Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Most of the VPN settings in Windows can be configured in VPN profiles using Microsoft Intune or Microsoft Configuration Manager. VPN settings can be configured using the ProfileXML node in the VPNv2 configuration service provider (CSP).
Note
If you're not familiar with CSPs, read Introduction to configuration service providers (CSPs) first.
The following table lists the VPN settings and whether the setting can be configured in Intune and Configuration Manager, or can only be configured using ProfileXML.
| Profile setting | Can be configured in Intune and Configuration Manager |
|---|---|
| Connection type | Yes |
| Routing: split-tunnel routes | Yes, except exclusion routes |
| Routing: forced-tunnel | Yes |
| Authentication (EAP) | Yes, if connection type is built in |
| Conditional access | Yes |
| Name resolution: NRPT | Yes |
| Name resolution: DNS suffix | No |
| Name resolution: persistent | No |
| Auto-trigger: app trigger | Yes |
| Auto-trigger: name trigger | Yes |
| Auto-trigger: Always On | Yes |
| Auto-trigger: trusted network detection | No |
| LockDown | No |
| Windows Information Protection (WIP) | Yes |
| Traffic filters | Yes |
| Proxy settings | Yes, by PAC/WPAD file or server and port |
Note
VPN proxy settings are only used on Force Tunnel Connections. On Split Tunnel Connections, the general proxy settings are used.
The ProfileXML node was added to the VPNv2 CSP to allow users to deploy VPN profile as a single blob. This node is useful for deploying profiles with features that aren't yet supported by MDMs. You can get more examples in the ProfileXML XSD article.
Sample Native VPN profile
The following sample is a sample Native VPN profile. This blob would fall under the ProfileXML node.
TestVpnProfile
testServer.VPN.com
IKEv2
Eap
25
0
0
0
25
true
d2 d3 8e ba 60 ca a1 c1 20 55 a2 e1 c8 3b 15 ad 45 01 10 c2
d1 76 97 cc 20 6e d2 6e 1a 51 f5 bb 96 e9 35 6d 6d 61 0b 74
true
false
13
true
true
d2 d3 8e ba 60 ca a1 c1 20 55 a2 e1 c8 3b 15 ad 45 01 10 c2
d1 76 97 cc 20 6e d2 6e 1a 51 f5 bb 96 e9 35 6d 6d 61 0b 74
false
true
false
AAD Conditional Access
1.3.6.1.4.1.311.87
AAD Conditional Access
false
true
true
false
SplitTunnel
true
192.168.0.0
24
10.10.0.0
16
Microsoft.MicrosoftEdge_8wekyb3d8bbwe
C:\windows\system32\ping.exe
%ProgramFiles%\Internet Explorer\iexplore.exe
6
10,20-50,100-200
20-50,100-200,300
30.30.0.0/16,10.10.10.10-20.20.20.20
ForceTunnel
Microsoft.MicrosoftEdge_8wekyb3d8bbwe
3.3.3.3/32,1.1.1.1-2.2.2.2
hrsite.corporate.contoso.com
1.2.3.4,5.6.7.8
5.5.5.5
true
.corp.contoso.com
10.10.10.10,20.20.20.20
100.100.100.100
corp.contoso.com
true
false
corp.contoso.com
contoso.com
HelloServer
Helloworld.Com
true
true
This is my Eku
This is my issuer hash
Sample plug-in VPN profile
The following sample is a sample plug-in VPN profile. This blob would fall under the ProfileXML node.
TestVpnProfile
testserver1.contoso.com;testserver2.contoso..com
JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy
<pulse-schema><isSingleSignOnCredential>true</isSingleSignOnCredential></pulse-schema>
192.168.0.0
24
10.10.0.0
16
Microsoft.MicrosoftEdge_8wekyb3d8bbwe
%ProgramFiles%\Internet Explorer\iexplore.exe
%ProgramFiles%\Internet Explorer\iexplore.exe
6
10,20-50,100-200
20-50,100-200,300
30.30.0.0/16,10.10.10.10-20.20.20.20
Microsoft.MicrosoftEdge_8wekyb3d8bbwe
3.3.3.3/32,1.1.1.1-2.2.2.2
Microsoft.MicrosoftEdge_8wekyb3d8bbwe
O:SYG:SYD:(A;;CC;;;AU)
corp.contoso.com
1.2.3.4,5.6.7.8
5.5.5.5
false
corp.contoso.com
10.10.10.10,20.20.20.20
100.100.100.100
true
false
corp.contoso.com
contoso.com,test.corp.contoso.com
HelloServer
Helloworld.Com
Apply ProfileXML using Intune
After you configure the settings that you want using ProfileXML, you can create a custom profile in the Microsoft Intune admin center. After it's created, you deploy this profile to your devices.
Sign in to the Microsoft Intune admin center.
Select Devices > Configuration profiles > Create profile.
Enter the following properties:
- Platform: Select Windows 10 and later
- Profile: Select Templates > Custom.
Select Create.
In Basics, enter the following properties:
- Name: Enter a descriptive name for the profile. Name your profiles so you can easily identify them later.
- Description: Enter a description for the profile. This setting is optional, but recommended.
Select Next.
In Configuration settings, enter the following properties:
- OMA-URI: Enter
./user/vendor/MSFT/VPNv2/Your_VPN profile name_/ProfileXML. - Data type: Select
String (XML file). - Value: Browse to, and select your XML file.
For more information on these settings, see Use custom settings for Windows devices in Intune.
- OMA-URI: Enter
Select Next, and continue configuring the policy. For the specific steps and recommendations, see Create a profile with custom settings in Intune.