Issue with Azure VPN Client app in my tenant

Question

Hi,

I'm unable to add the Azure VPN Client in my tenant. Initially the Azure VPN Client app is not present in Enterprise application, and I tried to add but I'm unable to do it. I don't know where I'm going wrong. Can someone guide me how to add the Azure VPN Client app to my tenant, also can I access the peered vnet with my configured point to site? for example: I have deployed a vnet A with vpn gateway and I have configured a vnet peering it with vnet B, so can I access vnet B with my configured point to site? If yes, please guide me how to achieve it?

Answer 1

Hi @Kiransuryavamshi-1246,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

Can someone guide me how to add the Azure VPN Client app to my tenant?

If you are trying to configure Azure P2S VPN gateway for Microsoft Entra ID authentication, then you need to follow the below documentation:

https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant

1. Sign in to the Azure portal as a user that is assigned the Global administrator role.
2. Next, grant admin consent for your organization. This allows the Azure VPN application to sign in and read user profiles. Copy and paste the URL that pertains to your deployment location in the address bar of your browser: For Public: https://login.microsoftonline.com/common/oauth2/authorize?client_id=41b23e61-6c1e-4545-b367-cd054e0ed4b4&response_type=code&redirect_uri=https://portal.azure.com&nonce=1234&prompt=admin_consent
3. Select the account that has the Global administrator role if prompted.
4. On the Permissions requested page, select Accept.
5. Go to Microsoft Entra ID. In the left pane, click Enterprise applications. You'll see Azure VPN listed.

As per the above doc, you need to sign in to the Azure portal as a user that is assigned the Global administrator role. If you are using a global admin account that is not native to the Azure AD tenant to provide consent, please replace “common” with the Azure AD directory id in the URL (https://login.microsoftonline.com/common/oauth2/authorize?client_id=41b23e61-6c1e-4545-b367-cd054e0ed4b4&response_type=code&redirect_uri=https://portal.azure.com&nonce=1234&prompt=admin_consent). You may also have to replace “common” with your directory id in certain other cases as well.

The Directory ID of the directory that you want to use for authentication is listed in the properties section of the Active Directory page.

Please refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant#enable-authentication

NOTE:

• Native member to Azure AD tenant is a member user or Azure AD member whose account is created via Azure AD > Users > Create user option in the tenant.
• A user not native to the Azure AD tenant means a user who is brought over from another directory as a business-to-business (B2B) collaboration guest (guest user).

To answer your 2nd question,

Yes, it is possible. For a point-to-site client to have access to a peered VNet, the peered VNet (the VNet without the gateway) must be configured with the Use remote gateways attribute.

The VNet with the VPN gateway must be configured with Allow gateway transit.

Reference: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#can-i-configure-a-point-to-site-client-to-connect-to-multiple-virtual-networks-at-the-same-time

Hope this clarifies!

If above is unclear and/or you are unsure about something add a comment below.

Please don’t forget to close the thread by clicking "Accept answer" if the information provided helps you, as this can be beneficial to other community members.

Thanks,

Sai.