Windows VPN technical guide
This guide walks you through the decisions to make for Windows clients in your organization's VPN solution, and how to configure your devices. This guide references the VPNv2 Configuration Service Provider (CSP) and provides mobile device management (MDM) configuration instructions using Microsoft Intune.
To create a Windows VPN device configuration profile see: Windows device settings to add VPN connections using Intune.
Note
This guide does not explain server deployment.
Windows edition and licensing requirements
The following table lists the Windows editions that support Virtual private network (VPN):
| Windows Pro | Windows Enterprise | Windows Pro Education/SE | Windows Education |
|---|---|---|---|
| Yes | Yes | Yes | Yes |
Virtual private network (VPN) license entitlements are granted by the following licenses:
| Windows Pro/Pro Education/SE | Windows Enterprise E3 | Windows Enterprise E5 | Windows Education A3 | Windows Education A5 |
|---|---|---|---|---|
| Yes | Yes | Yes | Yes | Yes |
For more information about Windows licensing, see Windows licensing overview.
In this guide
| Article | Description |
|---|---|
| VPN connection types | Select a VPN client and tunneling protocol |
| VPN routing decisions | Choose between split tunnel and force tunnel configuration |
| VPN authentication options | Select a method for Extensible Authentication Protocol (EAP) authentication. |
| VPN and conditional access | Use Microsoft Entra policy evaluation to set access policies for VPN connections. |
| VPN name resolution | Decide how name resolution should work |
| VPN auto-triggered profile options | Set a VPN profile to connect automatically by app or by name, to be "always on", and to not trigger VPN on trusted networks |
| VPN security features | Configure traffic filtering, connect a VPN profile to Windows Information Protection (WIP), and more |
| VPN profile options | Combine settings into single VPN profile using XML |