So now I want to change gears just a bit and talk about provisioning Always
On VPN client configuration settings using PowerShell.
Now,
you've heard me say that Intune is really the tool of
choice and the platform of choice to manage Always On VPN
client configuration settings.
There's no doubt about that.
Always On VPN as a workload is designed to be managed
using MDM and specifically Intune.
It is definitely the path of least resistance.
It provides the best administrative experience.
It is definitely the way to go.
However, it is, as I said, not the only way to go,
and there are some scenarios in which you may decide to use PowerShell.
It may be better or more convenient or just a better fit for you.
The first kind of common use case for deploying Always On
VPN using PowerShell is local testing.
So you may have an Always On VPN configuration profile
that you're going to deploy using Intune,
and I'm going to talk about that deployment scenario a little bit later,
but it is possible to create an XML configuration file
and then simply upload that to Intune.
And if you want to make sure that that XML file is working,
that it's functional and that it's configured properly and works as expected,
you'll want to test that before you upload it to Intune and push it out broadly.
So in that scenario, it makes sense to build the XML file.
Install it locally on a test client with PowerShell,
maybe on a couple of other machines,
just make sure it's all working before you ship it out broadly using Intune.
Also, you may simply have a small deployment, right?
In other words, maybe you only have a handful of users,
5 or 10 or 15, and it makes sense to, you know,
just deploy it with PowerShell as opposed to undertaking a,
you know, a large‑scale Intune deployment.
It might be less effort just to simply run a PowerShell script on a
handful of machines and then just call it a day.
So I've done that for customers in the past, and it works quite well.
If you are using SCCM or any non‑Microsoft management platforms,
none of these support Always On VPN profiles natively.
So if you're deploying Always On VPN using SCCM or something like a PDQ or a
whole variety of other management platforms out there,
then you will do so using PowerShell in the XML configuration file I'll describe here shortly.