Hello, I'm testing Azure VPN, but I'm facing a problem with Authentication, unauthorized users could still establish VPN connection. Here's my setup: VPN GW deployed authentication set to Azure AD and the app registartion is successful "Assignment required" is enabled on the "Azure VPN" enterprise application a users group was created to test non-members of that group cannot establish VPN connection; however However, a test user was removed from that AzureAD group, but he can still connect to VPN. I'\ve waitied for sometime, but still able to VPN, and this is dangerous. I've even disabled the account, so he can no longer loginto the Azure portal, but still can connect to VPN. How to fix this please, otherwise I will have to consider other solutions? Best Regards

Azure VPN - unauthorized users can still establish VPN connection

Mohamed Roushdy 40

Hello,

I'm testing Azure VPN, but I'm facing a problem with Authentication, unauthorized users could still establish VPN connection. Here's my setup:

VPN GW deployed
authentication set to Azure AD and the app registartion is successful
"Assignment required" is enabled on the "Azure VPN" enterprise application
a users group was created to test
non-members of that group cannot establish VPN connection; however

However, a test user was removed from that AzureAD group, but he can still connect to VPN. I'\ve waitied for sometime, but still able to VPN, and this is dangerous. I've even disabled the account, so he can no longer loginto the Azure portal, but still can connect to VPN. How to fix this please, otherwise I will have to consider other solutions?

Best Regards

KapilAnanth-MSFT 46,016 Reputation points Microsoft Employee

2023-02-15T04:07:57.9233333+00:00
@Mohamed Roushdy

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that users are able to log in via AAD authentication even after getting removed from the group.

Can you please try the following and let me know if it helps,

Make sure the user you have removed from the group is not part of the users as well.

In the properties section, verify that Enabled for users to sign in is set to Yes.

Please do a Get Set operation on the VPN Gateway.
$Gateway = Get-AzVirtualNetworkGateway -ResourceGroupName "<RG Name>" -Name "<GW Name>"
Set-AzVirtualNetworkGateway

Cheers,

Kapil
KapilAnanth-MSFT 46,016 Reputation points Microsoft Employee

2023-02-22T04:39:24.14+00:00

@Mohamed Roushdy

May I know if you got a chance to review my previous comment?

Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.

Thanks,

Kapil
Leonardo Nicolini 0 Reputation points

2024-10-17T08:03:27.94+00:00

Hello, I tried, and the problem wasn’t resolved.

Share via

Azure VPN - unauthorized users can still establish VPN connection

Your answer