メインコンテンツへスキップ

110: Tunnel based VPN access for enrolled devices

Implementation Effort: High
User Impact: Medium

Overview​

Tunnel-based access for enrolled mobile devices should provide private-resource connectivity without giving every device unrestricted network reach. In a Zero Trust design, the preferred pattern is usually per-app or tightly scoped private access, integrated with Microsoft Intune compliance and Microsoft Entra Conditional Access, so only trusted users on healthy devices can reach the specific services they need.

Implementation Guidance​

  1. Define the access target before choosing the tunnel design. Some apps need full network reachability, but many only require access to a small number of internal APIs, web apps, or name spaces.
  2. Use the current Microsoft architecture where possible, such as Microsoft Tunnel for mobile application management or another supported Intune VPN profile approach. Avoid broad always-on tunnels unless the business requirement truly needs them.
  3. Plan certificate authentication, DNS, split-tunnel behavior, and gateway placement. The most common operational failures are name resolution, certificate lifecycle gaps, and routes that are broader than intended.
  4. Assign tunnel access only to enrolled devices that also meet compliance requirements. Pair the design with Conditional Access so a risky or noncompliant device loses access automatically.
  5. Pilot with the real apps that depend on the tunnel and measure reconnect behavior, battery impact, captive portal handling, and supportability off the corporate network.
  6. Document emergency troubleshooting steps for gateway outage, expired certificates, and app-specific exceptions.

Reference​