Configure Azure P2S VPN Gateway with Microsoft Entra Authentication

Prerequisites

1. Azure Subscription: Ensure you have an active Azure subscription.
2. Azure AD Directory: You must have an Azure AD directory.
3. User Permissions: Ensure you have permissions to create and manage resources in the Azure portal.

Step-by-Step Guide

Step 1: Create and Configure the Virtual Network Gateway

1. Create a Virtual Network:
   • Navigate to Create a resource > Networking > Virtual network.
   • Configure basic settings:
     • Name: Enter a name for your virtual network.
     • Region: Select the region where you want to deploy the VNet.
     • Address space: Specify the address space (e.g., 10.1.0.0/16).
     • Subnet: Create a subnet for the gateway (e.g., “GatewaySubnet”).
   • Click Review + create.
2. Create a Virtual Network Gateway:
   • Navigate to Create a resource > Networking > Virtual network gateway.
   • Configure the gateway:
     • Name: Enter a name for your gateway.
     • Region: Select the same region as your VNet.
     • Gateway type: Select VPN.
     • VPN type: Select Route-based.
     • SKU: Select the appropriate SKU for your needs.
     • Virtual network: Select the virtual network created earlier.
     • Public IP address: Create a new public IP address.
   • Click Review + create.

Step 2: Configure Point-to-Site VPN

1. Configure Point-to-Site Settings:
   • Navigate to the Virtual Network Gateway created.
   • Select Point-to-site configuration.
   • Configure the following settings:
     • Address pool: Define an IP address range for VPN clients (e.g., 172.16.0.0/24).
     • Tunnel type: Select OpenVPN.
     • Authentication type: Select Azure Active Directory.
     • Azure Active Directory:
       • AAD tenant: https://login.microsoftonline.com/{Microsoft ID Entra Tenant ID}
       • Issuer: https://sts.windows.net/{Microsoft ID Entra Tenant ID}/
       • Audience: c632b3df-fb67-4d84-bdcf-b95ad541b5c8
   • Click Save.

Step 3: Configure the VPN Client

1. Generate VPN Client Configuration:
   • In the Virtual Network Gateway, navigate to Point-to-site configuration.
   • Click Download VPN client.
   • Save and extract the VPN client configuration file.
2. Install and Configure VPN Client:
   • Download & install the VPN client on your local machine.
   • Import the VPN client configuration file.
3. Connect to the VPN:
   • Open the VPN client software.
   • Select the configuration and connect.
   • Authenticate using your Azure AD credentials when prompted.

Step 4: Verify Connectivity

1. Check IP Address:
   • Once connected, verify that your IP address falls within the VPN address pool.
2. Ping Virtual Network Resources:
   • Try to access resources within your virtual network to confirm connectivity.

Summary

By following this guide, you have set up a Point-to-Site VPN using Microsoft Entra authentication and a Microsoft-managed app. This setup enhances security by leveraging Azure AD for authentication, ensuring that only authorized users can access your virtual network.