So,
the use case is we've got an Azure virtual network that has VMs and
other resources that we need our local users to access.
Those local users or some local users are potentially remote,
so we're talking Point‑to‑Site VPN tunnels.
And the constraint here is that those users need to
authenticate the Point‑to‑Site tunnel using their local Active
Directory Domain Services identities that have not been
synchronized into Azure Active Directory.
What's required?
Well,
notice first of all that we can create this kind of
connection with all of the different tunnel types.
You can do SSTP, you can do IKE, you can do OpenVPN if you want to,
but the secret sauce to the configuration occurs in your on‑premises Active
Directory Domain Services domain in which you need at least one Windows server
that has the Network Policy Server role installed.
The NPS console, the NPS capability gives you RADIUS server ability.
Now, RADIUS is a client/server protocol,
so we'll need to set up the NPS policy server as a server that will link
authentication requests to Azure to AD Domain Services.
Now how does that link happen?
Well, you create, in Azure,
a RADIUS client entry that maps to the virtual network gateway in Azure.
So in this context,
the client on the RADIUS side is actually the Azure VPN gateway,
the RADIUS server is the Network Policy Server,
and your authenticator is the domain controller in your environment.
Make sense?
We don't have to get too far into the high weeds here. I just need you to know the general flow on how that works.