Azure Compliance ControlsAzure VPN Gateway
VPN gateways should have point-to-site 'Authentication type' set to 'Azure Active Directory' only
VPN Gateway point-to-site connections should use Azure Active Directory authentication. The Azure Policy check says disabling local authentication methods ensures VPN Gateways use only Azure Active Directory identities for authentication.
What this control checks
VPN gateway point-to-site 'Authentication type' must be 'Azure Active Directory' only.
Framework mappings
The clauses this control is mapped to in each framework.
- 7.9 Ensure 'Authentication type' is set to 'Azure Active Directory' only for Azure VPN Gateway point-to-site configuration
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_virtual_network_gateway_aad_only - Powerpipe Control:
azure_compliance.control.network_virtual_network_gateway_aad_only - Azure Policy Definition:
21a6bc25-125e-4d13-b82d-2e19b7208ab7
Last reviewed: 2026-10-14