Your firewall inspects everything. Tunnel client sessions cannot be inspected, and doing it anyway makes them fail.
Microsoft Tunnel is a VPN gateway running in a container on Linux, giving iOS, iPadOS and Android Enterprise devices access to on-premises resources with modern authentication and Conditional Access. The design constraints are specific and documented, and two of them decide whether it fits your network at all.
- iOS and AndroidEnterprise mobile platforms only
- Container on LinuxOn-premises, or cloud with ExpressRoute
- No break and inspectClient sessions cannot be terminated
- 500 rulesSplit tunnelling, shared across include and exclude
Seven things to establish before anybody builds a Linux server.
Break and inspect is not supported, and it does not degrade gracefully
Microsoft is unambiguous. Tunnel Gateway does not support SSL break and inspect, TLS break and inspect, or deep packet inspection for client connections, and the use of firewalls, proxies, load balancers or any technology that terminates and inspects client sessions going into the gateway is not supported and causes client connections to fail. In enterprise networks that inspect everything, this is the first conversation.
It does not use FIPS compliant algorithms
Microsoft states this in a single-sentence note: Microsoft Tunnel does not use Federal Information Processing Standard compliant algorithms. For most UAE commercial organisations that is not a constraint. For anyone whose obligations reference FIPS validation, it is a scoping fact that belongs at the start of the evaluation rather than after a server has been built.
A container on Linux, physical or virtual, on-premises or cloud
The gateway installs into a container running on a Linux server, which can be a physical box on-premises or a virtual machine running on-premises or in the cloud. Microsoft notes that where the tunnel is hosted in the cloud you need a solution such as Azure ExpressRoute to extend your on-premises network to it, which is a material cost and design consideration.
Servers group into Sites, with a shared server configuration
Multiple Linux servers can support the tunnel and are combined into logical groups called Sites, with each server joining a single Site. A Site defines the connection point devices use, carries a public IP address or fully qualified domain name which can belong to a load balancer, and applies one server configuration to every server in it, which simplifies adding more.
Two channels, one port, and a split tunnelling budget
A control channel is established over TCP and TLS, which also serves as a backup data channel, then a UDP channel using datagram TLS serves as the main data channel, with port 443 used by default for both. Split tunnelling allows up to 500 rules shared across include and exclude routes, so 300 include rules leaves 200 exclude rules.
Per-app VPN, and a mode where users never open the app
The VPN profile defines which applications use the tunnel and whether it is always on, and Microsoft notes that if no applications are defined, an always-on connection carries all network traffic from the device. On iOS with per-app VPN and TunnelOnly mode set to true, users do not need to open or sign in to Defender for the tunnel to be used, though TunnelOnly disables the Defender functionality.
Conditional Access is enforced, and rooted Android is blocked
Conditional Access is performed in the VPN client against the Microsoft Tunnel Gateway cloud application, and non-compliant devices do not receive an access token from Entra so cannot reach the VPN server. Separately, the Defender client automatically blocks access if it identifies a rooted Android device, immediately marking risk as high and dropping active connections.
If your security team inspects all traffic, Tunnel will not work through that inspection.
Microsoft states the limitation in three separate places, and the failure mode is connections that do not work rather than connections that work slowly.
- Quoted: Tunnel Gateway does not support SSL break and inspect, TLS break and inspect, or deep packet inspection for client connections.
- Quoted: the use of firewalls, proxies, load balancers, or any technology that terminates and inspects the client sessions that go into the Tunnel Gateway is not supported and causes client connections to fail.
- There is a second, less obvious case. If the gateway itself uses an outbound proxy for internet access, that proxy cannot perform break and inspect either, because the management agent uses TLS mutual authentication when connecting to Intune. Where break and inspect is enabled, network administrators must add the gateway IP address and fully qualified domain name to an approve list for the Intune endpoints.
- Microsoft acknowledges why these technologies exist, noting they provide important risk mitigation for generic internet requests but can dramatically reduce performance, scalability and end user experience when applied to Tunnel Gateway and Intune service endpoints. The answer is an exception, agreed in advance, rather than a surprise during a pilot.
Four things that determine whether Tunnel is the right answer for you.
We test the inspection question before anything else
Break and inspect on client sessions is not supported and causes connections to fail, and an outbound proxy in front of the gateway cannot perform break and inspect either because the management agent uses mutual TLS to Intune. In a network that inspects by default, this needs an agreed exception with the security team, and that conversation belongs in week one.
We design Sites around real connection points, not around servers
A Site is what devices connect to, carrying a public address that can belong to a load balancer, with one server configuration applied to every server in it. Designing Sites by geography or by resource access requirement, then adding servers into them, scales cleanly. Designing around individual servers produces a configuration that has to be rebuilt when you add capacity.
We budget the split tunnelling rules deliberately
Five hundred rules sounds generous until an organisation with a large internal address space starts enumerating include routes. Microsoft is explicit that the 500 is shared across include and exclude, so 300 include rules leaves 200 exclude rules. Designing the routing with summarisation in mind avoids hitting that ceiling six months in.
We separate the enrolled and unenrolled populations early
Tunnel serves enrolled iOS, iPadOS and Android Enterprise devices. Tunnel for Mobile Application Management extends it to Android and iOS devices that are not enrolled with Intune, and Microsoft states it is an advanced capability requiring additional licensing. Which population you actually need to serve is a licensing decision as much as a technical one.
Six UAE situations where Tunnel is worth evaluating.
A business with line of business systems that never moved to cloud
Internal web applications, file shares and legacy systems that mobile users need from outside the office. Tunnel gives iOS, iPadOS and Android Enterprise devices access with modern authentication and Conditional Access, managed from the same console as the devices themselves, which removes a separate appliance and a separate skill set.
A regulated firm that needs compliance checked before connection
Conditional Access is performed in the VPN client against the Microsoft Tunnel Gateway cloud application, and non-compliant devices do not receive an access token from Entra so cannot reach the VPN server at all. That is a materially stronger position than a traditional VPN where compliance is evaluated after the tunnel is already up, if at all.
An organisation working with contractors on unenrolled devices
Tunnel for Mobile Application Management extends the gateway to Android and iOS devices not enrolled with Intune, which is the classic contractor and consultant scenario. Microsoft states it is an advanced capability requiring additional licensing beyond Intune, so the commercial question belongs in the design rather than after it.
An operator that cannot allow traffic to leak around the tunnel
Strict Tunnel Mode on Android blocks all network traffic when the VPN connection drops, ensuring no data bypasses the tunnel. For enrolled devices it is available when always-on VPN is enabled, and for unenrolled devices using Tunnel for Mobile Application Management it is configured through the Microsoft Edge app configuration policy.
A healthcare organisation concerned about compromised devices
The Defender client automatically blocks a device access to Tunnel if it identifies the device as rooted, immediately marking risk as high, dropping active connections and continuing to block until the device is compliant. Microsoft is clear this complements rather than replaces Intune compliance policy settings for rooted devices and Play Integrity verdicts.
An institution with several campuses and internal resources at each
Multiple Linux servers combined into Sites, each Site defining a connection point with its own public address and shared server configuration, is a clean fit for a multi-site estate. Devices connect to the Site appropriate to where the resources are, and adding servers to a Site inherits the configuration automatically.
How UAE organisations give mobile devices access to on-premises systems.
| Feature | Microsoft Tunnel | Traditional mobile VPN client | No mobile access to internal systems |
|---|---|---|---|
Modern authentication | Yes | Varies | Not applicable |
Conditional Access enforced before connection | Yes | Rarely | Not applicable |
Per-app VPN | Yes | Sometimes | Not applicable |
Rooted Android blocked automatically | Yes | No | Not applicable |
Traffic blocked if the tunnel drops | Yes, on Android | Rarely | Not applicable |
Works for unenrolled devices | With Tunnel for MAM | Sometimes | No |
Managed from the same console as the devices | Yes | No | Not applicable |
Compatible with full traffic inspection | No | Often | Not applicable |
FIPS validated algorithms | No | Varies | Not applicable |
Infrastructure to run | Linux servers | Appliances | None |
What goes where, and what each setting decides.
| Element | Where it is configured | What it decides | |
|---|---|---|---|
| IP address range | Server configuration | The addresses assigned to connecting devices, invisible to the wider network because of port address translation | |
| DNS servers and suffix search | Server configuration | How connected devices resolve internal names | |
| Split tunnelling rules | Server configuration | Up to 500 rules shared across include and exclude routes | |
| Listening port | Server configuration | Defaults to 443 for both TCP and UDP, and firewall rules must match if changed | |
| Public IP address or FQDN | Site | The connection point devices use, which can be a load balancer address | |
| Server configuration assignment | Site | Applied to every server in that Site, so adding servers is simple | |
| Site membership | Installation script | Chosen when the tunnel software is installed on each Linux server | |
| Per-app VPN and always-on | VPN profile | Which applications use the tunnel, and whether all traffic goes through it | |
| On-demand VPN rules | VPN profile, iOS and iPadOS | Connect only when conditions are met for specific names or addresses | |
| Strict Tunnel Mode | VPN profile on Android, or Edge app configuration for MAM | Blocks all network traffic if the connection drops, so nothing bypasses the tunnel | |
| Proxy support | VPN profile, iOS and iPadOS and Android 11 or later | Whether traffic routes through an internal proxy | |
| TunnelOnly mode | Defender configuration, iOS and iPadOS | Removes the sign-in requirement, and disables Defender functionality |
Five steps, and the first one can end the project honestly.
- 1
Establish feasibility against the network and the obligations
Whether client TLS sessions are inspected anywhere in the path, since break and inspect is not supported and causes connections to fail. Whether any obligation references Federal Information Processing Standard validated algorithms, since Microsoft states Tunnel does not use them. And whether the platforms in scope are iOS, iPadOS and Android Enterprise, which is what Tunnel supports.
- 2
Design Sites, servers and the network path
How many Sites, based on where resources actually are, each with a public address that may belong to a load balancer. Where the Linux servers run, noting that cloud hosting requires something like ExpressRoute to extend the on-premises network. Then the firewall position for inbound and outbound TCP and UDP on the chosen port, 443 by default.
- 3
Build the server configuration and install
Address range, DNS servers and suffix search, split tunnelling rules within the 500 rule budget shared across include and exclude, and the listening port. Then the installation script from the admin center run on each Linux server, choosing the Site each server joins, with Podman or Docker depending on the version.
- 4
Deploy the client and the VPN profiles
Microsoft Defender deployed as the tunnel client from the respective app stores. VPN profiles using the Microsoft Tunnel connection type, configured for per-app or full tunnel, always-on where appropriate, on-demand rules on iOS and iPadOS, Strict Tunnel Mode on Android, and TunnelOnly mode where the sign-in prompt would be an adoption obstacle.
- 5
Prove Conditional Access and hand over
Testing that a non-compliant device is genuinely refused, since Conditional Access happens in the client against the Tunnel Gateway cloud application and a non-compliant device receives no access token. Then rooted device behaviour tested on Android, compliance policy settings aligned, and the operating model for server patching and certificate lifecycle handed over.
What organisations ask about Microsoft Tunnel.
Fifteen questions before a server is built.
Feasibility
- Does your network inspect client TLS?Break and inspect is not supported.
- Is there an obligation referencing FIPS?Tunnel does not use FIPS compliant algorithms.
- Are only iOS and Android in scope?Those are the supported platforms.
- Where will the Linux server live?Cloud hosting needs ExpressRoute or similar.
- Can inbound and outbound 443 be opened?TCP and UDP by default.
Design
- How many sites and servers?Servers group into Sites, one Site each.
- Is a load balancer in front?The Site can use its address.
- How many split tunnelling rules do you need?500 shared across include and exclude.
- Per-app VPN or all traffic?No apps defined means all traffic.
- Is Strict Tunnel Mode required?Android, and MAM through Edge configuration.
Devices and licensing
- Are devices enrolled, or unenrolled?Unenrolled needs Tunnel for MAM.
- Is Tunnel for MAM licensed?It is an advanced capability with extra licensing.
- Is Defender deployed to devices?It is the tunnel client app.
- Are compliance policies in place?Non-compliant devices get no access token.
- Are Android rooted device settings configured?Compliance policy, not just client detection.
The pages around this one.
Entra Global Secure Access
The Microsoft security service edge approach, and where it overlaps with Tunnel.
Mobile threat defense
Defender for mobile as a threat product, alongside its role as the tunnel client.
Intune app protection policies
Protecting data on unenrolled devices, which is the same population Tunnel for MAM serves.
Ask your network team whether client TLS is inspected end to end. That answer decides this.
Break and inspect on client sessions is not supported and causes connections to fail, so the answer determines whether Tunnel is a build or a different conversation. It takes one email and it saves a wasted pilot.
Related Services
Explore more solutions that work great with this service
Entra Global Secure Access
Internet Access, Private Access and tenant restrictions
Mobile Threat Defense
Device risk into Conditional Access, and the connector that fails open
App Protection Policies
Protect company data on a phone you will never be allowed to manage
Microsoft Intune
Device management and endpoint security
MDM Solutions Dubai
Device management across Windows, Apple and Android
Intune Configuration Profiles
Settings catalog, templates and conflict management
Entra Conditional Access
The control that decides who reaches your data
Intune Compliance Policies
The default that lets unassessed devices through Conditional Access