メインコンテンツへスキップ

063: VPN

Implementation Effort: Medium to High

User Impact: Medium

Overview​

VPN profiles in Microsoft Intune allow organizations to configure secure network access for managed devices. For Zero Trust, the goal should not be to put every mobile workload behind a full-tunnel VPN by default. Instead, use VPN only where specific applications or internal resources still require it, and combine it with strong identity, device compliance, and certificate-based trust where possible.

Modern designs often prefer per-app VPN or on-demand VPN over broad always-on tunnels for mobile devices.

Implementation Guidance​

  1. Identify which apps or resources still require VPN access and whether those dependencies can be reduced over time.
  2. Choose the VPN type supported by your gateway and target platform, then confirm whether the design should be per-app, on-demand, or broader user/device-initiated VPN.
  3. Decide how users or devices authenticate: certificate-based auth, username/password with MFA-backed sign-in, or another supported method.
  4. In Intune, create the VPN profile for the correct platform and assign required certificates or trusted roots before the VPN policy is enforced.
  5. Pilot with real workflows such as internal web access, file shares, or legacy line-of-business services. Validate both performance and user prompts.
  6. Avoid sending all traffic through VPN unless there is a strong regulatory or technical reason. Overuse of full-tunnel VPN can undermine user experience and encourage bypass behavior.

Reference​