When your network inspects TLS, Tunnel connections do not slow down. They stop working.
Microsoft Tunnel puts a VPN gateway in a Linux container so iOS, iPadOS, and Android Enterprise devices can reach on-premises resources, authenticated through Entra and gated by Conditional Access. Whether it belongs in your environment usually comes down to two published facts: client sessions must not be inspected anywhere in the path, and the product does not use FIPS-compliant algorithms. We check both before anything gets built.
- iOS and AndroidThe supported client platforms
- Linux containerWhere the gateway runs
- No inspectionTLS break and inspect breaks connections
- 500 rulesTotal split tunneling budget, include plus exclude
Seven facts that shape a Tunnel design.
Inspection in the client path is fatal, not slow
The documentation leaves no room: no SSL break and inspect, no TLS break and inspect, no deep packet inspection on client connections, and any firewall, proxy, or load balancer that terminates and inspects sessions headed into the gateway is unsupported and makes client connections fail outright. Networks that inspect everything need an exception carved out before this product can exist in them.
FIPS-compliant algorithms are absent
One sentence in the documentation carries the weight: Microsoft Tunnel does not use Federal Information Processing Standard compliant algorithms. Commercial businesses may shrug; federal contractors, defense supply chain companies scoping CMMC, and anyone whose agreements cite FIPS 140 validation cannot. It is a five-minute check that can save the whole project, so it happens first.
The gateway is a container on a Linux host
Physical or virtual, in your data center or in a cloud. Microsoft's caveat on cloud hosting is that something like Azure ExpressRoute must extend the on-premises network out to it, which adds real cost and complexity to that option. Depending on version, the container runtime is Podman or Docker.
Sites are the unit of design
Each Linux server joins exactly one Site, and the Site is what devices actually connect to: it owns the public IP or FQDN, which may point at a load balancer, and it pushes a single server configuration onto every member server. Growth means adding servers to a Site, and they inherit everything.
Channel behavior, and the routing budget
The client brings up a TCP/TLS control channel that doubles as a fallback data path, then attempts a UDP channel over datagram TLS for primary data, both on port 443 by default. Routing is governed by a split tunneling allowance of 500 rules total across include and exclude, so a design using 300 includes has 200 excludes left.
Per-app scope, and an invisible mode
VPN profiles decide which apps traverse the tunnel; leave the app list empty on an always-on profile and every packet from the device goes through. On iOS, setting TunnelOnly to true with per-app VPN means users never open or sign in to Defender for the tunnel to function, at the price of losing Defender's protection features.
Compliance gating, and root detection
Access is gated in the VPN client through Conditional Access against the Microsoft Tunnel Gateway cloud app; a device out of compliance gets no token from Entra and never reaches the server. On Android, Defender adds its own tripwire, instantly cutting Tunnel access for rooted devices, raising their risk to High and severing live connections until compliance returns.
Full traffic inspection and Tunnel cannot share a path.
Three separate passages of the documentation repeat the same prohibition, and what fails is connectivity itself, not throughput.
- Quoted: Tunnel Gateway does not support SSL break and inspect, TLS break and inspect, or deep packet inspection for client connections.
- Quoted: the use of firewalls, proxies, load balancers, or any technology that terminates and inspects the client sessions that go into the Tunnel Gateway is not supported and causes client connections to fail.
- A subtler variant applies to the gateway's own egress: an outbound proxy in front of it must not break and inspect either, since the management agent speaks mutual TLS to Intune. Where a proxy inspects by default, the gateway's IP and FQDN belong on the exemption list for the Intune endpoints.
- Microsoft is not dismissive of inspection stacks; it notes they mitigate real risk for ordinary internet traffic while dramatically degrading performance, scale, and user experience against Tunnel and Intune endpoints. The workable path is a scoped exception negotiated with the security team before the pilot, not during it.
What we actually contribute to a Tunnel project.
The inspection verdict comes in week one
Because inspected client sessions fail outright, and because even the gateway's outbound proxy is barred from inspecting (the management agent uses mutual TLS to Intune), the first deliverable is a written answer from your network team about what touches TLS in the path. Everything else waits on it. We work remotely and put it in writing.
Topology follows resources, not hardware
We lay out Sites according to where the resources and users are, give each a public address, load-balanced where warranted, and let the shared server configuration handle every server added later. Estates designed server-first end up rebuilding their topology at the first capacity increase.
The 500-rule budget is spent on purpose
Organizations with sprawling internal address space can burn through the shared include-and-exclude allowance surprisingly fast. Summarized routes, planned before deployment, keep the count low; enumerating subnets one at a time finds the limit the hard way.
Enrollment status is a licensing fork
The base product serves enrolled iOS, iPadOS, and Android Enterprise devices. Unenrolled phones need Tunnel for Mobile Application Management, which Microsoft classes as an advanced capability with licensing beyond Intune. Sorting devices into those buckets early keeps the commercial picture honest.
Where Tunnel earns a place.
On-premises systems that mobile staff still need
File shares, internal web apps, and legacy line-of-business systems with no cloud successor. Tunnel reaches them from managed mobile devices with Entra authentication and Conditional Access in front, all run from the console the devices already live in, with no extra appliance or vendor.
Compliance verified before the connection exists
Because Conditional Access runs in the client against the Tunnel Gateway cloud app, an out-of-compliance device is refused a token and never touches the VPN server. For firms answering GLBA, FTC Safeguards, or SOC 2 access criteria, pre-connection enforcement reads very differently from a VPN that checks afterward, or never.
Contractor phones that will never enroll
Consultants and contractors need internal access from devices your MDM will never own. Tunnel for MAM covers exactly that unenrolled population, and since Microsoft licenses it as an advanced capability beyond base Intune, the budget line belongs in the design phase.
Zero tolerance for traffic outside the tunnel
Android's Strict Tunnel Mode stops every packet when the VPN drops, so nothing slips out unprotected. Enrolled devices get it with always-on VPN enabled; unenrolled devices under Tunnel for MAM configure it through the Edge app configuration policy.
Compromised handsets near patient data
Defender's client watches for rooting on Android and reacts immediately: risk set to High, live Tunnel sessions cut, access denied until the device is compliant again. For HIPAA-covered organizations with clinicians on mobile, that sits alongside, not instead of, rooted-device compliance policy.
Several campuses, resources at each
Sites map naturally onto locations: each campus gets a Site with its own public address and shared configuration, devices connect where their resources are, and new servers slot into the right Site inheriting its settings.
How US organizations give mobile devices access to on-premises systems.
| Feature | Microsoft Tunnel | Traditional mobile VPN client | No mobile access to internal systems |
|---|---|---|---|
Modern authentication | Yes | Varies | Not applicable |
Conditional Access enforced before connection | Yes | Rarely | Not applicable |
Per-app VPN | Yes | Sometimes | Not applicable |
Rooted Android blocked automatically | Yes | No | Not applicable |
Device traffic halted when the tunnel drops | Yes, on Android | Rarely | Not applicable |
Works for unenrolled devices | With Tunnel for MAM | Sometimes | No |
Administered from the device management console | Yes | No | Not applicable |
Compatible with full traffic inspection | No | Often | Not applicable |
FIPS-validated algorithms | No | Varies | Not applicable |
Infrastructure to run | Linux servers | Appliances | None |
What goes where, and what each setting decides.
Element
IP address range
- Where it is configured
- Server configuration
- What it decides
- The pool handed to connecting clients; PAT keeps these addresses hidden from the rest of the network
Element
DNS servers and suffix search
- Where it is configured
- Server configuration
- What it decides
- Internal name resolution for connected devices
Element
Split tunneling rules
- Where it is configured
- Server configuration
- What it decides
- The 500-rule allowance spanning include and exclude routes
Element
Listening port
- Where it is configured
- Server configuration
- What it decides
- 443 by default for TCP and UDP alike; changing it means matching firewall work
Element
Public IP address or FQDN
- Where it is configured
- Site
- What it decides
- What clients dial; a load balancer address is acceptable here
Element
Server configuration assignment
- Where it is configured
- Site
- What it decides
- One configuration pushed to all member servers, so capacity adds are clean
Element
Site membership
- Where it is configured
- Installation script
- What it decides
- Fixed per server when the tunnel software is installed
Element
Per-app VPN and always-on
- Where it is configured
- VPN profile
- What it decides
- Scopes the tunnel to named apps, or to everything when no apps are listed
Element
On-demand VPN rules
- Where it is configured
- VPN profile, iOS and iPadOS
- What it decides
- Brings the tunnel up conditionally for defined names or addresses
Element
Strict Tunnel Mode
- Where it is configured
- VPN profile on Android, or Edge app configuration for MAM
- What it decides
- Halts all device traffic when the tunnel drops, preventing bypass
Element
Proxy support
- Where it is configured
- VPN profile, iOS and iPadOS and Android 11 or later
- What it decides
- Routes tunnel traffic via an internal proxy
Element
TunnelOnly mode
- Where it is configured
- Defender configuration, iOS and iPadOS
- What it decides
- Drops the Defender sign-in requirement and its protection features together
How we run it, feasibility first.
- 1
The go or no-go check
Three questions, answered in writing: does anything inspect client TLS in the path (unsupported, connections fail); does any contract or framework require FIPS-validated cryptography (Tunnel does not use FIPS algorithms); and is the device scope confined to iOS, iPadOS, and Android Enterprise (all Tunnel supports).
- 2
Topology and network design
Site count driven by resource locations, each with its public address or load balancer. Host placement for the Linux servers, remembering that cloud placement drags ExpressRoute or similar into scope. Firewall changes for TCP and UDP on the chosen port, default 443.
- 3
Configure and install
The server configuration takes shape: client address pool, DNS and suffix search, split tunneling within the shared 500-rule allowance, listening port. The admin center's installation script then runs on each Linux host, binding it to its Site, on Podman or Docker as the version dictates.
- 4
Client rollout
Defender ships to devices as the tunnel client. Profiles use the Microsoft Tunnel connection type: per-app or full-device, always-on where wanted, iOS on-demand rules, Android Strict Tunnel Mode, and TunnelOnly where a Defender sign-in prompt would stall adoption.
- 5
Enforcement proof and handover
We demonstrate the negative case: a noncompliant device denied its token and refused. Rooted-device behavior is exercised on Android, compliance policy aligned with it, and the run book for patching hosts and rotating certificates lands with your team in writing.
What organizations ask about Microsoft Tunnel.
Fifteen checks, ordered so the fatal ones come first.
Go or no-go
- Is client TLS inspected anywhere en route?Unsupported; connections fail.
- Do any obligations cite FIPS validation?The product does not use FIPS algorithms.
- Is the scope limited to iOS and Android?Nothing else is supported.
- On-premises host, or cloud?Cloud requires ExpressRoute or equivalent.
- Can 443 open both directions, TCP and UDP?The default for both channels.
Topology
- How many Sites does geography demand?Each server joins exactly one Site.
- Load balancer at the front?Allowed as the Site address, provided it never inspects.
- How close will you run to 500 routing rules?Include and exclude share the budget.
- Named apps, or the whole device?An empty app list tunnels everything.
- Does data leakage on drop matter?Strict Tunnel Mode exists for that, on Android.
Clients and licensing
- Enrolled fleet, unenrolled, or both?Unenrolled requires Tunnel for MAM.
- Is the MAM add-on licensed?Extra licensing beyond Intune, per Microsoft.
- Is Defender rolled out?Defender is the client application.
- Do compliance policies exist and bite?They are what Conditional Access evaluates.
- Do compliance rules cover rooted devices?Client-side detection is a complement, not the policy.
The pages around this one.
Entra Global Secure Access
Microsoft's security service edge, and the scenarios where it competes with or complements Tunnel.
Mobile threat defense
Defender on phones as a security product in its own right, beyond its role as Tunnel client.
Intune Suite
The licensing home of Tunnel for MAM, with the trial terms that govern evaluating it.
One email to your network team settles most of this.
Find out whether client TLS gets inspected anywhere end to end. If yes, Tunnel needs an exception before it needs a server; if no, the build is straightforward. Either way you learn it before spending anything on a pilot.
Related Services
Explore more solutions that work great with this service