Microsoft Always On VPN

Yes, Microsoft Always On VPN was explicitly designed to replace DirectAccess, which was deprecated and officially removed from Windows Server 2022. Always On VPN provides all the benefits of DirectAccess, like seamless automatic connections, but it does so using standard, modern VPN protocols. It also offers much better compatibility with third-party devices, unlike DirectAccess.

Microsoft Always On VPN primarily supports Internet Key Exchange version 2 (IKEv2) for device tunnel connections and Secure Socket Tunneling Protocol (SSTP) for user tunnel connections. IKEv2 is favored for its robust encryption and ability to handle network interruptions gracefully. SSTP is often used as a fallback because it runs over HTTPS, allowing it to pass through most firewalls.

Yes, this is one of the defining features of the solution, achieved by configuring a 'Device Tunnel.' The Device Tunnel establishes a connection to the corporate network using the computer's machine certificate before the Windows login screen even appears. This allows IT administrators to push Group Policy updates and run startup scripts seamlessly on remote machines.

No, Microsoft Always On VPN does not inherently require Azure; it can be deployed entirely on-premises. It relies on standard Windows Server roles like Remote Access Service (RAS) and Network Policy Server (NPS) to handle the routing and authentication. However, it integrates perfectly with Azure Active Directory (now Entra ID) for advanced Conditional Access and multi-factor authentication.