Skip to content

Commit 330b887

Browse files
v-albemiv-albemi
authored
Merge pull request #104535 from cherylmc/vpnvwan2
Vpnvwan2
2 parents 034d45b + 3402e37 commit 330b887

File tree

8 files changed

+121
-40
lines changed

8 files changed

+121
-40
lines changed

‎articles/virtual-wan/openvpn-azure-ad-mfa.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,23 +12,23 @@ ms.author: alzam
1212
---
1313
# Enable Azure Multi-Factor Authentication (MFA) for VPN users
1414

15-
If you want users to be prompted for a second factor of authentication before granting access, you can configure Azure Multi-Factor Authentication (MFA) for your Azure AD tenant. The steps in this article help you enable a requirement for two-step verification.
15+
[!INCLUDE [overview](../../includes/vpn-gateway-vwan-openvpn-enable-mfa-overview.md)]
1616

17-
## <a name="prereq"></a>Prerequisite
17+
## <a name="enableauth"></a>Enable authentication
1818

19-
The prerequisite for this configuration is a configured Azure AD tenant using the steps in [Configure a tenant](openvpn-azure-ad-tenant.md).
19+
[!INCLUDE [enable authentication](../../includes/vpn-gateway-vwan-openvpn-enable-auth.md)]
2020

21-
[!INCLUDE [MFA steps](../../includes/vpn-gateway-vwan-openvpn-azure-ad-mfa.md)]
21+
## <a name="enablesign"></a>Configure sign-in settings
2222

23-
## <a name="enablesign"></a> Configure sign-in settings
23+
[!INCLUDE [sign in](../../includes/vpn-gateway-vwan-openvpn-sign-in.md)]
2424

25-
On the **Azure VPN - Properties** page, configure sign-in settings.
25+
## <a name="peruser"></a>Option 1 - Per User access
2626

27-
1. Set **Enabled for users to sign-in?** to **Yes**. This allows all users in the AD tenant to connect to the VPN successfully.
28-
2. Set **User assignment required?** to **Yes** if you want to limit sign-in to only users that have permissions to the Azure VPN.
29-
3. Save your changes.
27+
[!INCLUDE [per user](../../includes/vpn-gateway-vwan-openvpn-per-user.md)]
3028

31-
![Permissions](./media/openvpn-azure-ad-mfa/user2.jpg)
29+
## <a name="conditional"></a>Option 2 - Conditional Access
30+
31+
[!INCLUDE [conditional access](../../includes/vpn-gateway-vwan-openvpn-conditional.md)]
3232

3333
## Next steps
3434

‎articles/vpn-gateway/openvpn-azure-ad-mfa.md

Lines changed: 10 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -6,47 +6,30 @@ author: anzaman
66

77
ms.service: vpn-gateway
88
ms.topic: conceptual
9-
ms.date: 11/21/2019
9+
ms.date: 02/14/2020
1010
ms.author: alzam
1111

1212
---
1313
# Enable Azure Multi-Factor Authentication (MFA) for VPN users
1414

15-
If you want users to be prompted for a second factor of authentication before granting access, you can configure Azure Multi-Factor Authentication (MFA) on a per user basis or leverage Multi-Factor Authentication (MFA) via [Conditional Access](../active-directory/conditional-access/overview.md) for more fine-grained control. Configuring Multi-Factor Authentication per user can be enabled at no-additional cost, however when enabling MFA per user, the user will be prompted for second factor authentication against all applications tied to the Azure AD tenant. Conditional Access will allow finer grain control over how a second factor should be promoted and can allow assignment of MFA to only VPN and not other applications tied to the Azure AD tenant.
15+
[!INCLUDE [overview](../../includes/vpn-gateway-vwan-openvpn-enable-mfa-overview.md)]
1616

1717
## <a name="enableauth"></a>Enable authentication
1818

19-
1. Navigate to **Azure Active Directory -> Enterprise applications -> All applications**.
20-
2. On the **Enterprise applications - All applications** page, select **Azure VPN**.
19+
[!INCLUDE [enable authentication](../../includes/vpn-gateway-vwan-openvpn-enable-auth.md)]
2120

22-
![Directory ID](../../includes/media/vpn-gateway-vwan-openvpn-azure-ad-mfa/user1.jpg)
21+
## <a name="enablesign"></a>Configure sign-in settings
2322

24-
## <a name="enablesign"></a> Configure sign-in settings
23+
[!INCLUDE [sign in](../../includes/vpn-gateway-vwan-openvpn-sign-in.md)]
2524

26-
On the **Azure VPN - Properties** page, configure sign-in settings.
25+
## <a name="peruser"></a>Option 1 - Per User access
2726

28-
1. Set **Enabled for users to sign-in?** to **Yes**. This allows all users in the AD tenant to connect to the VPN successfully.
29-
2. Set **User assignment required?** to **Yes** if you want to limit sign-in to only users that have permissions to the Azure VPN.
30-
3. Save your changes.
27+
[!INCLUDE [per user](../../includes/vpn-gateway-vwan-openvpn-per-user.md)]
3128

32-
![Permissions](./media/openvpn-azure-ad-mfa/user2.jpg)
29+
## <a name="conditional"></a>Option 2 - Conditional Access
3330

34-
## Option 1 - Enable Multi-Factor Authentication (MFA) via Conditional Access
35-
36-
Conditional Access allows for fine-grained access control on a per-application basis. Please note that to leverage Conditional Access, you should have Azure AD Premium 1 or greater licensing applied to the users that will be subject to the Conditional Access rules.
37-
38-
1. On the **Enterprise applications - All applications** page, select **Azure VPN**, select **Conditional Access**, and click **New policy**.
39-
2. Under Users and groups, on the *Include* tab check **Select users and groups**, check **Users and groups**, and select a group or set of users that should be subject for MFA. Click **Done**.
40-
![Assignments](../../includes/media/vpn-gateway-vwan-openvpn-azure-ad-mfa/mfa-ca-assignments.png)
41-
3. Under **Grant**, check **Grant access**, check **Require multi-factor authentication**, check **Require all the selected controls**, and click the **Select** button.
42-
![Grant access - MFA](../../includes/media/vpn-gateway-vwan-openvpn-azure-ad-mfa/mfa-ca-grant-mfa.png)
43-
4. Check **On** under **Enable policy** and click the **Create** button.
44-
![Enable Policy](../../includes/media/vpn-gateway-vwan-openvpn-azure-ad-mfa/mfa-ca-enable-policy.png)
45-
46-
## Option 2 - Enable Multi-Factor Authentication (MFA) per User
47-
48-
[!INCLUDE [MFA steps](../../includes/vpn-gateway-vwan-openvpn-azure-ad-mfa.md)]
31+
[!INCLUDE [conditional access](../../includes/vpn-gateway-vwan-openvpn-conditional.md)]
4932

5033
## Next steps
5134

52-
To connect to your virtual network, you must create and configure a VPN client profile. See [Configure a VPN client for P2S VPN connections](openvpn-azure-ad-client.md).
35+
To connect to your virtual network, you must create and configure a VPN client profile. See [Configure a VPN client for P2S VPN connections](openvpn-azure-ad-client.md).

‎articles/vpn-gateway/media/openvpn-azure-ad-mfa/user2.jpg renamed to ‎includes/media/vpn-gateway-vwan-openvpn-sign-in/user2.jpg

File renamed without changes.

‎includes/vpn-gateway-vwan-openvpn-conditional.md

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
title: include file
3+
description: include file
4+
services: vpn-gateway
5+
author: cherylmc
6+
ms.service: vpn-gateway
7+
ms.topic: include
8+
ms.date: 02/14/2020
9+
ms.author: cherylmc
10+
ms.custom: include file
11+
12+
# this file is used for both virtual wan and vpn gateway. When modifying, make sure that your changes work for both environments.
13+
---
14+
Conditional Access allows for fine-grained access control on a per-application basis. In order to use Conditional Access, you should have Azure AD Premium 1 or greater licensing applied to the users that will be subject to the Conditional Access rules.
15+
16+
1. Navigate to the **Enterprise applications - All applications** page and click **Azure VPN**.
17+
18+
- Click **Conditional Access**.
19+
- Click **New policy** to open the **New** pane.
20+
2. On the **New** pane, navigate to **Assignments -> Users and groups**. On the **Users and groups ->** **Include** tab:
21+
22+
- Click **Select users and groups**.
23+
- Check **Users and groups**.
24+
- Click **Select** to select a group or set of users to be affected by MFA.
25+
- Click **Done**.
26+
27+
![Assignments](./media/vpn-gateway-vwan-openvpn-azure-ad-mfa/mfa-ca-assignments.png)
28+
3. On the **New** pane, navigate to the **Access controls -> Grant** pane:
29+
30+
- Click **Grant access**.
31+
- Click **Require multi-factor authentication**.
32+
- Click **Require all the selected controls**.
33+
- Click **Select**.
34+
35+
![Grant access - MFA](./media/vpn-gateway-vwan-openvpn-azure-ad-mfa/mfa-ca-grant-mfa.png)
36+
4. In the **Enable policy** section:
37+
38+
- Select **On**.
39+
- Click **Create**.
40+
41+
![Enable Policy](./media/vpn-gateway-vwan-openvpn-azure-ad-mfa/mfa-ca-enable-policy.png)

‎includes/vpn-gateway-vwan-openvpn-enable-auth.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
title: include file
3+
description: include file
4+
services: vpn-gateway
5+
author: cherylmc
6+
ms.service: vpn-gateway
7+
ms.topic: include
8+
ms.date: 02/14/2020
9+
ms.author: cherylmc
10+
ms.custom: include file
11+
12+
# this file is used for both virtual wan and vpn gateway. When modifying, make sure that your changes work for both environments.
13+
---
14+
15+
1. Navigate to **Azure Active Directory -> Enterprise applications -> All applications**.
16+
2. On the **Enterprise applications - All applications** page, select **Azure VPN**.
17+
18+
![Directory ID](./media/vpn-gateway-vwan-openvpn-azure-ad-mfa/user1.jpg)

‎includes/vpn-gateway-vwan-openvpn-enable-mfa-overview.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
title: include file
3+
description: include file
4+
services: vpn-gateway
5+
author: cherylmc
6+
ms.service: vpn-gateway
7+
ms.topic: include
8+
ms.date: 02/14/2020
9+
ms.author: cherylmc
10+
ms.custom: include file
11+
12+
# this file is used for both virtual wan and vpn gateway. When modifying, make sure that your changes work for both environments.
13+
---
14+
15+
If you want users to be prompted for a second factor of authentication before granting access, you can configure Azure Multi-Factor Authentication (MFA). You can configure MFA on a per user basis, or you can leverage MFA via [Conditional Access](../articles/active-directory/conditional-access/overview.md).
16+
17+
* MFA per user can be enabled at no-additional cost. When enabling MFA per user, the user will be prompted for second factor authentication against all applications tied to the Azure AD tenant. See [Option 1](#peruser) for steps.
18+
* Conditional Access allows for finer-grained control over how a second factor should be promoted. It can allow assignment of MFA to only VPN, and exclude other applications tied to the Azure AD tenant. See [Option 2](#conditional) for steps.

‎includes/vpn-gateway-vwan-openvpn-azure-ad-mfa.md renamed to ‎includes/vpn-gateway-vwan-openvpn-per-user.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,17 +12,17 @@
1212
# this file is used for both virtual wan and vpn gateway. When modifying, make sure that your changes work for both environments.
1313
---
1414

15-
## <a name="mfa"></a>Open the MFA page
15+
### <a name="mfa"></a>Open the MFA page
1616

1717
1. Sign in to the Azure portal.
1818
2. Navigate to **Azure Active Directory -> All users**.
1919
3. Select **Multi-Factor Authentication** to open the multi-factor authentication page.
2020

2121
![Sign in](./media/vpn-gateway-vwan-openvpn-azure-ad-mfa/mfa1.jpg)
2222

23-
## <a name="users"></a> Select users
23+
### <a name="users"></a> Select users
2424

25-
1. On the **multi-factor authentication** page, select the user(s) for which you want to enable MFA.
25+
1. On the **multi-factor authentication** page, select the user(s) for whom you want to enable MFA.
2626
2. Select **Enable**.
2727

2828
![Select](./media/vpn-gateway-vwan-openvpn-azure-ad-mfa/mfa2.jpg)

‎includes/vpn-gateway-vwan-openvpn-sign-in.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: include file
3+
description: include file
4+
services: vpn-gateway
5+
author: cherylmc
6+
ms.service: vpn-gateway
7+
ms.topic: include
8+
ms.date: 02/14/2020
9+
ms.author: cherylmc
10+
ms.custom: include file
11+
12+
# this file is used for both virtual wan and vpn gateway. When modifying, make sure that your changes work for both environments.
13+
---
14+
15+
On the **Azure VPN - Properties** page, configure sign-in settings.
16+
17+
1. Set **Enabled for users to sign-in?** to **Yes**. This setting allows all users in the AD tenant to connect to the VPN successfully.
18+
2. Set **User assignment required?** to **Yes** if you want to limit sign-in to only users that have permissions to the Azure VPN.
19+
3. Save your changes.
20+
21+
![Permissions](./media/vpn-gateway-vwan-openvpn-sign-in/user2.jpg)

0 commit comments

Comments
 (0)