Azure VPN Client connects a device to an Azure VPN Gateway point-to-site connection over OpenVPN, and it is the required client when a gateway authenticates users with Microsoft Entra ID.
Azure VPN Client is the desktop application that dials a point-to-site VPN into an Azure virtual network from a single machine. It is the client Microsoft requires when the VPN gateway authenticates users with Microsoft Entra ID, because that combination works over the OpenVPN tunnel type only. The workflow is short: an administrator downloads the VPN client profile package from the gateway, the user imports the profile file it contains, and the Azure VPN Client then prompts for sign-in rather than for manual server details. Once the tunnel is up, the machine can reach private virtual networks, peered networks, and published internal services exactly as if it were running inside Azure.
The profile is the reason this client feels different from a consumer VPN app. Instead of asking for a server address and a shared secret, it carries the settings the gateway generated: authentication endpoints, certificate references, routes, and name resolution values. Because the profile is produced per gateway, it is also easy to replace when routes or address pools change, and a device can hold several profiles for different subscriptions or environments. That handoff from administrator to user keeps configuration out of the hands of people who should not need it. Organisations already familiar with appliance-based clients such as MotionPro will recognise the pattern: a managed profile plus identity-based login, with policy enforced centrally.
Security teams get the most out of Azure VPN Client because sign-in is tied to the corporate identity directory rather than a shared key. That makes conditional access and multi-factor authentication apply to the VPN the same way they apply to email or file storage, and access can be scoped by user or group without touching the client. Certificate-based OpenVPN connections remain available where directories are not in play, and RADIUS-backed gateways let organisations reuse existing authentication infrastructure. For users the benefit is simplicity: import one profile, sign in with the account already in use, and the tunnel behaves like a normal network connection, with no per-site settings to remember and no tunnel sitting open when it is not needed. Administrators can also tailor what each profile reaches, so a developer gets the lab subnets while a support agent gets only the ticketing system.
Key capabilities and highlights.
An administrator generates the VPN client profile package on the gateway, and the Azure VPN Client imports the profile file from the extracted folder. Settings such as authentication endpoints, routes, and DNS values arrive pre-filled; when a gateway serves multiple authentication types, the package includes a separate profile for the directory-based configuration.
Sign-in in Azure VPN Client uses the same identity as the rest of the Microsoft cloud estate, so conditional access, multifactor prompts, and device compliance checks reach the VPN too. Access can be limited to named users or groups, and profiles can enable device single sign-on so the connection is established without a second credential prompt.
The tunnel is built on the OpenVPN protocol, which rides over TLS on a commonly open port and therefore survives many hotel, campus, and guest networks that block other VPN traffic. Microsoft Entra ID authentication is supported only over this tunnel type, which is why the client is required for those gateways.
Azure VPN Client also handles OpenVPN connections secured with client certificates, and gateways backed by RADIUS can reuse the authentication infrastructure an organisation already runs. That means one endpoint application covers directory-based, certificate-based, and directory-plus-RADIUS designs without users installing anything different.
A single machine can store several profiles, which suits consultants and administrators who work across more than one subscription, tenant, or environment. Each profile keeps its own name, gateway, and settings, and switching between them is a matter of selecting a different entry rather than rebuilding a configuration.
Routes, address pools, and name resolution stay under the gateway's control. Addresses are handed out from the point-to-site pool, custom routes can be advertised to clients, and the generated profile carries the resulting settings, so a subnet added later does not require every user to edit anything by hand.
The client is meant to sit quietly in the background on a managed device, connecting when the user needs private resources and disconnecting when they do not. Background operation has to be permitted on the device, and connection state is visible from the client interface rather than through command-line tools.
Point-to-site connections from a virtual network gateway and from a Virtual WAN user VPN hub both use this endpoint application, so organisations running either topology can standardise on one client. Profiles differ by gateway, but the experience of importing a file and signing in stays the same.
Browse historical releases and previous builds.
No old versions have been added yet.
Common questions about Azure VPN Client.
It connects a single computer to an Azure virtual network over a point-to-site VPN. It is the client Microsoft requires when the gateway authenticates with Microsoft Entra ID, and it is also used for OpenVPN connections that rely on client certificates instead of directory credentials.
No. It is needed for OpenVPN tunnels and is specifically required for Microsoft Entra ID authentication. Connections that use IKEv2 or SSTP are handled by VPN software built into the operating system instead, configured from the same profile package the gateway produces.
From the VPN gateway. An administrator downloads the client profile package, extracts the AzureVPN folder, and passes the profile file to the user, who imports it. That is why most people never type a server address or tunnel setting themselves.
Yes, when Azure VPN Client is paired with Microsoft Entra ID authentication. Because sign-in happens against the identity directory, conditional access and multifactor policies apply to the VPN connection, and RADIUS-backed gateways can also enforce additional factors through the organisation's own authentication service.
Yes. Multiple profiles can be imported and stored side by side, each with its own name and gateway. That is useful for consultants and administrators who connect to more than one subscription, tenant, or environment, since switching does not require rebuilding any settings.
Yes. Profiles for certificate-based OpenVPN connections use the same client; the difference is that a client certificate issued from the trusted root must be installed on the device, and the gateway validates it while the connection is established rather than prompting for directory credentials.
Azure VPN Client connects a device to an Azure VPN Gateway point-to-site connection over OpenVPN, and it is the required client when a gateway authenticates users with Microsoft Entra ID.
Remote Desktop is the Microsoft client for connecting to remote PCs, cloud desktops, and published applications over the Remote Desktop Protocol. It lets people work in a full desktop environment from another device, with local printers, drives, and audio available during the session.
Pritunl Client is a VPN client that connects computers to OpenVPN and WireGuard servers, giving administrators and remote workers one interface for importing profiles, switching organizations, and keeping encrypted tunnels reliably connected.
Windows App is Microsoft's unified client for reaching Windows 365 Cloud PCs, Azure Virtual Desktop, Microsoft Dev Box, Remote Desktop Services, and remote PCs. It brings cloud and remote desktop access from Windows, macOS, mobile, and the browser into one secure workspace.
Surfshark is a VPN service that encrypts internet traffic, masks the user’s public IP address, and combines selective routing, tracker blocking, multi-server connections, and automatic protection for everyday privacy.
Comments