How to void an established VPN?

Hi Kapil,
Thank you for the reply.

1. Yes I am using Azure VPN Gateway.
2. Yes, I am using Entra Authentication.
3. I am using Microsoft-registered app.
   The question you asked here is about application object from my understanding.
   Please see here:
   https://zcusa.951200.xyz/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser
4. There are some documentations that I follow:
   For application registration, I follow the instructions (I used the Microsoft-registered public application id):
   https://zcusa.951200.xyz/en-us/azure/vpn-gateway/point-to-site-entra-register-custom-app#expose-an-api-and-add-a-scope
   For setting up for users, I follow "Assign users and groups" from here.
   https://zcusa.951200.xyz/en-us/azure/vpn-gateway/point-to-site-entra-users-access

Please let me know if this clarifies my question.

Thank you very much,
Handi

@Handinata Tanudjaja ,

Thanks for sharing the info.

However, I am not able to repo your issue.

• I created a Lab of my own
• Once I removed an user who was previously part of the "Users and Groups" of the Enterprise application, they were immediately not able to log in
• 

This means, as long as the user is not part of the Enterprise application's "Users and Groups", they will not be able to log in and connect.

If your query is about removing user sessions to P2S VPN Gateway

• See : Point-to-site VPN session management
• Make sure you review the necessary permissions and PowerShell command to do the same
• You can get the
  • VpnConnectionId
  • PublicIpAddress
  • VpnUserName (Entra Email ID)
  And use these values to bulk remove user session

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Thank you @KapilAnanth-MSFT .
I would like to make sure a couple of things first.
Before you removed the user, did you try to do VPN first using Azure VPN Client (https://apps.microsoft.com/detail/9np355qt2sqb?hl=en-US&gl=US) with the VPN Client profile configuration file (https://zcusa.951200.xyz/en-us/azure/vpn-gateway/about-vpn-profile-download) ?
Here's how I reproduce the steps for the issue (assuming you have creating the application object);

1. Assign the user to the application object.
2. Fill out the P2S configuration in the Virtual Network Gateway.
3. Download VPN Client Profile config file from Virtual Network Gateway.
4. Connect Azure VPN Client with the VPN Client Profile.
   You will see the prompted Entra ID account, etc.
   Make sure the connection is successfully established.
5. Once you validate the connection is established. Go back to "Users and Groups" and remove the user from the application object.
6. Now try to reconnect again using Azure VPN Client with the saved VPN client profile (do not try to reimport the VPN Client profile).
   You should see that the connection is still successfully established.

Expected outcome:
Connection shouldn't be established after the user removal.

Could you please let me know if this how you were testing it?

Thank you,

Handi

Hi @KapilAnanth-MSFT ,
Were you able to reproduce my issue with the steps that I given above?

Thank you

@Handinata Tanudjaja , yes - I used the same profile without re-importing the profile into the Azure VPN Client.

• I take it that by "application object", you refer to the application registered using : Register an application
• User2 was not able to login once I removed the user from the users and groups.

Moreover, re-importing the configuration file should not have any impact, as it only stores the configuration information.

Can you try to replicate the issue in a different client machine? and for a different user?

Cheers,

Kapil