|
| 1 | +--- |
| 2 | +title: 'VPN Gateway: Azure AD tenant for P2S VPN connections: Azure AD authentication' |
| 3 | +description: You can use P2S VPN to connect to your VNet using Azure AD authentication |
| 4 | +services: vpn-gateway |
| 5 | +author: anzaman |
| 6 | + |
| 7 | +ms.service: vpn-gateway |
| 8 | +ms.topic: conceptual |
| 9 | +ms.date: 11/13/2019 |
| 10 | +ms.author: alzam |
| 11 | + |
| 12 | +--- |
| 13 | +# Create an Azure Active Directory tenant for P2S OpenVPN protocol connections |
| 14 | + |
| 15 | +When connecting to your VNet, you can use certificate-based authentication or RADIUS authentication. However, when you use the Open VPN protocol, you can also use Azure Active Directory authentication. This article helps you set up an Azure AD tenant for P2S Open VPN authentication. |
| 16 | + |
| 17 | +> [!NOTE] |
| 18 | +> Azure AD authentication is supported only for OpenVPN® protocol connections. |
| 19 | +> |
| 20 | +
|
| 21 | +## <a name="tenant"></a>1. Create the Azure AD tenant |
| 22 | + |
| 23 | +Create an Azure AD tenant using the steps in the [Create a new tenant](../active-directory/fundamentals/active-directory-access-create-new-tenant.md) article: |
| 24 | + |
| 25 | +* Organizational name |
| 26 | +* Initial domain name |
| 27 | + |
| 28 | +Example: |
| 29 | + |
| 30 | +  |
| 31 | + |
| 32 | +## <a name="users"></a>2. Create Azure AD tenant users |
| 33 | + |
| 34 | +Next, create two user accounts. Create one Global Admin account and one master user account. The master user account is used as your master embedding account (service account). When you create an Azure AD tenant user account, you adjust the Directory role for the type of user that you want to create. |
| 35 | + |
| 36 | +Use the steps in [this article](../active-directory/fundamentals/add-users-azure-active-directory.md) to create at least two users for your Azure AD tenant. Be sure to change the **Directory Role** to create the account types: |
| 37 | + |
| 38 | +* Global Admin |
| 39 | +* User |
| 40 | + |
| 41 | +## <a name="enable-authentication"></a>3. Enable Azure AD authentication on the VPN gateway |
| 42 | + |
| 43 | +1. Locate the Directory ID of the directory that you want to use for authentication. It is listed in the properties section of the Active Directory page. |
| 44 | + |
| 45 | +  |
| 46 | + |
| 47 | +2. Copy the Directory ID. |
| 48 | + |
| 49 | +3. Sign in to the Azure portal as a user that is assigned the **Global administrator** role. |
| 50 | + |
| 51 | +4. Next, give admin consent. Copy and paste the URL that pertains to your deployment location in the address bar of your browser: |
| 52 | + |
| 53 | + Public |
| 54 | + |
| 55 | + ``` |
| 56 | + https://login.microsoftonline.com/common/oauth2/authorize?client_id=41b23e61-6c1e-4545-b367-cd054e0ed4b4&response_type=code&redirect_uri=https://portal.azure.com&nonce=1234&prompt=admin_consent |
| 57 | + ```` |
| 58 | +
|
| 59 | + Azure Government |
| 60 | +
|
| 61 | + ``` |
| 62 | + https://login-us.microsoftonline.com/common/oauth2/authorize?client_id=51bb15d4-3a4f-4ebf-9dca-40096fe32426&response_type=code&redirect_uri=https://portal.azure.us&nonce=1234&prompt=admin_consent |
| 63 | + ```` |
| 64 | +
|
| 65 | + Microsoft Cloud Germany |
| 66 | +
|
| 67 | + ``` |
| 68 | + https://login-us.microsoftonline.de/common/oauth2/authorize?client_id=538ee9e6-310a-468d-afef-ea97365856a9&response_type=code&redirect_uri=https://portal.microsoftazure.de&nonce=1234&prompt=admin_consent |
| 69 | + ```` |
| 70 | +
|
| 71 | + Azure China 21Vianet |
| 72 | +
|
| 73 | + ``` |
| 74 | + https://https://login.chinacloudapi.cn/common/oauth2/authorize?client_id=49f817b6-84ae-4cc0-928c-73f27289b3aa&response_type=code&redirect_uri=https://portal.azure.cn&nonce=1234&prompt=admin_consent |
| 75 | + ``` |
| 76 | +
|
| 77 | +5. Select the **Global Admin** account if prompted. |
| 78 | +
|
| 79 | +  |
| 80 | +
|
| 81 | +6. Select **Accept** when prompted. |
| 82 | +
|
| 83 | +  |
| 84 | +
|
| 85 | +7. Under your Azure AD, in **Enterprise applications**, you see **Azure VPN** listed. |
| 86 | +
|
| 87 | +  |
| 88 | +
|
| 89 | +8. Enable Azure AD authentication on the VPN gateway by running the following commands, being sure to modify the command to reflect your own environment: |
| 90 | +
|
| 91 | + ```azurepowershell-interactive |
| 92 | + $gw = Get-AzVirtualNetworkGateway -Name <name of VPN gateway> -ResourceGroupName <Resource group> |
| 93 | + Set-AzVirtualNetworkGateway -VirtualNetworkGateway $gw -VpnClientRootCertificates @() |
| 94 | + Set-AzVirtualNetworkGateway -VirtualNetworkGateway $gw -AadTenantUri "https://login.microsoftonline.com/<your Directory ID>" -AadAudienceId "41b23e61-6c1e-4545-b367-cd054e0ed4b4" -AadIssuerUri "https://sts.windows.net/<your Directory ID>/" |
| 95 | + ``` |
| 96 | +
|
| 97 | +9. Create and download the profile by running the following commands. Change the -ResourcGroupName and -Name values to match your own. |
| 98 | +
|
| 99 | + ```azurepowershell-interactive |
| 100 | + $profile = New-AzVpnClientConfiguration -Name <name of VPN gateway> -ResourceGroupName <Resource group> -AuthenticationMethod "EapTls" |
| 101 | + $PROFILE.VpnProfileSASUrl |
| 102 | + ``` |
| 103 | +
|
| 104 | +10. After running the commands, you see a result similar to the one below. Copy the result URL to your browser to download the profile zip file. |
| 105 | +
|
| 106 | +  |
| 107 | +
|
| 108 | +11. Extract the downloaded zip file. |
| 109 | +
|
| 110 | +12. Browse to the unzipped “AzureVPN” folder. |
| 111 | +
|
| 112 | +13. Make a note of the location of the “azurevpnconfig.xml” file. The azurevpnconfig.xml contains the setting for the VPN connection and can be imported directly into the Azure VPN Client application. You can also distribute this file to all the users that need to connect via e-mail or other means. The user will need valid Azure AD credentials to connect successfully. |
| 113 | +
|
| 114 | +## Next steps |
| 115 | +
|
| 116 | +In order to connect to your virtual network, you must create and configure a VPN client profile. See [Configure Azure AD authentication for Point-to-Site connection to Azure](virtual-wan-point-to-site-azure-ad.md). |
0 commit comments