Replace Always On VPN And DirectAccess For On-Prem AD
Move off Always On VPN, DirectAccess and branch tunnels without moving your directory to Entra. One outbound-only fabric for users and sites, one policy.
What this actually does
DirectAccess is gone, Always On VPN is a certificate estate with a gateway attached, and every branch tunnel is a device somebody has to keep alive. The directory does not have to move to fix any of that.
One fabric covers both motions
user-to-service access for remote staff and site-to-site connectivity between branches, governed by a single policy model instead of two stacks.
No concentrator to size for peak concurrency, licence per tunnel, or refresh when it reaches end of support.
Direct peer-to-peer paths with NAT traversal, so branch traffic does not hairpin through a head-office gateway that becomes the bottleneck and the outage.
Access follows verified device and user identity rather than whichever subnet the tunnel dropped someone into.
Migration runs per site.
Prove one branch, then move the next, with the VPN still in place underneath until you choose to decommission it.
How the connection works
What changes as a result
- One appliance and one support contract off the bill
- No certificate estate to renew purely to keep access working
- Branch onboarding without shipping and staging hardware
- Narrower access than a tunnel that lands users on a whole subnet
- A staged migration you can stop at any point
Three ways to find out if it fits.
AD Readiness Review
Forty-five minutes on your directory and remote access, and a one-page verdict you can circulate.
Book the reviewThe 14-Day Pilot
Five criteria agreed in writing first, then tested on real endpoints. If it fails, you walk.
Plan a pilotTalk to Us
Tell us about your sites, endpoints and directory. We will tell you what the overlay changes.
Talk to us
Map your VPN estate in a 45-minute review
Bring us your directory, your remote access and your sites. We will map what the overlay changes before anyone signs anything.