Back to all blogs

Hybrid Deployment Model: Microsoft Always On VPN + Microsoft SASE (Secure Access Service Edge)

Hybrid Deployment Model: Microsoft Always On VPN + Microsoft SASE (Secure Access Service Edge)

This hybrid model combines Microsoft Always On VPN (AOVPN) with Microsoft’s SASE (via Microsoft Entra Internet Access, Microsoft Entra Private Access, and Defender for Cloud Apps) to create a secure, scalable remote access solution. It integrates traditional VPN connectivity with modern cloud-delivered security, enabling Zero Trust principles while maintaining compatibility with legacy systems.

Key Components

1. Microsoft Always On VPN (AOVPN)

  • Provides persistent, device/user-tunneled VPN access to on-premises resources.
  • Uses IKEv2/IPsec or SSTP for encrypted connectivity.
  • Integrates with Microsoft Entra ID (Azure AD) for authentication.
  • Supports Conditional Access policies for risk-based access control.

2. Microsoft SASE Components

Microsoft’s SASE offering includes:

  • Microsoft Entra Internet Access (formerly Cloud App Security) – Secures internet-bound traffic with ZTNA, CASB, and SWG capabilities.
  • Microsoft Entra Private Access – Provides Zero Trust Network Access (ZTNA) to private apps without VPN.
  • Defender for Cloud Apps – Enforces DLP, threat protection, and SaaS app control.
  • Azure Virtual WAN + Firewall – Optional for SD-WAN and cloud firewall integration.

Hybrid Deployment Architectures

Option 1: AOVPN for Legacy, Microsoft SASE for Cloud & Internet

  • AOVPN → Used only for on-premises legacy apps (e.g., file servers, RDP, databases).
  • Microsoft SASE → Handles internet traffic, SaaS apps, and cloud resources with Zero Trust policies.
  • Traffic Steering:
    • Internal ERP/SQL → AOVPN.
    • Office 365, Azure, web → Entra Internet Access.

Option 2: Microsoft SASE as Primary, AOVPN as Fallback

  • Most users connect via Entra Private Access (ZTNA) for private apps.
  • AOVPN serves as a backup for legacy systems not yet migrated.

Option 3: Conditional Split Tunneling

  • AOVPN for specific internal apps only (split tunneling).
  • All other traffic → Secured by Microsoft SASE (Entra Internet Access + Defender for Cloud Apps).

Implementation Steps

1. Deploy & Configure Microsoft Always On VPN

  • Set up Windows Server with Routing and Remote Access (RRAS).
  • Configure device & user tunnels (IKEv2/IPsec).
  • Integrate with Microsoft Entra ID + Conditional Access for MFA & risk-based policies.

2. Enable Microsoft SASE Components

  • Microsoft Entra Internet Access → Enforce secure web gateway (SWG) policies for internet traffic.
  • Microsoft Entra Private Access → Replace VPN for private app access (ZTNA).
  • Defender for Cloud Apps → Monitor SaaS apps, prevent data leaks.

3. Define Traffic Routing Policies

  • Use Windows 11/10 VPN profiles to enforce split tunneling:
    • Route on-premises subnets via AOVPN.
    • Route 0.0.0.0/0 (internet) via Microsoft SASE.
  • Use Entra ID Conditional Access to require compliant devices for both VPN & SASE access.

4. Monitor & Optimize

  • Microsoft Sentinel → Correlate VPN + SASE logs.
  • Defender for Endpoint → Detect compromised devices attempting access.

Benefits of Microsoft AOVPN + SASE Hybrid Model

  • Zero Trust Security – No implicit trust; continuous validation via Entra ID.
  • Reduced VPN Load – Only legacy traffic uses VPN; everything else goes through SASE.
  • Cloud-Native Scalability – No on-prem bottlenecks for internet traffic.
  • Unified Policy Management – Single pane (Microsoft Entra Admin Center).
  • Better User Experience – Lower latency for cloud apps via SASE PoPs.

Challenges & Mitigations

ChallengeSolution
Legacy app dependenciesGradually migrate to Entra Private Access (ZTNA).
VPN performance bottlenecksOffload internet traffic to Microsoft SASE.
Policy conflictsUse Microsoft Intune to enforce consistent device compliance.

Conclusion

This hybrid Microsoft AOVPN + SASE model provides:

  • Secure legacy access via AOVPN.
  • Modern Zero Trust security via Microsoft Entra Internet/Private Access.
  • Smooth migration path from VPN to full SASE.

Best for enterprises:

  • Transitioning from VPN to Zero Trust.
  • Using Microsoft 365/Azure (native integration).
  • Needing both legacy and cloud app security.

more blogs