I've configured several standalone remote-user VPN connections with the Windows Azure VPN Client, but this is my first attempt on macOS. I installed the Azure VPN Client from the Apple App Store and imported the same XML profile that works on Windows. The Mac client never prompts for a username or password, and the XML does not contain credentials. Its log repeatedly shows Keychain error -25300, missingClientID, failure to load Microsoft Entra settings, and failure to acquire a Microsoft Entra token. Could the Windows profile be incompatible with the Mac client, or is there an additional authentication setting or profile file I need to use?
1 Answer
The log points primarily to an incomplete Microsoft Entra authentication profile rather than a bad username or password. The macOS client is trying to initialize MSAL, but it cannot find the required client/application ID, so it never reaches the interactive sign-in prompt. The -25300 Keychain message is likely a follow-on error because no valid token has been created or saved yet. When downloading the VPN configuration from Azure, make sure you import the Entra ID/AAD-specific profile, commonly named something like azurevpnconfig_aad.xml, rather than the generic azurevpnconfig.xml. The Mac client is stricter about the tenant and application ID fields than the Windows client. Also verify that the installed client version supports the authentication method configured on the gateway, and check whether Conditional Access, MFA, or device-compliance policies are blocking macOS sign-in.
The download gives me an Azure VPN folder containing an XML file, plus a separate folder with the VPN server root certificate and vpnsettings.xml. I normally ignore the certificate folder. Is there a setting on the virtual network gateway that controls which profile is generated?