Always On VPN

Answer: Always On VPN supports user-tunnel deployments across Windows Pro, Enterprise, and Education. Device tunnels and certain advanced scenarios require Enterprise or Education, so the tunnel type must be part of the edition decision.

Administrator playbook

Decide, verify, and document

Use the curated answer as a starting point, then prove the outcome against the target tenant or device.

What it means

Always On VPN can use built-in Windows VPN clients and standard VPN protocols
User and device tunnels solve different connectivity and sign-in requirements
Microsoft recommends Always On VPN instead of DirectAccess for new deployments

What to check next

Choose user tunnel, device tunnel, or both before validating the client edition
Confirm certificate, authentication, routing, name-resolution, and VPN-gateway requirements
Test pre-sign-in connectivity and manage-out behavior separately from an ordinary user connection

Verify success

Confirm the feature is present or enabled on the target edition and build.
Test the intended workflow with a pilot device and least-privileged user.
Confirm policy reports success from the actual management authority.

Escalate when

The documented edition and hardware requirements are met but the feature is absent.
Policy reports success while the user or device state is incorrect.
Licensing or OEM terms—not technical prerequisites—control the outcome.

Copyable admin briefAnswer, next checks, source, and review date

Capture edition and build

Get-ComputerInfo | Select-Object WindowsProductName,WindowsVersion,OsBuildNumber,OsArchitecture

Read-only. Edition and exact build often control availability.

List optional feature state

Get-WindowsOptionalFeature -Online | Where-Object State -ne "Disabled" | Select-Object FeatureName,State

Read-only. Not every Windows capability is represented as an optional feature.

Evidence to preserve

Windows edition, version, and build
Hardware and firmware prerequisites
Management authority and policy source
Required user or device experience

← Search another