About this article: AI-assisted writing, reviewed against the cited sources. This is source research, not lab validation. Check the stated versions and your own requirements before making changes.
Use RD Gateway when people need an encrypted route to a remote desktop or RemoteApp. Consider site-to-site VPN connectivity when an office also needs authorised private access to several hosted resources. Neither choice automatically gives users permission to the resources behind it.
A tunnel joins routed networks; it does not turn them into one trusted LAN. A gateway narrows the remote access path to the resources its policies permit, but still depends on user authentication, host permissions and a supported client.
Define what must cross the connection
List the traffic before choosing the access method. Does an employee only use a hosted application? Does an office scanner need to deliver files? Does a server integration require a database connection? Name the source, destination, required protocol/port and responsible owner for each flow.
Microsoft's RD Gateway deployment guide describes access to internal remote resources without a VPN for that RDP path. It does not make the gateway a general route to file shares or database ports from the employee's laptop.
A site-to-site VPN connects a network gateway to another network gateway. A point-to-site VPN connects an individual remote device. Microsoft's VPN Gateway overview explains those distinctions for Azure, including IPsec/IKE site-to-site tunnels. The exact hosting implementation and supported protocols need their own design.
Keep route, identity and certificate trust separate
For RD Gateway, a trusted TLS certificate protects the gateway connection and authenticates the gateway name to the client. It is not, by itself, certificate-based authentication of the employee. Connection Authorization Policies (CAPs) decide who may connect through the gateway; Resource Authorization Policies (RAPs) decide which resources they may reach. The destination still applies its own sign-in and application permissions.
For VPN, specify allowed office and hosted subnets and the minimum required ports between them. Network rules, resource authentication and application permissions still apply independently. A route to a server is not authority to sign in or read its files. Keep management access distinct from ordinary user traffic.
Full-tunnel and split-tunnel routing have different traffic, inspection and capacity implications. Full tunnelling can satisfy a deliberate inspection policy, while also extending the path for some traffic. Split tunnelling can shorten some routes while changing where controls apply. Neither automatically passes or fails compliance, and neither guarantees low latency. Check the actual routing policy and measured path.
MFA is a specific integration
One documented gateway option is the NPS extension for Microsoft Entra multifactor authentication. In that design, RD Gateway sends CAP evaluation through RADIUS to a separate NPS server with the extension. RAP evaluation remains on the gateway. The documented integration assumes on-premises identities synchronised to Microsoft Entra ID, enabled and registered for the supported MFA method.
That page is for cloud-based Entra MFA, not the legacy MFA Server product. It documents RD Gateway's phone verification and Authenticator Approve/Deny flow and explains that its sign-in experience cannot accept SMS or other verification-code entry. Validate the current NPS version, user registration and supported method before rollout. Do not infer that generic Conditional Access controls or every Entra authentication method automatically apply to this RADIUS path.
Compare the operating choices
| Requirement | Candidate | Evidence to request |
|---|---|---|
| Roaming users only need desktops or published apps | RD Gateway | Named resources, effective CAP/RAP, trusted certificate, MFA flow and client support |
| An office needs several private application flows | Site-to-site VPN | Explicit routes, source/destination rules, identity checks, tunnel capacity and monitoring ownership |
| An individual needs private access beyond RDP | Point-to-site VPN, if supported | Device authentication, permitted routes and resource permissions |
| Offices and home users differ | A documented combination | Consistent resource authorisation, name resolution and tested failure behaviour for both routes |
A safe pilot should verify required connections and attempts that should be denied. Check office and home paths separately, with non-sensitive test data, then record who diagnoses a failed tunnel, a denied gateway policy and an application permission failure. These are different faults even when the user sees the same failed connection.
No gateway, VPN or identity changes were tested for this article. Confirm provider capabilities separately; this comparison makes no claim about a particular deployed service.
Related service: ThinPoint remote access.
This article was originally published on .