Restricting VPN access through Azure AD groups

[diego.frausto]

All,

Is it possible to restrict access to Site-to-Site VPN tunnels with Azure AD groups?  We have 3 Site-to-Site VPN tunnels in our environment and we would like to restrict access through the use of Azure AD groups.  We are using Azure MFA for login authorization, but we would also like to use Azure Groups to restrict access to Site-to-Site VPN tunnels.   I know that we have to create different ACL, but how would we associate the Azure AD group to the proper ACL? 

Thank you,

Diego 

[balaji.bandi]

is this site to site VPN or Remote access VPN ?

[diego.frausto]

We want to control remote access VPN to the Site-to-Site VPN tunnels.  

If we have an anyconnect client login and establish a remote VPN connection, we do not want to give this user access to all three Site-to-Site VPN connections.  We want to restrict it so that her or she only gets access to the Site-to-Site VPN tunnels that they have right to through Azure AD groups.

[balaji.bandi]

do you different Remote access VPN for each Location?

with profiles you can restrict right, depends on the Pool you allocating you can have ACL Polices not to access other resources(other site-site vpn), and make different Group if you different have  VPN.