How to Deploy VPN Profiles in Configuration Manager


Updated: May 14, 2015

Applies To: System Center 2012 Configuration Manager SP2, System Center 2012 R2 Configuration Manager, System Center 2012 R2 Configuration Manager SP1


The information in this topic applies only to System Center 2012 R2 Configuration Manager versions only.

VPN profiles in System Center 2012 Configuration Manager must be deployed to one or more collections before they can be used.

Use the Deploy VPN Profile dialog box to configure the deployment of VPN profiles. As part of the configuration, you define the collection to which the VPN profile is to be deployed and specify how often the VPN profile is evaluated for compliance.


If you deploy multiple company resource access profiles to the same user, the following behavior occurs:

  • If a conflicting setting contains an optional value, it will not be sent to the device.

  • If a conflicting setting contains a mandatory value, the default value will be sent to the device. If there is no default value, the entire company resource access profile will fail.


You can deploy VPN profiles to user collections or to user and device connections if you have installed the optional Windows Phone 8.1 extension. For information on how to install the extension, see Planning to Use Extensions in Configuration Manager.

When a VPN profile deployment is removed, the VPN profile is not removed from client devices. If you want to remove the profile from devices, you must manually remove it.

To deploy a VPN profile

  1. In the Configuration Manager console, click Assets and Compliance.

  2. In the Assets and Compliance workspace, expand Compliance Settings, expand Company Resource Access, and then click VPN Profiles.

  3. In the VPN Profiles list, select the VPN profile that you want to deploy, and then in the Home tab, in the Deployment group, click Deploy.

  4. In the Deploy VPN Profile dialog box, specify the following information:

    - **Collection** - Click **Browse** to select the collection where you want to deploy the VPN profile.
    - **Generate an alert** - Enable this option to configure an alert that is generated if the VPN profile compliance is less than a specified percentage by a specified date and time. You can also specify whether you want an alert to be sent to System Center Operations Manager.
    - **Specify the compliance evaluation schedule for this VPN profile** - Specify the schedule by which the deployed VPN profile is evaluated on client computers. The schedule can be either a simple or a custom schedule.
      <div class="alert">
      > [!NOTE]
      > <P>The profile is evaluated by client computers when the user logs on.</P>
  5. Click OK to close the Deploy VPN Profile dialog box and to create the deployment. For more information about how to monitor the deployment, see How to Monitor VPN Profiles in Configuration Manager.