2.2 Point-to-Site (P2S) VPN Connectivity
📘Microsoft Azure Networking Solutions (AZ-700)
A Point-to-Site (P2S) VPN allows individual clients (like a laptop or workstation) to securely connect to an Azure Virtual Network (VNet) over the internet. Unlike Site-to-Site VPNs which connect entire networks, P2S is user-based.
One of the key decisions when setting up a P2S VPN is how to authenticate users—in other words, how Azure confirms that the person or device trying to connect is allowed to access the network.
1. Available Authentication Methods for P2S VPN
Azure supports three main authentication methods for P2S VPNs:
A. Azure Certificate Authentication (Self-Signed or CA-Signed Certificates)
How it works:
- You create a root certificate and then generate client certificates from it.
- Each client device gets a unique client certificate installed.
- When connecting, the VPN checks the client certificate against the root certificate to allow access.
Key Points:
- Simple to set up for small-scale deployments (few clients).
- Does not require Azure Active Directory (AAD).
- Certificates can be self-signed (you create them yourself) or issued by a certificate authority (CA).
- Suitable for IT devices you manage directly, like company laptops.
Exam Tip:
- Know that client certificates are validated against the trusted root certificate uploaded to Azure VPN Gateway.
- Certificate authentication does not support Azure AD conditional access policies.
B. Azure Active Directory (Azure AD) Authentication
How it works:
- Users authenticate with their Azure AD credentials (username/password or multi-factor authentication).
- VPN integration with Azure AD allows identity-based access.
Key Points:
- Scales well for large organizations with many users.
- Supports Multi-Factor Authentication (MFA), conditional access, and security monitoring.
- No need to manage certificates for each client device.
- Requires that the client OS and VPN client support Azure AD authentication (Windows 10+, macOS, certain VPN clients).
IT Environment Example:
- Employees logging in with their Azure AD account can connect to the VPN securely, and MFA can be enforced to prevent unauthorized access.
Exam Tip:
- Azure AD authentication is required when you need centralized identity control, MFA, or conditional access.
- Works only with IKEv2 or OpenVPN protocols.
C. RADIUS Authentication (via a Network Policy Server)
How it works:
- Azure VPN Gateway communicates with a RADIUS server to authenticate users.
- Users enter their credentials (username/password) and the RADIUS server validates them against Active Directory (on-prem or in the cloud).
Key Points:
- Useful for organizations that already use RADIUS for VPN or Wi-Fi authentication.
- Supports existing security policies and multi-factor solutions integrated with RADIUS.
- Can be combined with certificate authentication for stronger security (certificate + RADIUS).
Exam Tip:
- Remember: RADIUS requires extra infrastructure, such as a Network Policy Server (NPS).
- P2S clients can use SSTP, IKEv2, or OpenVPN protocols depending on setup.
2. Factors to Consider When Choosing an Authentication Method
When selecting the best authentication method for a P2S VPN, consider the following:
| Factor | Certificate Authentication | Azure AD Authentication | RADIUS Authentication |
|---|---|---|---|
| Scale | Small | Medium to Large | Medium to Large |
| User Management | Manual (client certificates) | Centralized (AAD users) | Centralized via RADIUS |
| MFA / Conditional Access | No | Yes | Possible via RADIUS integration |
| Complexity | Simple | Moderate | Complex (requires RADIUS infrastructure) |
| Protocol Support | SSTP, IKEv2, OpenVPN | IKEv2, OpenVPN | SSTP, IKEv2, OpenVPN |
Quick Rule of Thumb for Exams:
- Small number of clients: Certificates are fine.
- Enterprise with Azure AD: Use Azure AD.
- Existing on-premises AD with RADIUS: Use RADIUS.
3. Exam-Focused Summary
- Azure P2S VPN supports three authentication types:
- Certificate-based
- Azure AD-based
- RADIUS-based
- Certificate authentication: Good for small deployments, simple but manual.
- Azure AD authentication: Centralized, secure, scalable, supports MFA/conditional access.
- RADIUS authentication: Integrates with on-prem AD, supports existing policies, requires extra setup.
- Selection depends on:
- Number of users
- Security requirements (MFA, conditional access)
- Existing infrastructure (Azure AD, RADIUS)
💡 Tip for remembering on exams:
Think of it as “Scale + Security + Infrastructure”:
- Small + simple → Certificate
- Medium/Large + cloud-native → Azure AD
- Medium/Large + on-premises AD → RADIUS
