So in terms of provisioning and managing our endpoints for Always On VPN,
as I just mentioned,
the preferred method is using Microsoft Endpoint Manager or Intune.
It's important to understand that Always On VPN as a workload was
designed to be managed using Endpoint Manager or Intune,
so that's going to be the best administrative experience and
it's going to be the path of least resistance to deploying and
managing our Always On VPN profiles.
It is possible to use SCCM, however, it's important to understand that with SCCM,
although you can provision VPN profiles using the native management tools,
you cannot natively deploy Always On VPN profiles.
So with SCCM,
you will have to use a PowerShell script and XML
configuration file and then you will wrap that up and
deliver that to your endpoints via SCCM,
and of course,
the PowerShell script could be run just directly on an endpoint if
you have just a handful of endpoints to manage,
you could certainly run those ad hoc on those
devices to configure Always On VPN.
Without a doubt,
the cloud integration features and capabilities with
Always On VPN are really important.
When we enable cloud integration,
we have the advantage of using a variety of different identities,
specifically, we can use native Azure AD accounts,
but we can also use on‑premises Active Directory accounts,
or we can use a combination of the two.
We can use on‑premises AD accounts that have been
synchronized with Azure AD as well.
When we integrate with the cloud, and specifically,
Azure,
we get the advantage of using a conditional access so we can apply
conditional access policies to our VPN access,
and we can also leverage proactive remediation,
which is a feature of Intune,
and we can use this capability to finetune the VPN configuration settings post deployment.