3.2.3. Always On VPN and Azure Network Adapter
Two client-side ways of reaching a virtual network that both sit on top of an ordinary point-to-site gateway. Neither is a new gateway type, which is the point the exam tests.
Always On VPN is the Windows client feature that replaced DirectAccess. The tunnel connects automatically as soon as the device has a network, before or after user sign-in depending on whether you deploy a device tunnel or a user tunnel. On the Azure side it needs nothing exotic: a route-based VPN gateway configured for point-to-site with IKEv2, authenticating by certificate or RADIUS. The "Always On" behaviour is configured on the Windows client through a profile, not in Azure.
⚠️ Exam Trap: Always On VPN cannot use Microsoft Entra ID authentication. Entra ID is supported only on the OpenVPN tunnel type and requires the Azure VPN Client, whereas Always On is built on the native Windows VPN client. An option pairing Always On with Entra ID is therefore always wrong, however plausible it reads.
Azure Network Adapter connects a single Windows Server to a virtual network from Windows Admin Center, which builds the point-to-site connection for you rather than making you assemble the client configuration by hand. It still requires a VPN gateway in the target virtual network.
💡 First Principle: Both answers are "point-to-site, configured from the client end". If a question offers Always On VPN or Azure Network Adapter as an alternative to point-to-site, that framing is the distractor — they are ways of consuming it.
