN client
Download the latest version of the Azure VPN Client install files using one of the following links:
Install the Azure VPN Client to each computer.
Verify that the Azure VPN Client has permission to run in the background. For steps, see Windows background apps.
To verify the installed client version, open the Azure VPN Client. Go to the bottom of the client and click ... -> ? Help. In the right pane, you can see the client version number.
To create a certificate-based client profile
When working with a certificate-based profile, make sure that the appropriate certificates are installed on the client computer. You can install and specify more than one certificate when using the Azure VPN client version 2.1963.44.0 or higher. For more information about certificates, see Install client certificates.
To create a RADIUS client profile
The Server Secret can be exported in the P2S VPN client profile. To export a client profile, see User VPN client profiles.
To export and distribute a client profile
Once you have a working profile and need to distribute it to other users, you can export it using the following steps:
Highlight the VPN client profile that you want to export, select the ..., then select Export.
Select the location that you want to save this profile to, leave the file name as is, then select Save to save the xml file.
To import a client profile
On the page, select Import.
Browse to the profile xml file and select it. With the file selected, select Open.
Specify the name of the profile and select Save.
Select Connect to connect to the VPN.
Once connected, the icon will turn green and say Connected.
To delete a client profile
Select the ellipses next to the client profile that you want to delete. Then, select Remove.
Select Remove to delete.
Create a connection
On the page, select +, then + Add.
Fill out the connection information. If you are unsure of the values, contact your administrator. After filling out the values, select Save.
Select Connect to connect to the VPN.
Select the proper credentials, then select Continue.
Once successfully connected, the icon will turn green and say Connected.
To connect automatically
These steps help you configure your connection to connect automatically with Always-on.
On the home page for your VPN client, select VPN Settings.
Select Yes on the switch apps dialogue box.
Make sure the connection that you want to set is not already connected, then highlight the profile and check the Connect automatically check box.
Select Connect to initiate the VPN connection.
Diagnose connection issues
To diagnose connection issues, you can use the Diagnose tool. Select the ... next to the VPN connection that you want to diagnose to reveal the menu. Then select Diagnose.
On the Connection Properties page, select Run Diagnosis.
Sign in with your credentials.
View the diagnosis results.
Optional client settings
You can configure optional settings for the Azure VPN Client, such as forced tunneling, exclude routes, DNS, and certificate authentication settings. For steps, see Configure Azure VPN Client optional settings.
For more information, see Create a Microsoft Entra tenant for P2S Open VPN connections that use Microsoft Entra authentication.