VPN gateways should have point-to-site 'Authentication type' set to 'Azure Active Directory' only
VPN Gateway point-to-site connections should use Azure Active Directory authentication. The Azure Policy check says disabling local authentication methods ensures VPN Gateways use only Azure Active Directory identities for authentication.
Disabling local authentication methods improves security by ensuring that VPN Gateways use only Azure Active Directory identities for authentication.
What this control checks
VPN gateway point-to-site 'Authentication type' must be 'Azure Active Directory' only.
Common pitfalls
Default effect is Audit
The effect parameter allows Audit, Deny and Disabled, with a defaultValue of Audit.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "VPN gateways should use only Azure Active Directory (Azure AD) authentication for point-to-site users" (21a6bc25-125e-4d13-b82d-2e19b7208ab7); PowerPipe control azure_compliance.control.network_virtual_network_gateway_aad_only.
Framework-specific interpretation
CIS Azure Benchmark v5.0.0: Mapped to 7.9 (Ensure 'Authentication type' is set to 'Azure Active Directory' only for Azure VPN Gateway point-to-site configuration).
Framework mappings
The clauses this control is mapped to in each framework.
- 7.9 Ensure 'Authentication type' is set to 'Azure Active Directory' only for Azure VPN Gateway point-to-site configuration
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_virtual_network_gateway_aad_only - Powerpipe Control:
azure_compliance.control.network_virtual_network_gateway_aad_only - Azure Policy Definition:
21a6bc25-125e-4d13-b82d-2e19b7208ab7
Last reviewed: 2026-10-14