Understanding Microsoft AOVPN: Key Features and Benefits

Microsoft AOVPN stands for Microsoft Always On Virtual Private Network. It is a remote access solution that is built into Windows 10 and is designed to provide seamless and consistent connectivity for domain-joined, nondomain-joined, or Azure AD–joined devices¹. AOVPN allows users to access corporate resources securely over the internet, without the need for user interaction or manual configuration². AOVPN also supports various features and integrations, such as:

• Cryptography: AOVPN uses strong encryption algorithms and protocols, such as IKEv2, SSTP, and L2TP/IPsec, to protect the data in transit. AOVPN also supports certificate-based authentication, which eliminates the need for passwords and reduces the risk of credential theft².
• Conditional access: AOVPN can integrate with the Azure conditional access platform to enforce multifactor authentication (MFA), device compliance, or a combination of the two. This ensures that only authorized and compliant devices can access the VPN network¹.
• Windows Information Protection (WIP): AOVPN can work with WIP to control the flow of data between personal and work apps, and prevent data leakage or unauthorized sharing. WIP also automatically triggers AOVPN to connect when users access work apps or data¹.
• Windows Hello for Business: AOVPN natively supports Windows Hello for Business, which is a biometric authentication solution that replaces passwords with facial recognition or fingerprint scanning. Windows Hello for Business provides a seamless single sign-on experience for both sign-in to the device and connection to the VPN¹.

These are some of the main aspects of Microsoft AOVPN, but there are more details and nuances that are beyond the scope of this brief explanation. Microsoft AOVPN is meant to be the successor to DirectAccess, which is another remote access solution that has been used for years. However, AOVPN offers more flexibility, compatibility, and security than DirectAccess²³. Microsoft AOVPN is available in all Windows editions, and can be deployed and managed with various tools, such as PowerShell, Microsoft Endpoint Configuration Manager, Intune, Windows Configuration Designer, or any third-party mobile device management (MDM) tool¹.