I have several standalone remote-user VPN profiles working with the Azure VPN Client on Windows. One user has a Mac, so I installed the macOS Azure VPN Client and imported the same XML profile used on the Windows machines. The connection never prompts for a username or password, and the XML does not contain credentials.
The client log repeatedly shows Keychain error -25300, missingClientID, failure to load Microsoft Entra settings, and failure to acquire a Microsoft Entra token. I downloaded the VPN client package from the Azure portal, which produced an Azure VPN folder containing an XML file plus a separate folder with the VPN server root certificate and vpnsettings.xml. I normally ignore the certificate folder. Is the wrong profile being imported, or does the macOS client require an additional setting or a different XML file?
2 Answers
The important error is missingClientID, not the Keychain message. The macOS client needs the Microsoft Entra ID authentication settings in the profile, including the tenant and application/client ID. Make sure you are importing the Entra ID-specific profile, commonly named azurevpnconfig_aad.xml, rather than the generic azurevpnconfig.xml. The Windows client may accept or assemble the configuration differently, while the macOS client is stricter about those XML elements.
The -25300 Keychain error is likely a follow-on error: because authentication never initialized successfully, there is no cached account or token for the app to retrieve. It does not mean you should add a username and password to the XML.
When generating the package in the Azure portal, select the authentication option that matches the gateway configuration, then inspect the extracted files before importing anything. For Microsoft Entra authentication, use the AAD-specific XML and keep the related root certificate available. If the profile uses certificate authentication, the Mac also needs the VPN server root certificate installed or trusted in Keychain Access; vpnsettings.xml may contain supporting client settings rather than being the profile you import directly.
Also verify that the gateway’s Entra configuration has a valid tenant ID and client/application ID, and that Conditional Access or device-compliance policies are not blocking macOS sign-in. After replacing the profile, remove the old connection from the app and import the corrected one again so stale cached settings are not reused.
That helps. The download created an Azure VPN folder with the XML and another folder containing the VPN server root certificate and vpnsettings.xml. I had been ignoring the second folder. I’ll check whether the XML is the Entra-specific profile and whether the certificate needs to be imported as part of the Mac setup.