How to deploy always-on VPN using Microsoft Intune MDM

If you are administrator for a qualifying Proton VPN for Bushiness plan, you can enforce VPN usage across your organization with our Always-on VPN feature.

In this guide, we show you how to deploy Always-on VPN across your organization’s Windows devices using Microsoft Intune MDM. There are two ways to do this:

• Deploy via Windows app (install script)
• Deploy via a platform script

Option 1. Deploy via Windows app (install script)

1. Create a setup folder

1. Generate a protonvpn-install-xxxxxx.ps1 profile file, as described here.
2. Download this file: detect.ps1(new window).
3. Create a Windows folder named ProtonVPN-AlwaysOnProfile in a convenient location.
4. Drop protonvpn-install-xxxxxx.ps1 and detect.ps1 files into the ProtonVPN-AlwaysOnProfile folder you just created.

2. Create the .intunewin package

1. Download and run the Microsoft Win32 Content Prep Tool(new window) (see here for more details).
2. Enter:

• Source folder: [Path to]/ProtonVPN-AlwaysOnProfile
• Setup file: protonvpn-install-xxxxxx.ps1
• Output folder: Path to the your Intune packages folder
• Do you want to specify catalog order (Y/N)? n

The program will create a file called protonvpn-install-xxxxxx.intunewin in your Intune packages folder.

3. Add the Windows app to Intune

1. Sign in to intune.microsoft.com(new window) and go to Apps → By platform → Windows → +Add → Select app type → App type. Select Windows app (Win32) from the dropdown menu → Select.

2. Add information tab. Fill in as many details as you like, and click Next when you’re done.
3. Program tab. Enter the following information:

• Install command: powershell.exe -NoProfile -ExecutionPolicy Bypass -File protonvpn-install-xxxxx.ps1
• Uninstall command: powershell.exe -NoProfile -ExecutionPolicy Bypass -Command “$p=’C:\Program Files\Proton\VPN\Policies\always-on.rego’; if (Test-Path $p) { Remove-Item $p -Force }; $d=’C:\Program Files\Proton\VPN\Policies’; if ((Test-Path $d) -and -not (Get-ChildItem $d -Force)) { Remove-Item $d -Force }; exit 0”

Note that the Install command must match the filename in the package. If you rename the script, update the command accordingly.

4. Requirements tab. These should match those of your organization (minimum Win10 19041+, 64-bit, ~1 MB disk).
5. Detection rules tab. Enter:

• Type: Use a custom detection script
• Script file: upload your detect.ps1 file
• Run script as 32-bit process: no
• Enforce script signature check: no

Click Next when you’re done.

6. Assignments tab. Select Required → Add group → your device group. Click Next.

7. Dependencies tab. Toggle the Automatically install button for your existing Proton VPN Windows app on.

Click Next and review the app settings you just created. If you’re happy, click Create.

Option 2. Deploy via a platform script

This simplified script is easier to deploy than the Windows app, it but has some important limitations:

• No built-in detection and retry
• It’s harder to track installs across your organization

1. Generate a protonvpn-install-xxxxx.ps1 profile file, as described here.
2. Sign in to intune.microsoft.com(new window) and go to Devices → Scripts and remediations → Platform Scripts → Add → Windows 10 and later.
3. Enter the following:

• Script location: upload your protonvpn-install-xxxxx.ps1 file
• Run this script using the logged on credentials: No
• Enforce script signature check: No
• Run script in 64 bit PowerShell Host: Yes

Leave the Assignments tab at its default values, and then review, and click Create.

How to remove the policy

How to removing the Always-on policy depends on how you deployed it:

Option 1. Deploy via Windows app (install script)

On the Assignments tab (see step 1.7), either:

1. Remove the user from assigned group.

or

1. Remove the the group from the app’s assignments

Option 2. Deploy via a platform script

1. Generate a protonvpn-deviceprofile-remove.ps1 file, as described here.
2. Sign in to intune.microsoft.com(new window) and go to Devices → Scripts and remediations → Platform Scripts → Add → Windows 10 and later.
3. Enter the following:

• Script location: upload the protonvpn-deviceprofile-remove.ps1 file
• Run this script using the logged on credentials: No
• Enforce script signature check: No
• Run script in 64 bit PowerShell Host: Yes