- My VPN gateway has the root certificate from my active directory installed
- Each client creates an AD client credentials certificate and downloads the VPN client in order to connect
- Our AD is federated into an AAD and is the trusted tenant in our Azure subscription
- Does any user who can create a valid client credentials AD certificate and download the VPN client have access to the VPN network?
- Does the user also need any Azure RBAC permissions defined in the VNet or Gateway in order to access it?
- When an employee leaves the company what steps need to be taken to make sure they no longer have access to the VPN network? Do we have to register their certificate thumbprint as a revoked cert or will the gateway check the AAD user and see that they are disabled?