Anyconnect profile for cloud based AD

[abhijith891]

Hi All,

So far, we are using an Always On VPN where users are authenticated against an AD inside the client network. Now we are planning to deploy some users who will be authenticated against a MS Azure AD on the cloud. Our requirement is to create an XML profile where internet access has to be provided before the user gets connected via Anyconnect since there will be a compliance test of the machine against MS Azure. So can someone please suggest what all changes should we make on the XML profile? Sreenshots of the existing profile have been enclosed for reference. 

Also, should we make any other changes on the ASA firewall or the XML code?

PS: We are looking at a password-based authentication mechanism.

Regards.

[Mohammed al Baqari]

Hi,

Let me start with saying that authentication isn't between Azure and
client, instead its ASA will proxy authentication request to Azure. So
authentication with Azure will work even if the client don't have access to
it.

Now you can use dynamic split tunneling to exclude MS Azure from your VPN
traffic to allow direct communication between clients and Azure cloud for
other reasons (assuming you are tunneling all traffic)