So at this point,
you've learned how to provision Always On VPN client configuration
settings using Intune and the VPN template using the UI,
walking through the wizard, if you want to call it that,
and then, of course,
we've learned how to deploy an XML configuration file using PowerShell.
It is possible to deploy that XML configuration file using Intune.
This is kind of a hybrid model, it's a combination of the two,
and you can use XML within Intune for both device and user tunnels,
as long as you know the correct OMA‑URI, and I'll
explain that a little more shortly.
It does require that you use the custom template,
not the VPN template,
and the reason you might want to do this is because using
XML exposes some additional settings that are not
available to you in the Intune UI.
So if you're using the VPN template,
there may be some things that you want to define or change or
set that are just simply not in the Intune UI,
so you have to do it through XML.
And you're going to see that in detail in the next module.
For now,
I want to show you how to deploy the XML file that you were
deploying locally with PowerShell previously,
and I want to show you how to push that XML file out using Intune.
So let's get on to this demonstration,
and I'll show you how to deploy a user tunnel and a
device tunnel using XML with Intune.
Back in the Microsoft Endpoint Manager admin center,
we'll click on Devices and Configuration profiles.
And here you'll see that we have are Always On VPN device
tunnel and user tunnels that we provisioned in an earlier
lesson using the Intune UI.
These are listed as profile type VPN.
We're going to do this a little differently now, so
we're going to click Create profile,
and we'll select Windows 10 and later as our
platform and a Templates profile type.
And here, instead of selecting VPN as we did previously,
we're actually going to select Custom this time,
so we'll click Create.
We'll provide a name here.
And by the way, this is not how it appears in Windows,
this is simply an administrative name, so you can call it whatever you like.
You can provide a description if you like as well,
then we'll choose Next, and then we'll click Add for our OMA‑URI Settings.
Here we'll provide a name, and once again,
this is just an administrative name, not how it appears in Windows.
You can enter a description if you like.
And then next,
we need to provide the OMA‑URI or the target location for the settings we
want to deploy for this specific Always On VPN profile.
The OMA‑URI that you choose depends on which tunnel you want to deploy,
whether it's a user tunnel or a device tunnel.
The OMA‑URI for the user tunnel is
./User/Vendor/MSFT/VPNv2/Example%20Profile%20Name is what I'm using
here.
This is the name as it appears in Windows.
This is what will actually show up in the UI on the client.
And so, the XML does not accept spaces,
so you must escape them with the %20 character.
So if you choose to use spaces in your name,
then you must use the %20 characters in place of the spaces.
If you don't want to use spaces, great,
you can avoid this by just calling it a name without
spaces like AOVPN and then /ProfileXML.
So the OMA‑URI that you enter in Intune should look exactly
like this except for with your specific name.
And the difference between the user and the device
tunnel is the prefix ./User or ./Device,
and the rest of it is functionally the same.
In the previous lessons, when we deployed the XML using PowerShell,
we used Always On VPN as the name of the user tunnel and Always On
VPN device tunnel as the name of the device tunnel,
and we'll use those here in our examples.
So I'm going to copy and paste the OMA‑URI here for the user tunnel,
so that's ./User.
And again, just to drive that point home,
the dot, that trailing dot or leading dot,
I should say, is critical.
If everything looks good, the UI will, of course, validate it for you.
Next we'll choose data type, and we'll choose String XML.
We'll click on the little blue folder here,
and we will just simply select our XML file that we used in that
previous lesson to deploy with PowerShell.
So we'll click Open.
And if everything looks good, should be no errors here.
If there's an issue with the syntax in your XML,
this UI will complain, so it does validate this XML.
It doesn't validate the settings, just the syntax, right?
So if you've missed a tag or added something incorrectly,
it will appear as an error here.
So once you're done, go ahead and click Save.
And at this point, I should probably drive home the fact that this XML file,
before you push it out with Intune,
it's always best to use the PowerShell technique to at least test it locally.
You want to make sure that your syntax is correct,
that all the settings are functioning as expected,
and that it's working before you deploy it broadly using Intune.
So once this is done, we'll click Next.
We'll add our group.
This is a user tunnel, so I'm going to find my VPN Users group,
Select, Next, Next, and Create.
And that's it.
So this is going to go out to that target group.
Now, to deploy a device‑based connection, it is almost identical.
So we'll go to Devices, Configuration profiles,
and then we'll click Create profile again,
Windows 10 and later, Templates, Custom,
Create, ,ive this one a different name, choose Next.
We'll click Add, provide a name again.
And then this time, I'll paste in the OMA‑URI
relating to the device‑based connection,
so ./Device and then the name of my profile there as you see it.
We'll select our String XML, and this time we will select our Device XML.
Click Open, Save,
Next, nd we'll assign this to our VPN Devices group because this
is a device‑based connection, click Select,
Next, and Create.
And at this point,
you should now see that we have our VPN profiles deployed using the custom profile type.