Microsoft 365 VPN split tunnelling
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/microsoft-365-docs · commit 1118e79 · +2 −2 lines · also on GitHub
⋯ 137 unchanged lines
138138
In addition to the tenant restrictions feature noted in Q1, [conditional access policies](/azure/active-directory/conditional-access/overview) can be applied to dynamically assess the risk of an authentication request and react appropriately. Microsoft recommends the [Zero Trust model](https://www.microsoft.com/security/zero-trust?rtc=1) is implemented over time and we can use Azure AD conditional access policies to maintain control in a mobile and cloud-first world. Conditional access policies can be used to make a real-time decision on whether an authentication request is successful based on numerous factors such as:
139139
140140
- Device, is the device known/trusted/Domain joined?
141
−- IP – is the authentication request coming from a known corporate IP address? Or from a country we do not trust?
141
+- IP – is the authentication request coming from a known corporate IP address? Or from a country/region we do not trust?
142142
- Application – Is the user authorized to use this application?
143143
144144
We can then trigger policy such as approve, trigger MFA or block authentication based on these policies.
⋯ 20 unchanged lines
165165
166166
### Does this advice apply to users in China using a worldwide instance of Microsoft 365?
167167
168
−**No**, it does not. The one caveat to the above advice is users in the PRC who are connecting to a worldwide instance of Microsoft 365. Due to the common occurrence of cross border network congestion in the region, direct Internet egress performance can be variable. Most customers in the region operate using a VPN to bring the traffic into the corporate network and utilize their authorized MPLS circuit or similar to egress outside the country via an optimized path. This is outlined further in the article [Microsoft 365 performance optimization for China users](microsoft-365-networking-china.md).
168
+**No**, it does not. The one caveat to the above advice is users in the PRC who are connecting to a worldwide instance of Microsoft 365. Due to the common occurrence of cross border network congestion in the region, direct Internet egress performance can be variable. Most customers in the region operate using a VPN to bring the traffic into the corporate network and utilize their authorized MPLS circuit or similar to egress outside the country/region via an optimized path. This is outlined further in the article [Microsoft 365 performance optimization for China users](microsoft-365-networking-china.md).
169169
170170
### Does split-tunnel configuration work for Teams running in a browser?
171171
⋯ 29 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/microsoft-365-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 05:49 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.