---
title: >-
  Azure VPN Gateway point-to-site configuration should use only Azure Active
  Directory authentication
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Azure VPN Gateway point-to-site
  configuration should use only Azure Active Directory authentication
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Azure VPN Gateway point-to-site configuration should use only Azure Active Directory authentication
 
## Description{% #description %}

Azure VPN gateways with a point-to-site configuration should allow only Microsoft Entra ID authentication. Entra ID authentication provides centralized identity management and Conditional Access, and removes the risks of static certificates and RADIUS shared secrets. This rule skips virtual network gateways that are not VPN gateways or have no point-to-site configuration.

## Remediation{% #remediation %}

Set the gateway's point-to-site authentication type to Microsoft Entra ID only, and remove Azure certificate and RADIUS authentication. See [Configure P2S VPN gateway for Microsoft Entra ID authentication](https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-gateway).

## References{% #references %}

- [Configure P2S VPN gateway for Microsoft Entra ID authentication](https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-gateway)
- [About Azure point-to-site VPN connections](https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about)
- [CIS Microsoft Azure Foundations Benchmark](https://www.cisecurity.org/benchmark/azure)