The last piece of consideration for Always On VPN infrastructure
planning is client provisioning and management.
How are we going to get our Always On VPN client
settings to our endpoints in the field?
Here administrators have a number of options available to them.
The first is Microsoft Endpoint Manager,
and honestly,
this is probably the best choice because Always On VPN as a
workload is designed to be managed using a mobile device
management platform like Intune.
Using Intune Endpoint Manager provides the best administrative experience
and probably provides the best scalability as well.
It allows you to provision your settings to a mass number
of users very quickly and very easily.
Another option is to use PowerShell.
Now, PowerShell is helpful for, you know, local testing and evaluation.
It might make sense to install a configuration file locally using
PowerShell just to make sure that it works,
and it doesn't make sense to create an XML configuration
file and deploy that using Intune if only to find out that
it doesn't work correctly.
So in this case, you can install that configuration file locally,
do some evaluation testing, and then once it's been certified as operational,
then you can publish that using Intune.
It also works well in small deployments where you only
have to touch a handful of machines,
of course. And if you plan to use System Center Configuration Manager or SCCM,
then PowerShell is what you'll use there.
You'll deploy the PowerShell script and XML configuration file as a package with SCCM and push that out to your endpoints accordingly.