What happens when an employee works from a coffee shop and needs to access a file on the company's private server — a server that isn't connected to the internet? This chapter solves that exact puzzle. For the MD-102 exam, you need to know how to configure the secure tunnels, called VPNs, that make remote work possible without exposing the company's network to attack.
Jump to a section
A simple way to picture Managing Remote Access and VPN Profiles
Your company's main office is in a high-security building in the city centre. Employees work there every day, so the building's security team knows them by sight and their ID badges work for the front door, the lifts, and their specific floor. This is the office network.
Now, imagine you're working from home for a day. You need access to a confidential file locked in the building's secure records room on the fifth floor. You can't just walk through the front door because you're 20 miles away. Instead, the building has a special, permanent secure courier service. You call the courier dispatch, and they assign you a personal, encrypted courier pouch. Every piece of data you send to or receive from the office gets locked inside this pouch, sent over the public roads (the internet), and only the courier desk inside the building has the key to open it. The courier desk then passes your request to the internal mailroom, which fetches the file and sends it back in the same pouch. From the perspective of your home computer, you have a private, secure tunnel directly into the building's mail system. You present your courier pouch credentials, not your office ID badge, to prove you're allowed to use the service. The building's security team has a list of authorised remote workers and their unique courier pouch numbers. If someone tries to use a fake pouch, the courier desk simply shreds the request and logs the attempt. This permanent secure pouch is your VPN profile.
A Virtual Private Network, or VPN, creates a secure, encrypted tunnel between a device (like a laptop) and a private network (like your company's office network). Think of the internet as a public postal system. Anyone can read a postcard sent through the mail. A VPN is like putting that postcard inside a locked, steel briefcase that only the sender and the receiver have the key to open. It protects the data inside from being read or tampered with while it travels across the public internet.
Before VPNs were common, if you wanted to work remotely, you might have used a dial-up modem to call a special phone number that connected you directly to the company's modem bank. This worked, but it was slow, expensive, and tied up a phone line. VPNs replaced this by using the internet itself as the connection medium, but wrapping the data in encryption.
There are two main ways to set up a VPN connection for a device: Always-on VPN and on-demand VPN. An always-on VPN automatically connects every time the device has internet access. The user doesn't have to think about it. The device is constantly tunneled back to the corporate network. This is common for company-issued laptops where security is the top priority. An on-demand VPN only connects when the user needs to access a resource on the corporate network, like a shared drive or an internal website. This saves bandwidth and is often used on personal devices that only occasionally need corporate access.
Microsoft Intune is the tool you use to create and deploy these VPN profiles to devices. A profile is a set of configuration settings. You tell Intune: 'Here is the VPN server address, here is the type of connection (e.g., IKEv2, SSTP), here is the authentication method (e.g., certificate or username/password), and here are the apps that should trigger the VPN to connect.' Intune then pushes this profile to the device, and the device creates the VPN connection automatically based on those instructions.
The key authentication methods for VPN profiles in a Microsoft environment include:
Certificates: A digital certificate is like an electronic passport issued by the company's own certificate authority (a trusted internal server). The device presents this certificate to the VPN server to prove it's a legitimate company device. This is the most secure method.
Username and password: The user types their corporate credentials. This is simpler but less secure because passwords can be guessed or stolen.
Microsoft Entra ID integration: The device authenticates using its identity in Microsoft Entra ID, which can also enforce multifactor authentication (MFA), like a text message code.
The exam focuses heavily on the concept of 'split tunneling' versus 'full tunneling'. With full tunneling, all traffic from the device (even browsing the public web) goes through the VPN tunnel and out the corporate network. This is very secure but uses a lot of corporate bandwidth and can be slow. With split tunneling, only traffic destined for the corporate network goes through the tunnel. Traffic to public websites (like Google or YouTube) goes directly to the internet via the device's normal connection. This is faster but slightly less secure because the device is not under the corporate firewall's protection for its web browsing.
For Wi-Fi profiles, you are configuring how a device connects to a wireless network. Instead of a tunnel, you are providing the SSID (the network name), the security type (e.g., WPA2-Enterprise which requires a certificate), and the authentication method. Intune pushes these settings so the device automatically connects to the correct corporate Wi-Fi network without the user needing to know the password. This is especially useful when the Wi-Fi network uses a certificate for authentication, which is common in larger organisations.
Finally, there are 'trusted network detection' settings. You can define a list of DNS suffixes or IP address ranges that tell the device 'you are in the office, so don't bother connecting the VPN.' When the device leaves that network, the VPN profile kicks in. This saves power and prevents unnecessary VPN traffic when the user is sitting at their desk inside the corporate network.
Define the VPN connection name and server address
In the Intune profile, you specify a friendly name (e.g., 'Company VPN') and the public DNS name or IP address of your VPN gateway server. This tells the device where to connect.
Select the VPN connection type and protocol
You choose the protocol like IKEv2 or SSTP. This determines how the tunnel is established. For MD-102, know that IKEv2 is modern and preferred for Windows devices. You also choose 'Always On' or 'On Demand'.
Configure authentication method
You select 'Certificate' or 'Username and Password'. If using a certificate, you must also ensure that a trusted certificate profile is deployed to the same devices first, so the device has the credentials to present to the VPN server.
Set up split tunneling or full tunneling rules
You define which IP ranges or DNS suffixes are considered 'corporate'. Traffic matching these routes goes through the VPN tunnel. All other traffic goes directly to the internet if split tunneling is enabled.
Configure trusted network detection
You add a list of DNS suffixes or IP ranges that represent the corporate office network. When the device detects it is on one of these networks, the VPN disconnects (or does not connect) automatically.
Deploy the profile to target device groups
You assign the profile to a Microsoft Entra ID security group containing the devices or users who need the VPN. Intune sends the profile to those devices on their next check-in, and the configuration is applied silently.
An IT professional at a company called 'GreenLeaf Consulting' needs to set up remote access for 50 sales representatives who work from home or on the road. The sales team uses company-issued Windows laptops. The IT pro's goal is to ensure that when a sales rep opens their CRM (Customer Relationship Management) software at a coffee shop, the connection to the company's internal CRM server is secure.
Here is the step-by-step process they would follow in the Microsoft Intune admin centre:
First, the IT pro creates a VPN profile. They open the Intune console, go to 'Devices' > 'Configuration profiles', and create a new profile for Windows 10 and later. They select 'VPN' as the profile type.
Second, they configure the basics. They enter a connection name, say 'GreenLeaf VPN'. They specify the VPN server address, which is something like 'vpn.greenleaf.com'. This is the public internet address of the company's VPN gateway, a server designed to receive and authenticate VPN connection requests.
Third, they choose the connection type. For maximum security and because the laptops are company-managed, they select 'IKEv2'. Internet Key Exchange version 2 is a modern, secure VPN protocol. They then configure authentication. They choose 'Certificate-based authentication' because the company has already deployed certificates to all laptops via Intune. This means the laptop can automatically authenticate without the user typing a password, which is both more secure and more convenient.
Fourth, they configure split tunneling. The IT pro knows the sales reps need to access the CRM server at IP address 10.10.10.50 and a file share at 10.10.20.0/24. They add these specific routes to the VPN profile's 'Split Tunneling' rule. They also add a 'Trusted Network Detection' rule for the company's office Wi-Fi (SSID: GreenLeaf-Office) and DNS suffix (greenleaf.local). When the laptop detects it is connected to that Wi-Fi, the VPN will automatically disconnect.
Fifth, they target the profile. They create an Entra ID group called 'Sales Force Laptops' and assign this VPN profile to that group. Intune checks in with the laptops, sees the new policy, and pushes the VPN profile down. The next time a sales rep opens their laptop at a coffee shop, Windows automatically establishes the VPN connection using the certificate. The rep opens the CRM app, and it seamlessly connects to the internal server via the encrypted tunnel. The user never types a password or clicks 'Connect'. It just works.
For the Wi-Fi profile, a separate configuration profile is created for 'Wi-Fi'. The IT pro enters the SSID 'GreenLeaf-Guest' and the security type 'WPA2-Enterprise', and specifies that the device should use a certificate for authentication. This profile is deployed to a different group of devices that need guest-like network access in the office.
The MD-102 exam tests your practical knowledge of configuring VPN and Wi-Fi profiles in Intune. It does not test how the underlying VPN protocols work at a packet level. The focus is on 'what settings go where' and 'which option causes which behaviour'.
Key exam topics you must know:
The difference between 'Always On' and 'On Demand' VPN in a profile. The exam will describe a scenario ('users need continuous access to internal resources') — the answer is 'Always On'.
Split tunneling vs. full tunneling. The exam loves to ask: 'Which configuration reduces corporate network bandwidth usage?' The answer is split tunneling, because only corporate traffic goes through the tunnel. Another question: 'Which configuration provides maximum security?' The answer is full tunneling.
Trusted network detection. A question might describe a scenario where a user's VPN disconnects when they arrive at the office. The answer is that trusted network detection was configured correctly.
Certificate-based authentication vs. username/password. A question will ask 'Which authentication method prevents password-related attacks?' The answer is certificate-based.
Wi-Fi profile security types. Know the difference between WPA2-Personal (one shared password) and WPA2-Enterprise (each user authenticates individually, usually with a certificate). The exam tests that WPA2-Enterprise is appropriate for corporate devices.
Common traps the exam sets:
They ask about 'VPN proxy' settings. A VPN proxy is a separate setting inside a VPN profile that routes specific traffic through a proxy server while inside the VPN tunnel. It is not the same as a regular proxy. The exam may list 'VPN proxy' as an option when it is irrelevant to the question.
They present a scenario with 'On Demand VPN' but the requirement is 'always connected'. Traps you into choosing 'On Demand' because it sounds flexible.
They mix up 'profile deployment' with 'app deployment'. A VPN profile is a configuration profile, not a managed app. The exam might offer 'Line-of-business app' as a distractor.
For Wi-Fi, they might talk about 'SSID broadcasting' being disabled. The exam will ask 'How do you connect to a hidden network?' The answer is to configure the profile with the exact SSID and set 'Connect automatically' to 'True'. The profile already knows the name.
Patterns for correct answers:
If the question mentions 'multiple users sharing a device' and 'VPN', the correct authentication method is usually certificate-based (because it doesn't require a password to be entered by each user).
If the question mentions 'company-managed device' and 'VPN', look for 'Always On VPN' and 'device tunnel' (a connection that initiates before the user logs in).
If the question mentions 'personal device' and 'VPN', look for 'On Demand' or 'user tunnel' (connects after login).
A VPN profile configures a device to create an encrypted tunnel to a corporate network; a Wi-Fi profile configures connection to a specific wireless network.
Split tunneling sends only corporate-bound traffic through the VPN, saving bandwidth; full tunneling sends all traffic through the VPN for maximum security.
Certificate-based authentication is more secure than username/password for VPN connections because it does not rely on a secret that can be guessed or phished.
Trusted network detection prevents the VPN from connecting when the device is physically on the corporate network, preserving battery and bandwidth.
Always-on VPN starts automatically when the device has internet access, requiring no user intervention and providing continuous secure access.
Intune configuration profiles silently deploy VPN and Wi-Fi settings to managed devices without requiring the user to manually configure anything.
WPA2-Enterprise on a Wi-Fi profile requires each user to authenticate individually, typically with a certificate, unlike WPA2-Personal which uses a shared password.
These come up on the exam all the time. Here's how to tell them apart.
Always-on VPN
Connects automatically whenever the device has internet access, without user action.
Used for company-managed devices where continuous corporate access is required.
More secure because it ensures the device is always inside the corporate security perimeter.
On-demand VPN
Connects only when the user launches an app or tries to access a resource specified in the profile.
Used for personal devices or scenarios where constant VPN is unnecessary.
Less bandwidth-intensive on the corporate network as the tunnel is not always active.
Split Tunneling
Only corporate-bound traffic (defined by IP ranges or DNS suffixes) goes through the VPN.
Faster for general internet use because private traffic uses the direct internet connection.
Less secure because the device is exposed to the internet for non-corporate traffic.
Full Tunneling
All traffic from the device goes through the VPN tunnel to the corporate network.
Slower for internet use because everything is routed via the corporate gateway.
More secure because all traffic is inspected by corporate security appliances.
Certificate-based Authentication
Uses a digital certificate installed on the device to prove identity.
Extremely resistant to phishing and credential theft because there is no shared secret to steal.
Requires a Public Key Infrastructure (PKI) to issue and manage certificates.
Username & Password Authentication
User types their corporate username and password to connect.
Vulnerable to phishing attacks and credential spraying.
Simpler to set up initially as it does not require a certificate infrastructure.
WPA2-Personal (Wi-Fi)
Uses a single pre-shared key (password) for all users on the network.
Simpler to set up for small offices or home networks.
Less secure because the password can be shared or leaked, and it is the same for everyone.
WPA2-Enterprise (Wi-Fi)
Each user authenticates individually, often using a certificate or RADIUS server.
Provides per-user auditing and more granular control over network access.
More secure because credentials are unique to each user and can be revoked individually.
Mistake
A VPN makes your internet speed faster by routing traffic through the corporate network.
Correct
A VPN typically slows down your internet because it adds encryption overhead and extra routing steps. It does not boost speed; it prioritises security.
People confuse the concept of a VPN hiding their location for streaming (which can sometimes bypass throttling) with a corporate VPN, which is purely about secure remote access.
Mistake
Deploying a VPN profile via Intune means the user must manually type the server address and credentials the first time.
Correct
Intune pre-configures the entire VPN connection, including the server address, authentication method, and even the certificate. The user often does not need to type anything; the connection happens automatically.
Many beginners imagine IT as just 'giving instructions' to the user. They don't realise Intune pushes the entire configuration silently, which is the whole point of device management.
Mistake
Wi-Fi profiles and VPN profiles are the same thing — they both secure the connection.
Correct
Wi-Fi profiles connect a device to a wireless network (securing the link between the device and the router). VPN profiles create an encrypted tunnel over any internet connection (securing data from the device to the corporate network, even on an unsecured Wi-Fi). They solve different problems at different layers.
Both involve 'connecting securely' and both are configured via Intune profiles. Beginners mash them together because the tool looks the same, but the underlying technology and purpose are distinct.
Mistake
If you use a VPN, you don't need to worry about firewalls or antivirus on the remote device.
Correct
A VPN only secures the traffic in transit. It does not protect the device from malware, phishing, or local network attacks at the coffee shop. The device still needs antivirus, a firewall, and updates. A VPN is one layer of security, not the entire stack.
Over-reliance on a single security measure is a common beginner error. The VPN's job is 'encryption in transit', not 'protecting the endpoint'. The exam tests layered security concepts.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
No. A VPN encrypts only the traffic between your device and the corporate network. It does not scan for or block malware, so you still need antivirus software and a firewall on your device.
A Wi-Fi profile configures how a device connects to a specific wireless network (like entering the SSID and password). A VPN profile configures a secure tunnel over any internet connection to reach a corporate network. Both are managed via Intune but solve different problems.
Split tunneling reduces load on the corporate network and improves internet speed for non-corporate traffic (like web browsing) because it goes directly to the internet instead of through the VPN. It's a trade-off between security and performance.
No. The built-in Windows VPN client handles the connection. Intune configures it automatically, so the user does not need to download or install third-party VPN software.
It's a setting in a VPN profile that tells the device to not connect the VPN when it is already on a trusted network (like the corporate office Wi-Fi). It prevents unnecessary VPN usage and saves resources.
Yes, you can, but it is less secure than certificate-based authentication because passwords can be phished or guessed. For MD-102, certificate-based authentication is recommended for higher security environments.
You've finished Managing Remote Access and VPN Profiles. Continue through the MD-102 study guide to build a complete picture of the exam.
Done with this chapter?