This feature needs to be explicitly enabled as described in the Cisco docs. This supports a feature called “ Start before logon” (SBL) that integrates with the Windows logon screen using PLAP. So let’s do a quick run-through of the third-party VPN clients that we believe will work, either based on customer reports during the private preview process or on our reading of the available documentation. (You can provision DirectAccess later if you want, since the GPOs can be applied with VPN connectivity.) While we can provision the offline domain join blob over the internet, the ODJ Connector doesn’t have the ability to deliver the needed certificates and polices as part of that ODJ blob. You can’t deliver a user cert to a device before the user signs in, and if the user can’t sign in before getting that user cert, then you can see the obvious chicken-and-egg problem. Hence you need to use a “fat” VPN client, a Win32 app that can be deployed to the device, or alternatively the in-box Windows VPN client.
There are some UWP-based VPN plug-ins available in the Microsoft Store, but these cannot be installed and used prior to the user signing into the device. But we can read their public documentation, looking for specific capabilities.įirst though, let’s talk about what we know won’t work today: In many cases, that really means what we think will work, because we don’t happen to have environments available to try out all of these VPN solutions ourselves. The configuration of those Win32 VPN clients varies by vendor, but often this configuration is bundled into the installer itself (not delivered separately).Īs the official docs don’t get into the specifics for what third-party VPN clients can be used, I thought it would be useful to review what will and won’t work. Usually this means a Win32 app delivered by Intune.
For the “manually initiate” case, that typically means a VPN client that leverages the RAS capabilities and pre-logon authentication hook (PLAP) capabilities that has been in Windows for several years. “always on”) or it needs to be one that the user can manually initiate from the The VPN connection either needs to be automatically established (e.g.In my previous post, I talked about the new VPN support for user-driven Hybrid Azure AD Join.
0 kommentar(er)
