VPN auto-triggered profile options
With auto-triggered VPN profile options, Windows can automatically establish a VPN connection based on IT admin-defined rules. Learn about the types of auto-trigger rules that you can create for VPN connections.
Windows can use different features to auto-trigger VPN, avoiding users to manually connect when VPN is needed to access necessary resources. There are three different types of auto-trigger rules:

Application trigger

Name-based trigger

Always On

Application trigger

VPN profiles can be configured to automatically connect on the execution of certain applications:

You can configure desktop or Universal Windows Platform (UWP) apps to trigger a VPN connection

You can configure per-app VPN and specify traffic rules for each app

For more information, see Traffic filters.

Name-based trigger

You can configure a domain name-based rule so that a specific domain name triggers the VPN connection.

Name-based auto-trigger can be configured using the VPNv2/<ProfileName>/DomainNameInformationList/dniRowId/AutoTrigger setting in the VPNv2 Configuration Service Provider (CSP).

There are four types of name-based triggers:

Short name: for example, if HRweb is configured as a trigger, and the stack sees a DNS resolution request for HRweb, the VPN triggers

Fully qualified domain name (FQDN): for example, if HRweb.corp.contoso.com is configured as a trigger, and the stack sees a DNS resolution request for HRweb.corp.contoso.com, the VPN triggers

Suffix: for example, if .corp.contoso.com is configured as a trigger, and the stack sees a DNS resolution request with a matching suffix (such as HRweb.corp.contoso.com), the VPN triggers. For any short name resolution, VPN triggers, and the DNS servers are queried for the <ShortName>.corp.contoso.com

All: if used, all DNS resolution triggers VPN

Always On

Always On is a Windows feature that enables the active VPN profile to connect automatically on the following triggers:

User sign-in

Network change

Device screen on

When the trigger occurs, VPN tries to connect. If an error occurs, or any user input is needed, the user sees a toast notification for more interaction.

When a device has multiple profiles with Always On triggers, the user can specify the active profile in Settings > Network & Internet > VPN > <VPN profile> by selecting the Let apps automatically use this VPN connection checkbox. By default, the first MDM-configured profile is marked as Active. Devices with multiple users have the same restriction: only one profile, and therefore only one user, is able to use the Always On triggers.

Preserving user Always On preference

Another Windows feature is to preserve a user's Always On preference. If a user manually unchecks the Connect automatically checkbox, Windows remembers the user preference for the profile name by adding the profile name to the registry value AutoTriggerDisabledProfilesList.

If a management tool removes or adds the same profile name back and set AlwaysOn to true, Windows doesn't check the box if the profile name exists in the following registry value, in order to preserve user preference.

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config

Value: AutoTriggerDisabledProfilesList

Type: REG_MULTI_SZ

Trusted network detection

The Trusted network detection feature configures the VPN so that connection isn't triggered when a device is on a trusted network. To configure Trusted network detection, you must provide a list of DNS suffixes. The VPN stack verifies the network name of the physical interface connection profile: if it matches any of the suffixes configured in the list and the network is private or provisioned by MDM, then VPN doesn't trigger.

Trusted network detection can be configured using the VPNv2/<ProfileName>/TrustedNetworkDetection setting in the VPNv2 CSP.

Configure app-triggered VPN

See VPN profile options and VPNv2 CSP for XML configuration.

The following image shows associating apps to a VPN connection in a VPN Profile configuration policy using Microsoft Intune.