Harbor contractors on laptops must reach a VNet without a site-to-site appliance at their desks. How should the security engineer configure point-to-site authentication?
Select an answer to reveal the explanation.
Short Explanation
Contractors aren’t a branch office—they’re roaming laptops. Give them point-to-site with Entra ID on OpenVPN (or the documented Entra-supported stack), not a shared key you spray through email.
Full Explanation
Point-to-site VPN connects individual users into a VNet without requiring a site-to-site device at each location. Microsoft Entra ID authentication with a supported protocol such as OpenVPN is the identity-backed choice for contractors. A pre-shared key emailed to every user is weak shared-secret hygiene. Site-to-site is for always-on site connectivity. Publishing VNet ranges publicly and relying only on Conditional Access does not provide a private VPN path into the VNet.