Always On VPN is still supported on Windows Server 2025 and Windows 11 — but Microsoft has stopped investing in it, DirectAccess is formally deprecated in the same release, and every new engineering euro goes to Entra and cloud-delivered access instead. If you migrated from DirectAccess to AOVPN, you landed on a platform in maintenance mode. The real question for 2026 is not whether AOVPN works today, but which of the three exits you take before the next forced move.
Key takeaways
- AOVPN is supported but strategically sidelined: Microsoft states its remote-access investments now go to Entra Private Access and Global Secure Access, positioning AOVPN as transitional technology.
- The operational pain is structural, not incidental: AD CS certificates, NPS/RADIUS policies, IKEv2 blocked by hotel Wi-Fi and CGNAT, and SSTP fallback that triggers TCP-over-TCP throughput collapse.
- The RRAS gateways behind AOVPN logged at least fourteen high-severity CVEs between 2024 and 2026, most rated CVSS 8.8 and several allowing unauthenticated remote code execution.
- Microsoft’s successor costs real money: standalone Entra Private Access at $5/user/month on top of a mandatory Entra ID P1 base, or the $12 Entra Suite — and it locks access policy to Entra ID.
- Gartner projected 70% of new remote-access deployments on ZTNA rather than VPN by 2025–2026, up from under 10% in 2021; the third path is a vendor-neutral platform that drops both the PKI burden and the Microsoft lock-in.
Where does Always On VPN officially stand in 2026?
Windows Server 2025 marks the end of DirectAccess, which is deprecated and slated for removal in future releases — the story covered in our DirectAccess migration guide. AOVPN itself remains fully supported, but Microsoft has halted core architectural enhancements and says so openly: ongoing investment in secure remote connectivity is directed at cloud-native identity and the Global Secure Access portfolio, because static-perimeter VPN architectures “fail to align with modern enterprise Zero Trust requirements”, as documented by Richard Hicks’ analysis of the Server 2025 lifecycle. Supported-but-frozen is a familiar phase to anyone who ran DirectAccess after 2016. It ends the same way.
Why running AOVPN hurts, mapped to root causes
The pain points admins report are not configuration mistakes — they are the architecture.
| Pain point | What users experience | Root cause |
|---|---|---|
| Certificate failures | Sudden lockouts, helpdesk spikes | AD CS auto-enrollment breaks, expired CA roots, unreachable CRL endpoints; Entra Conditional Access integration even needs 60-minute IPsec certificates synced across Intune, Entra and the CA |
| RADIUS fragility | Connections drop after policy changes | NPS policies depend on error-prone vendor-specific attributes (Allowed-Certificate-OID) |
| IKEv2 blocked on the road | Mobile users fail from hotels, public Wi-Fi, 4G | UDP 500/4500 and IPsec ESP dropped by restrictive firewalls and carrier-grade NAT |
| SSTP fallback crawls | Latency spikes, stuttering calls | PPP inside TCP 443 causes TCP-over-TCP meltdown: competing retransmission timers destroy throughput |
| Device vs user tunnel quirks | Pre-logon management breaks off-site | Device tunnel is IKEv2-only (no fallback), requires Windows Enterprise/Education and domain join; dual ProfileXML files drift |
| Troubleshooting marathons | Hours per incident | Diagnostics scattered across CAPI2, RasClient, NPS audit and Intune OMA-URI logs |
| Windows-only reality | macOS/Linux second-class | Advanced profile management and device tunnels are Windows-exclusive |
Two structural gaps sit beneath all of this. First, AOVPN is a network-level tunnel: once connected, the endpoint holds an internal IP with broad subnet routing, and although TrafficFilterList app-filtering exists in the XML schema, it is so brittle that most mid-market deployments run broad routing in practice — lateral-movement exposure by default. Second, there is no inline security: no SWG, CASB or DLP, so internet traffic either bypasses inspection via split tunneling or backhauls through head office at painful cost.
How exposed is the RRAS gateway itself?
The server role terminating AOVPN connections must listen on the public internet, and it has been a reliable Patch Tuesday customer. Between 2024 and 2026, RRAS logged a run of high-severity flaws including CVE-2024-43608, CVE-2024-49085/49086, CVE-2024-49125 and CVE-2025-24051 (all CVSS 8.8 remote code execution), the unauthenticated heap overflow CVE-2025-49657 exploitable over RADIUS and L2TP ports, CVE-2025-62549 (December 2025) and CVE-2026-25172 (March 2026, CVSS 8.0). Fourteen high-severity entries in thirty months is not an outlier streak; it is the running cost of exposing a Windows service to the internet. Every one of them lands on the same box that holds your remote-access keys.
The three paths out
| Dimension | Stay on AOVPN | Entra Private Access | Vendor-neutral ZTNA/SASE |
|---|---|---|---|
| Architecture | Network tunnel via RRAS | Identity-centric ZTNA via outbound connectors | Identity-aware proxy, per-app micro-segmentation |
| Infrastructure to run | RRAS, NPS, AD CS PKI, load balancers, public IPs | Connectors on Windows Server; Microsoft cloud edge | Lightweight connectors; cloud edge |
| Identity provider | On-prem AD + RADIUS + certificates | Entra ID only | Any IdP (Entra, Okta, Google, SAML/OIDC) |
| Cross-platform | Windows-native; weak elsewhere | GSA client, Windows-centric; web proxy for the rest | Full parity Windows/macOS/Linux/mobile + agentless browser access |
| Inline security (SWG/DLP) | None | Basic; Internet Access add-on | Integrated in SASE platforms |
| Licence cost logic (as of Aug 2026) | Server licences + heavy admin hours | $5/user/month + mandatory Entra ID P1 (~$7), or $12 Suite | Published market range $5–$10/user/month; flat EU options |
| EU sovereignty | On-prem, but high operational risk | US hyperscaler; CLOUD Act exposure | EU-hosted sovereign options available |
Path two deserves an honest word: Entra Private Access genuinely fixes the inbound-port problem and reuses your Conditional Access investment. But it swaps PKI lock-in for identity-plane lock-in — policies evaluate exclusively through Entra ID, non-Windows endpoints lean on web proxying, and your access traffic routes through a US-headquartered hyperscaler with CLOUD Act exposure regardless of EU data-centre locations. You leave one dependency and buy another.
What about the device tunnel? The pre-logon question
The strongest technical argument for keeping AOVPN is pre-logon connectivity: domain controller line-of-sight for Group Policy and password resets before a user signs in. Two modern answers exist. Either shift device management to Intune/Autopilot, which delivers policy over plain HTTPS with no domain line-of-sight needed — Microsoft’s own recommended direction — or use a ZTNA machine tunnel: a system-level service that comes up at boot with micro-segmented access strictly to the domain controllers, nothing else. Both remove the last dependency that keeps RRAS alive, and both fit the coexistence pattern: run ZTNA connectors alongside the VPN, migrate user groups in cohorts, strip the user-tunnel auto-trigger from the Intune profile, and tear down RRAS last. The broader sequencing is covered in the complete VPN-to-ZTNA migration guide.
What does NIS2 make of it?
NIS2 Article 21 expects access-control policies, MFA or continuous authentication, and secured communications. AOVPN authenticates once at session start; if device health degrades mid-session, the tunnel stays open — there is no continuous, context-aware re-evaluation. Add an internet-exposed RRAS gateway with the CVE record above and the compliance picture writes itself: per-request ZTNA evaluation of identity, posture and risk aligns with the directive natively, while a static tunnel needs compensations. The same logic applied in the IPsec-versus-ZTNA comparison applies here unchanged.
Retire the architecture, not just the feature
DirectAccess taught Windows teams what “deprecated” means in practice; AOVPN’s “supported but frozen” is the preceding chapter of the same book. If you are going to move — and 70% of new deployments already have — move once: not to Microsoft’s next transitional product with its own lock-in and jurisdiction questions, but to an architecture that ends the cycle. For EU mid-market teams, Jimber is the vendor-neutral version of that move: per-application ZTNA with no PKI, no NPS and no exposed gateway, full support for mixed Windows/macOS/Linux estates plus agentless access for the devices that fit no client, EU-sovereign infrastructure outside CLOUD Act reach, and one flat licence instead of a licensing stack. Book a demo to map your AOVPN profiles to per-app policies — the certificate renewal calendar can retire with the RRAS boxes.
Frequently asked questions
Is Always On VPN officially deprecated in 2026?
No. AOVPN remains supported on Windows Server 2025 and Windows 11. But DirectAccess is officially deprecated in the same release, and Microsoft has moved its remote-access engineering investment to Entra Private Access and Global Secure Access, leaving AOVPN in a maintenance lifecycle with no structural feature development.
What is the main difference between AOVPN and Entra Private Access?
AOVPN builds a network-level IPsec or SSTP tunnel that places the device on the internal subnet. Entra Private Access is a ZTNA broker: outbound connectors publish specific applications, users get per-app access, and no inbound firewall ports exist. The trade-off is exclusive dependence on Entra ID and the Microsoft cloud edge.
Why does IKEv2 keep failing for travelling users?
IKEv2 needs UDP ports 500 and 4500 plus IPsec ESP. Hotel networks, public Wi-Fi and carrier-grade NAT routinely block or drop exactly that traffic, forcing the client onto the SSTP fallback.
Why is the SSTP fallback so slow?
SSTP wraps PPP frames inside TCP port 443. Running user TCP sessions inside another TCP connection creates TCP-over-TCP meltdown: the two layers’ retransmission timers fight each other, amplifying packet loss into throughput collapse and latency spikes.
What licences does Entra Private Access require?
As of August 2026: $5 per user per month standalone, on top of a mandatory Entra ID P1 base (about $7), with device-posture enforcement requiring Intune. The bundled Entra Suite is $12 per user per month. Verify current Microsoft pricing at renewal — it moves.
How do we keep pre-logon device management without the AOVPN device tunnel?
Either move device management to Intune/Autopilot, which works over plain HTTPS without domain-controller line-of-sight, or deploy a ZTNA machine tunnel that starts at boot and grants micro-segmented access only to the domain controllers for authentication traffic.
Can a vendor-neutral ZTNA platform work with our existing Active Directory and Entra ID?
Yes. Vendor-neutral platforms integrate with Entra ID, on-prem AD, Okta and Google Workspace over standard SAML 2.0 and OIDC, and run in parallel with AOVPN during a phased migration — no identity migration required.
Is an internet-facing RRAS server actually dangerous?
The record says yes: at least fourteen high-severity RRAS vulnerabilities were disclosed between 2024 and 2026, most rated CVSS 8.8, including unauthenticated remote-code-execution flaws such as CVE-2025-49657. An exposed Windows service that terminates all remote access is a standing target.
