跳到主要內容

078: Tunnel based VPN access for enrolled devices

Implementation Effort: High
User Impact: Medium

Overview​

For enrolled devices, Microsoft Tunnel can provide secure access from Intune-managed mobile devices to private applications and services. This is most commonly used for Android Enterprise and iOS/iPadOS scenarios where specific work apps need a trusted path to internal APIs, intranet services, or line-of-business endpoints. For Zero Trust, the important design decision is not just 'turn on VPN' but 'which traffic, from which apps, on which compliant devices, for which users.' Enrolled-device deployments should prefer narrowly scoped access, strong identity, and conditional access checks over broad network exposure.

Implementation Guidance​

  1. Ensure devices are properly enrolled, licensed, and receiving baseline compliance, configuration, and app policies before layering Tunnel access on top.
  2. Define whether the scenario should use per-app VPN or device-wide VPN. Per-app VPN is usually the better Zero Trust default because it limits exposure to approved work apps.
  3. Deploy the client and VPN profile together, including routes, DNS behavior, authentication method, and any per-app associations for Microsoft Edge, Teams, or line-of-business apps.
  4. If the app relies on certificates, deploy trusted root, intermediate, and client certificate profiles first and validate renewal behavior.
  5. Require device compliance and strong user authentication for access to the target applications, and validate failure behavior when a device falls out of compliance.
  6. Monitor gateway health, connection success rates, battery impact, and app-specific routing behavior during pilot and early production rollout.

Reference​