Configure Azure VPN Client - Microsoft Entra ID authentication - Windows

  • Article

This article helps you configure the Azure VPN Client on a Windows computer to connect to a virtual network using a VPN Gateway point-to-site (P2S) VPN and Microsoft Entra ID authentication. For more information about point-to-site connections, see About point-to-site connections. The Azure VPN Client is supported with Windows FIPS mode by using the KB4577063 hotfix.

Prerequisites

Configure your VPN gateway for point-to-site VPN connections that specify Microsoft Entra ID authentication. See Configure a P2S VPN gateway for Microsoft Entra ID authentication.

Workflow

This article continues on from the Configure a P2S VPN gateway for Microsoft Entra ID authentication steps. This article helps you:

  1. Download and install the Azure VPN Client for Windows.
  2. Extract the VPN client profile configuration files.
  3. Update the profile configuration files with a custom audience value (if applicable).
  4. Import the client profile settings to the VPN client.
  5. Create a connection and connect to Azure.

Download the Azure VPN Client

  1. Download the latest version of the Azure VPN Client install files using one of the following links:

  2. Install the Azure VPN Client to each computer.

  3. Verify that the Azure VPN Client has permission to run in the background. For steps, see Windows background apps.

  4. To verify the installed client version, open the Azure VPN Client. Go to the bottom of the client and click ... -> ? Help. In the right pane, you can see the client version number.

Extract client profile configuration files

To configure your Azure VPN Client profile, you must first download the VPN client profile configuration package from the Azure P2S gateway. This package is specific to the configured VPN gateway and contains the necessary settings to configure the VPN client. If you used the P2S server configuration steps as mentioned in the Prerequisites section, you've already generated and downloaded the VPN client profile configuration package that contains the VPN profile configuration files. If you need to generate configuration files, see Download the VPN client profile configuration package.

After you obtain the VPN client profile configuration package, extract the zip file. The zip file contains the AzureVPN folder. The AzureVPN folder contains the azurevpnconfig_aad.xml file or the azurevpnconfig.xml file, depending on whether your P2S configuration includes multiple authentication types. If you don't see azurevpnconfig_aad.xml or azurevpnconfig.xml, or you don't have an AzureVPN folder, verify that your VPN gateway is configured to use the OpenVPN tunnel type and that Azure Active Directory (Microsoft Entra ID) authentication is selected.

Modify profile configuration files

If your P2S configuration uses a custom audience and your registered app is associated with Manually-registered App ID, you might receive the error message AADSTS650057 when you try to connect. Entering your Entra ID credential in pop-up for the second time will resolve the issue. This happens because the VPN client profile needs both the custom audience ID and the Microsoft application ID. To prevent this, modify your profile configuration .xml file to include both the custom application ID and the Microsoft application ID.

Note

This step is necessary for P2S gateway configurations that use a custom audience value and your registered app is associated with the Manually-registered Azure VPN Client app ID. If this doesn't apply to your P2S gateway configuration, you can skip this step.

  1. To modify the Azure VPN Client configuration .xml file, open the file using a text editor such as Notepad.

  2. Next, add the value for applicationid and save your changes. The following example shows the application ID value for 49f817b6-84ae-4cc0-928c-73f27289b3aa.

    Example

    <aad>
   <audience>{customAudienceID}</audience>
   <issuer>https://sts.chinacloudapi.cn/{tenant ID value}/</issuer>
   <tenant>https://login.chinacloudapi.cn/{tenant ID value}/</tenant>
   <applicationid>49f817b6-84ae-4cc0-928c-73f27289b3aa</applicationid> 
</aad>

Import client profile configuration settings

Note

We're in the process of changing the Azure VPN Client fields for Azure Active Directory to Microsoft Entra ID. If you see Microsoft Entra ID fields referenced in this article, but don't yet see those values reflected in the client, select the comparable Azure Active Directory values.

  1. On the page, select Import.

    Screenshot that shows the Add button selected and the Import action highlighted in the lower left-side of the window.

  2. Browse to the Azure VPN Client profile configuration folder that you extracted. Open the AzureVPN folder and select the client profile configuration file (azurevpnconfig_aad.xml or azurevpnconfig.xml). Select Open to import the file.

  3. Change the name of the Connection name (optional).

    Screenshot shows Save the profile.

  4. Click Save to save the connection profile.

  5. In the left pane, select the connection profile that you want to use. Then click Connect to initiate the connection.

    Screenshot that shows the VPN and Connect button selected.

  6. Authenticate using your credentials, if prompted.

  7. Once connected, the icon turns green and shows Connected.

To connect automatically

These steps help you configure your connection to connect automatically with Always-on.

  1. On the home page for your VPN client, select VPN Settings. If you see the switch apps dialogue box, select Yes.

    Screenshot of the VPN home page with VPN Settings selected.

  2. If the profile that you want to configure is connected, disconnect the connection, then highlight the profile and select the Connect automatically check box.

    Screenshot of the Settings window, with the Connect automatically box checked.

  3. Select Connect to initiate the VPN connection.

Export and distribute a client profile

Once you have a working profile and need to distribute it to other users, you can export it using the following steps:

  1. Highlight the VPN client profile that you want to export, select the ..., then select Export.

    Screenshot that shows the Azure VPN Client page, with the ellipsis selected and Export highlighted.

  2. Select the location that you want to save this profile to, leave the file name as is, then select Save to save the xml file.

Delete a client profile

  1. Select the ellipses next to the client profile that you want to delete. Then, select Remove.

    Screenshot that shows the ellipses and Remove option selected.

  2. On the confirmation popup, select Remove to delete.

Diagnose connection issues

  1. To diagnose connection issues, you can use the Diagnose tool. Select the ... next to the VPN connection that you want to diagnose to reveal the menu. Then select Diagnose. On the Connection Properties page, select Run Diagnostics.

    Screenshot of the ellipsis and Diagnose selected.

  2. If asked, sign in with your credentials.

  3. View the results.

Optional client configuration settings

You can configure the Azure VPN Client with optional configuration settings such as additional DNS servers, custom DNS, forced tunneling, custom routes, and other settings. For more information, see Azure VPN Client - optional settings.

Azure VPN Client version information

For Azure VPN Client version information, see Azure VPN Client versions.

Next steps

About point-to-site connections.