Microsoft Azure VPN to connect to SharePoint

David Arshakyan 0

Hi everyone,

I need to set up a VPN to provide some employees access to SharePoint only through this VPN. The VPN should work as a default gateway since this is the only way to create a Conditional Access Policy and give an encrypted channel from the employee's PC to SharePoint. I tried to set up Azure VPN P2S Gateway but it only provides routes to the Azure local subnets. Is there any way to create a VPN service that matches our needs? Thanks in advance.

Praveen Bandaru 690 Reputation points Microsoft Vendor

2025-02-21T11:54:58.25+00:00

Hello David Arshakyan

Greetings!
To restrict SharePoint access through a VPN, you can use Azure VPN with a Conditional Access Policy to limit access to specific IP ranges.

You can try using Conditional access policy where you can allow Azure VPN IP range for access only. You can refer below URL: -

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-mfa

Additionally, you might explore third-party VPN solutions that offer a default gateway and meet your secure access needs for SharePoint.

Kindly check the reference documents:

https://learn.microsoft.com/en-us/answers/questions/119632/sharepoint-online-via-vpn

https://learn.microsoft.com/en-us/answers/questions/69931/i-want-to-enable-access-to-sharepoint-online-only?page=1#answer-69952

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
David Arshakyan 0 Reputation points

2025-02-21T15:52:34.7533333+00:00

Hello @praveen Bandaru

Thank you for your instant reply. I have already set up Azure VPN Gateway (P2S). However, it provides me only local routes and as I understand I can't create a Conditional Access policy based on private IP ranges. I have read all documentation regarding VPN Gateway and Conditional Access and didn't find any method to use the VPN as a default gateway or create a Conditional Access policy based on private IP ranges. When I check the "Sign-in logs", I see that my user is connected to Azure services by my ISP's public IP address, while I am connected to the Azure VPN.
Praveen Bandaru 690 Reputation points Microsoft Vendor

2025-02-24T16:56:44.26+00:00
Hello David Arshakyan

Greetings!

By default, split tunneling is enabled on the P2S VPN clients.

This means public traffic will use the ISP IP, and only private traffic will go to the VPN gateway.

Could you please let me know if the SharePoint server and VPN gateway are both in the same VNET or in different VNETs?

Setting up a VPN to restrict employee access to SharePoint only

Configure VPN Gateway with Forced Tunneling

• Set up Point-to-Site (P2S) VPN.

• Enable Forced Tunneling with the default route (0.0.0.0/0).

Docs: https://learn.microsoft.com/en-us/azure/vpn-gateway/about-site-to-site-tunneling

Restrict Traffic to SharePoint Online

• Deploy Azure Firewall or use Network Security Groups (NSGs).

• Allow outbound traffic only to SharePoint’s IP ranges and URLs.

Docs: https://learn.microsoft.com/en-us/azure/firewall/protect-office-365

Configure Conditional Access in Azure AD

• Set up a Conditional Access policy to restrict SharePoint access to VPN users only.

Docs: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network

Get SharePoint Online IP ranges and URLs

• Ensure your firewall and Conditional Access policies use Microsoft’s official SharePoint Online endpoints.

Docs: https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Praveen Bandaru 690 Reputation points Microsoft Vendor

2025-02-25T10:09:06.4033333+00:00

Hello David Arshakyan

Greetings!

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.
Praveen Bandaru 690 Reputation points Microsoft Vendor

2025-02-26T13:19:08.0633333+00:00

Hello David Arshakyan

Greetings!

Following up to see if the above suggestion was helpful. Additionally, please note that Azure VPN is only used for connecting VNETs and connected resources, not for M365 services.

Azure VPN does not support connections to M365 services.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
David Arshakyan 0 Reputation points

2025-02-27T08:55:36.8866667+00:00

Hi @Praveen Bandaru

We use Microsoft Azure SharePoint Online. I need to set up a P2S Azure VPN Gateway and create a Conditional Access Policy to restrict some users from connecting to SharePoint Online only through this VPN. For this purpose, I need to go to the Internet with this VPN, since Conditional Access Policy only works for Public IP addresses. Which solution will you suggest for this purpose? If I am right Azure VPN Gateway doesn't provide a default gateway to users. I tried to create a NAT Gateway also but I couldn't connect the NAT Gateway to the P2S VPN Gateway clients' IP range. Thank you for the detailed answers but I tried many ways without any result.

Share via

Microsoft Azure VPN to connect to SharePoint

Your answer