メインコンテンツへスキップ

091: VPN

Implementation Effort: Medium
User Impact: Medium

Overview​

VPN profiles in Microsoft Intune let managed devices securely connect to private business resources when those resources are not directly exposed to the internet. Typical scenarios include access to internal APIs, intranet sites, certificate-backed web services, or other private dependencies used by line-of-business apps. In a Zero Trust design, VPN should be narrowly scoped and paired with strong identity and device trust. Avoid using VPN as a blanket proxy for all activity unless a specific business requirement justifies that overhead.

Implementation Guidance​

  1. Choose the access model first: Microsoft Tunnel, a supported third-party VPN client, or a platform-native VPN profile that matches your existing network architecture.
  2. Decide whether the requirement is per-app VPN, on-demand VPN, or Always On VPN. Per-app access is often the best default for mobile Zero Trust scenarios.
  3. Document routes, DNS behavior, split-tunnel versus full-tunnel decisions, proxy needs, and certificate or authentication dependencies before creating the profile.
  4. Create the VPN profile in the Microsoft Intune admin center, assign it to the right device groups, and if needed map it to the approved apps that should trigger it.
  5. Require compliant devices and appropriate user authentication before granting access to the underlying applications or network paths.
  6. Pilot under real conditions such as roaming, low bandwidth, sign-in expiry, certificate renewal, and client app updates.

Reference​