Harbor contractors on laptops must reach a VNet without a site-to-site appliance at their desks. How should the security engineer configure point-to-site authentication?
Select an answer to reveal the explanation.
Short Explanation
Contractors aren’t a branch office—they’re roaming laptops. Give them point-to-site with Entra ID on OpenVPN (or the documented Entra-supported stack), not a shared key you spray through email.
Full Explanation
Point-to-site VPN connects individual users into a VNet without requiring a site-to-site appliance at each desk. For harbor contractors on laptops, configure point-to-site using an Entra-supported protocol such as OpenVPN with Microsoft Entra ID authentication so identity and Conditional Access patterns can gate who enters the VNet.
Emailing every contractor the same pre-shared key for a shared-key P2S profile fails credential hygiene and accountability. Requiring each contractor to stand up their own site-to-site local network gateway from home fails scale and supportability. Publishing the VNet address space on a public IP and relying on Conditional Access alone for network isolation fails by concept: Conditional Access does not replace an encrypted VPN path into private address space.
Exam caveat: match P2S auth to device posture—Entra ID auth fits joined/managed clients; certificates may fit other shops. Operational check: configure P2S with Entra authentication, enroll a contractor laptop, confirm allocation from the P2S address pool, and verify only authorized users can connect. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.