Skip to main content

077: VPN tunnel

Implementation Effort: High
User Impact: Medium

Overview​

Microsoft Tunnel is Microsoft Intune's mobile VPN solution for secure access from supported iOS/iPadOS and Android Enterprise devices to private applications and resources. It is designed for modern mobile access patterns, including per-app VPN and Always On VPN scenarios, without requiring a traditional full-device VPN design for every use case. In a Zero Trust architecture, Microsoft Tunnel is most useful when access to a private web app, API, or internal dependency should be limited to authenticated users on managed devices that meet compliance requirements. It should be combined with identity controls, device compliance, and least-privilege network access rather than treated as a stand-alone trust boundary.

Implementation Guidance​

  1. Plan the gateway architecture first: Linux host placement, certificates, DNS, outbound internet requirements, firewall rules, logging, and high availability across at least two servers or sites for production use.
  2. Create the Microsoft Tunnel server configuration and site objects in the Microsoft Intune admin center, then register and validate each Linux gateway according to Microsoft guidance.
  3. Deploy the supported Tunnel client experience for each platform documented by Microsoft. In many current mobile scenarios, Microsoft Defender for Endpoint participates in the Tunnel experience, but the exact client pattern should be verified per platform and scenario.
  4. Create VPN profiles with clear decisions on split tunneling, DNS suffixes, internal routes, per-app associations, and whether the requirement is on-demand, per-app, or Always On.
  5. Use Conditional Access and Intune compliance so only approved users on healthy devices can establish the secure path to private resources.
  6. Run pilot validation for sign-in, tunnel establishment time, battery impact, certificate renewal, and failure handling when the gateway or client is unavailable.

Reference​