Setup Azure P2S VPN using Entra ID (Azure Active Directory) and Certificate based authentication

Hi Senthil,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

To address your queries,

1 . IKEv2 does not support Entra ID authentication, and this method is only supported via OpenVPN. I would like to confirm if this is indeed correct or if there is a workaround to make IKEv2 work with Entra ID and MFA.

• Your observation is correct.
• No, there are no alternatives or workarounds for this
• You have to use OpenVPN if you require Entra Authentication.

2 . However, I am unable to find any way to configure both authentication types simultaneously.

• Can you please specify what exactly is the challenge you are facing?
• Configure certificate authentication by following the steps mentioned here
• Configure Entra authentication by following the steps mentioned here
• The above two are mutually exclusive to each.

If you can provide a specific step where you are facing the issue, we can assist you better

Cheers,

Kapil

Hi Kapil,

Thank you for your prompt response and the information provided. I appreciate your help in clarifying the IKEv2 and Entra ID authentication situation.

First Issue:

I am currently using the Azure VPN Client with the following configuration:

• VPN Client: Azure VPN Client
• Tunnel Type: OpenVPN
• Authentication Type: Azure Certificate + Azure Active Directory

I would like to know if it is possible to have both authentication types mutually inclusive, meaning I want to implement added security by combining Azure Active Directory and Azure Certificates. If this is not feasible through the Azure VPN Client, could the OpenVPN client or any other VPN client support this combination?

I've attached my configuration for your reference.

Second Issue:

While my Entra ID authentication works with the Azure VPN Client using azurevpnconfig_aad.xml, I am having trouble getting the certificate authentication to work with azurevpnconfig_cert.xml. I have the client certificate installed on my laptop and have configured the root certificate information in the P2S settings. (I understand that they are mutually exclusive, so I tried these separately using their respective configuration azurevpnconfig_aad.xml, azurevpnconfig_cert.xml.)

If you could assist me with these issues, it would be greatly appreciated.

Attached is the error message

Thank you once again for your support!

Best regards,

Senthil

You are most welcome Senthil.

Wrt,

1 . I would like to know if it is possible to have both authentication types mutually inclusive, meaning I want to implement added security by combining Azure Active Directory and Azure Certificates.

• No, this is not supported as of now.
• Even with 3rd party applications, the Gateway will not authenticate the requests twice (one for Certificate and one for Entra)
• If you wish, you may vote in Azure Feedback Hub forum requesting this feature. All the feedback shared in these forums are monitored and reviewed by the Microsoft engineering teams responsible for building Azure

2 . You are facing "Server did not respond properly to VPN Control Packets. Session State: Key Material sent" error from the P2S Client.

• The error is usually associated with Entra authentication.
  • Can you please confirm if you are using the correct XML File (certificate auth) ?
• Can you please check if the local time is synchronized (correct) in this machine
• Can you try using a different machine to connect to the VPN Gateway (just for testing)
• Please download the VPN Client configuration file once again and use it in this server

Let us know how the above goes.

Cheers,

Kapil