Microsoft Intune device compliance policies - Cloud-based device compliance leverages Microsoft Intune Compliance Policies, which are capable of querying the device state and define compliance rules for the following, among other things. When that certificate expires, the client will again check with Azure AD for health validation before a new certificate is issued. Note that certificate authentication methods such as EAP-TLS can be used. If compliant, Azure AD sends back a short-lived certificate that is used to authenticate the VPN. See also Always On VPN deployment for Windows Server and Windows 10.Īzure AD-issued short-lived certificates - When a VPN connection attempt is made, the Azure AD Token Broker on the local device communicates with Azure Active Directory, which then checks for health based on compliance rules. The Azure AD CA cannot be configured as part of an on-premises Enterprise CA.

An Azure AD CA is essentially a mini-CA cloud tenant in Azure. Windows Health Attestation Service (optional)Īzure AD Certificate Authority - It is a requirement that the client certificate used for the cloud-based device compliance solution be issued by an Azure Active Directory-based Certificate Authority (CA). Conditional Access is an Azure AD Premium feature.Ĭonditional Access Platform components used for Device Compliance include the following cloud-based services:

Fortinet vpn client access other vlans