permanent, enterprise-wide solution to ensure all VPN users get correct DNS servers via Azure VPN Client

Hello Rajesh,

Welcome to Microsoft Q&A, To keep DNS settings static in Azure VPN Client so users don’t fall back to public DNS after reconnects or reboots, you’ll need to configure the Azure P2S VPN profile with custom DNS servers directly in the VPN configuration not just on the client. This is done by setting the DNS servers in the virtual network’s DNS settings or in the VPN Gateway configuration. Azure VPN Client pulls DNS settings from the VPN profile, so if the profile is generated from a configuration that includes DNS servers, those will persist across sessions. Manual changes on the client side won’t stick after reconnects.

You can configure DNS servers in two ways:

• At the Virtual Network level: Go to your VNet > DNS servers > set custom DNS IPs.
• In the P2S VPN configuration set DNS servers in the Azure VPN Gateway config: When generating the VPN client profile, include <dnsservers> inside the XML file. Example:

    <dnsservers>
      <dnsserver>10.0.0.4</dnsserver>
    </dnsservers>
  

• Then re-import the modified profile into Azure VPN Client.

This ensures all users connecting via Azure VPN Client get the correct DNS servers every time.

References:

• https://learn.microsoft.com/en-us/azure/vpn-gateway/azure-vpn-client-optional-configurations

If this resolves your question, please accept the answer.

Luis

Hello @**Rajesh Challa,
**Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand your question regarding how to set up static DNS server settings with the Azure VPN Client to maintain consistent connectivity after reconnecting or rebooting.

Manual DNS changes made within the Azure VPN Client are not retained, as the client reloads DNS settings from the VPN profile each time. To set static DNS servers for all users, you should configure the DNS servers in one of the following ways:

Virtual Network DNS settings: In the Azure portal, navigate to your Virtual Network and, under DNS servers, enter the IP addresses of your custom DNS servers. This will ensure DNS resolution for resources within your virtual network.

Point-to-Site (P2S) VPN client profile: When creating or updating the VPN client profile XML file, add your DNS server IP addresses as shown below:

<dnsservers>

  <dnsserver>10.0.0.4</dnsserver>

</dnsservers>

Then re-import the profile into users’ Azure VPN Client applications. This makes sure all users consistently use the specified DNS servers.

Please note that if these DNS servers become unreachable, client devices may still be fallback to public DNS servers based on their operating system resolver behavior. To avoid this, ensure your DNS servers are highly available.

Azure VPN Client - configure optional DNS and routing settings: https://learn.microsoft.com/en-us/azure/vpn-gateway/azure-vpn-client-optional-configurations
Configure Azure VPN Client optional settings - Azure VPN Gateway | Microsoft Learn

Azure Virtual Network Name Resolution Guide | Microsoft Learn

Kindly let us know if the above helps or you need further assistance on this issue.

I initially set up the DNS and imported it into the XML file, but it’s still displaying as dynamic (DNSClientServerAddress). I need to update the DNS server IP again

Let me know any other approach to resolve that issue

Hello @Rajesh Challa,

Thank you for clarifying the issue. The behavior you’re seeing, where DNS settings appear as dynamic (DNSClientServerAddress) is expected because the Azure VPN Client reloads DNS settings from the VPN profile each time it reconnects or after a reboot. Manual changes in the client UI are not persistent.

To ensure DNS servers remain consistent across sessions, here are the recommended approaches:

1. Update DNS in the VPN Profile XML: Add your DNS servers in the profile XML:

<dnsservers>

<dnsserver>10.0.0.4</dnsserver>

<dnsserver>10.0.0.5</dnsserver>

</dnsservers>

After updating, remove the old profile and re-import the updated XML into the Azure VPN Client.

2. Configure DNS at the Virtual Network Level: In the Azure portal:

• Navigate to Virtual Network → DNS servers
• Enter your custom DNS IPs This applies to all Point-to-Site connections and ensures name resolution within the VNet.

3. Enterprise-Wide Deployment: If you use Azure AD authentication or manage devices via Intune/Endpoint Manager:

• Push the updated XML profile through policy.
• This ensures all users receive the correct DNS settings automatically.

Note: If DNS servers become unreachable, the OS resolver may fall back to public DNS. To avoid this, ensure your DNS servers are highly available.

For detailed steps:

Configure Azure VPN Client optional settings - Azure VPN Gateway | Microsoft Learn

Azure Virtual Network Name Resolution Guide | Microsoft Learn

Kindly let us know if the above helps or you need further assistance on this issue.

Hi @Ganesh Patapati

The provided configuration was already in place, and there’s nothing further to update. However, the issue still persists and remains unresolved.

We’re currently in the testing phase and configuring the setup for individual users, so Active Directory and Intune Manager are not being utilized at this stage.