Create a Microsoft Entra tenant for P2S OpenVPN protocol connections

When connecting to your VNet, you can use certificate-based authentication or RADIUS authentication. However, when you use the Open VPN protocol, you can also use Microsoft Entra authentication. If you want different set of users to be able to connect to different gateways, you can register multiple apps in AD and link them to different gateways.

This article helps you set up a Microsoft Entra tenant for P2S Open VPN authentication, and create and register multiple apps in Microsoft Entra ID to allow different access for different users and groups.

Create a Microsoft Entra tenant using the steps in the Create a new tenant article:

• Organizational name

• Initial domain name

  Example:

  

In this step, you create two Microsoft Entra tenant users: One Global Admin account and one master user account. The master user account is used as your master embedding account (service account). When you create a Microsoft Entra tenant user account, you adjust the Directory role for the type of user that you want to create. Use the steps in this article to create at least two users for your Microsoft Entra tenant. Be sure to change the Directory Role to create the account types:

• Global Admin
• User

Register the VPN client in the Microsoft Entra tenant.

1. Locate the Directory ID of the directory that you want to use for authentication. It is listed in the properties section of the Active Directory page.

   

2. Copy the Directory ID.

3. Sign in to the Azure portal as a user that is assigned the Global administrator role.

4. Next, give admin consent. Copy and paste the URL that pertains to your deployment location in the address bar of your browser:

   Microsoft Azure operated by 21Vianet

   https://login.chinacloudapi.cn/common/oauth2/authorize?client_id=49f817b6-84ae-4cc0-928c-73f27289b3aa&response_type=code&redirect_uri=https://portal.azure.cn&nonce=1234&prompt=admin_consent
   

5. Select the Global Admin account if prompted.

   

6. On the Permissions requested page, select Accept to grant permissions to the app.

7. Under your Microsoft Entra ID, in Enterprise applications, you will see Azure VPN listed.

   

In this step, you register additional applications for various users and groups.

1. Under your Microsoft Entra ID, click App registrations and then + New registration.

   

2. On the Register an application page, enter the Name. Select the desired Supported account types, then click Register.

   

3. Once the new app has been registered, click Expose an API under the app blade.

4. Click + Add a scope.

5. Leave the default Application ID URI. Click Save and continue.

   

6. Fill in the required fields and ensure that State is Enabled. Click Add scope.

   

7. Click Expose an API then + Add a client application. For Client ID, Enter 49f817b6-84ae-4cc0-928c-73f27289b3aa for Azure China 21Vianet.

8. Click Add application.

   

9. Copy the Application (client) ID from the Overview page. You will need this information to configure your VPN gateway(s).

   

10. Repeat the steps in this register additional applications section to create as many applications that are needed for your security requirement. Each application will be associated to a VPN gateway and can have a different set of users. Only one application can be associated to a gateway.

Assign the users to your applications.

1. Under Microsoft Entra ID -> Enterprise applications, select the newly registered application and click Properties. Ensure that User assignment required? is set to yes. Click Save.

   

2. On the app page, click Users and groups, and then click +Add user.

   

3. Under Add Assignment, click Users and groups. Select the users that you want to be able to access this VPN application. Click Select.

   

A P2S configuration defines the parameters for connecting remote clients.

1. Set the following variables, replacing values as needed for your environment.

   $aadAudience = "00000000-abcd-abcd-abcd-999999999999"
   $aadIssuer = "https://sts.chinacloudapi.cn/00000000-abcd-abcd-abcd-999999999999/"
   $aadTenant = "https://login.partner.microsoftonline.cn/00000000-abcd-abcd-abcd-999999999999"    
   

2. Run the following commands to create the configuration:

   $aadConfig = New-AzVpnServerConfiguration -ResourceGroupName <ResourceGroup> -Name newAADConfig -VpnProtocol OpenVPN -VpnAuthenticationType AAD -AadTenant $aadTenant -AadIssuer $aadIssuer -AadAudience $aadAudience -Location chinaeast2
   

   Note

   Do not use the Azure VPN client's application ID in the commands above: It will grant all users access to the gateway. Use the ID of the application(s) you registered.

1. Navigate to the Hubs blade under the virtual WAN.

2. Select the hub that you want to associate the vpn server configuration to and click the ellipsis (...).

   

3. Click Edit virtual hub.

4. Check the Include point-to-site gateway check box and pick the Gateway scale unit that you want.

   

5. Enter the Address pool from which the VPN clients will be assigned IP addresses.

6. Click Confirm.

7. The operation can take up to 30 minutes to complete.

Use the VPN profile to configure your clients.

1. On the page for your virtual WAN, click User VPN configurations.

2. At the top of the page, click Download user VPN config.

3. Once the file has finished creating, you can click the link to download it.

4. Use the profile file to configure the VPN clients.

5. Extract the downloaded zip file.

6. Browse to the unzipped "AzureVPN" folder.

7. Make a note of the location of the "azurevpnconfig.xml" file. The azurevpnconfig.xml contains the setting for the VPN connection and can be imported directly into the Azure VPN Client application. You can also distribute this file to all the users that need to connect via e-mail or other means. The user will need valid Microsoft Entra credentials to connect successfully.

To connect, you need to download the Azure VPN Client and import the VPN client profile that was downloaded in the previous steps on every computer that wants to connect to the VNet.

Use this link to download the Azure VPN Client.

1. On the page, select Import.

   

2. Browse to the profile xml file and select it. With the file selected, select Open.

   

3. Specify the name of the profile and select Save.

   

4. Select Connect to connect to the VPN.

   

5. Once connected, the icon will turn green and say Connected.

   

1. Select the ellipsis (...) next to the client profile that you want to delete. Then, select Remove.

   

2. Select Remove to delete.

   

1. To diagnose connection issues, you can use the Diagnose tool. Select the ellipsis (...) next to the VPN connection that you want to diagnose to reveal the menu. Then select Diagnose.

   

2. On the Connection Properties page, select Run Diagnosis.

   

3. Sign in with your credentials.

   

4. View the diagnosis results.

   

1. Navigate to the virtual WAN.

2. On the Overview page, each point on the map represents a hub.

3. In the Hubs and connections section, you can view hub status, site, region, VPN connection status, and bytes in and out.

When you no longer need these resources, you can use Remove-AzResourceGroup to remove the resource group and all of the resources it contains. Replace "myResourceGroup" with the name of your resource group and run the following PowerShell command:

Remove-AzResourceGroup -Name myResourceGroup -Force

To learn more about Virtual WAN, see the Virtual WAN Overview page.