VPN - Simply Explained

Welcome to the M365 FM podcast, where we explore the people, ideas and technologies shaping the future of work. What a VPN actually is. The VPN app you installed is doing less than you think. It builds an encrypted tunnel between your device and a server somewhere else, then quietly sends your traffic through it so the sites you visit see that serve as address instead of yours. It sounds like a shield, but the twist is that it mostly changes who gets to watch you, not whether anyone can. Microsoft's own guidance says the work VPN. You're told to use is often the thing dragging down teams and SharePoint, which is why the company now tells admins to root Microsoft three hundred sixty five traffic around it, and the free VPN sitting on your phone is the one I'd check first, because independent testing keeps finding that free usually means your data is the product. By the end, you'll know what a VPN does, what it never did, and where it fits in Microsoft's cloud. Strip away the ads, and a VPN turns out to be one plain thing. It's a private route between your device and a server somewhere else. Your traffic travels through it. Instead of heading straight out to the open web, that server becomes your stand in, so every site you open sees its address instead of the one your internet provider handed you. Picture an envelope inside an envelope. Your traffic gets sealed inside the first one, and that envelope slides into a second one, addressed only to the VPN server. Anyone watching the road can see your sending mail, and they can even tell you're using a VPN, but neither envelope opens without the key. That's why the first thing a VPN changes is your address on the internet. Switch it on, and the website on the other end has no easy way to know which city you're actually sitting in. All it sees is which server you came through. One word gets used for two very different tools, and untangling that early saves plenty of confusion. Later. There's the privacy app you buy for your laptop. Then there's the tunnel your job makes you use to reach company systems the outside world can't touch. They share a name and a basic shape, yet they exist for completely different reasons. We'll look at both because the second one is where Microsoft three hundred sixty five and Azure come in. How the encrypted tunnel works. Setting up that tunnel takes only a few steps and the order matters. Your app reaches out to the VPN server, and both sides prove they are who they claim to be. Then they agree on a secret key for the session. The key exchange is the clever part because both sides end up with the same secret without ever sending it across the connection. It works a little like two people mixing paint in separate rooms, trading only the colors in the end. They land on an identical shade that nobody listening in could ever reproduce once the tunnel is opened. Your original data gets locked and then wrapped in a plain outer layer that only says where to deliver it. The VPN server opens that outer layer, unlocks the inner one, and forwards your request to the website, and the reply comes back the same way. The rules for all of this are called protocols, and four names cover most of what you'll meet. OpenVPN is the flexible open source workhorse that has been around the longest. WireGuard is the newer one, fast and simple, and it's what a lot of people end up using without ever noticing. On phones, Ikev2 holds the connection together. When you jump from Wi-Fi to cellular, TCP is the old one to avoid since it's widely considered insecure. The names sound technical, but they're really just different recipes for the same job, and most apps pick a sensible one for you by default. Underneath those names sits the actual scrambling, and modern services use strong ciphers like AES two hundred fifty six or Chacha20. WireGuard refreshes its keys roughly every two minutes, which limits how much any single key could ever expose if it were somehow captured. There's a quiet detail that trips people up, and it's called a DNS leak. Your device has to look up the address of every site you visit before it can reach it. If those lookups slip outside the tunnel, your provider still learns the list of sites you're opening even when the pages themselves stay scrambled. A good VPN routes those lookups through the tunnel. Two. One thing matters more than the rest. Every tunnel ends somewhere, and the company that owns the far end can see your traffic in the clear. So a VPN doesn't remove the watcher. It changes which company gets to be the watcher, and that single choice decides whether you've actually gained anything. The moments where a VPN actually helps the clearest win is hiding your browsing list from your internet provider. Without a tunnel, your provider can see which sites you connect to, and a VPN takes that record off their screen. What it doesn't do is hide those sites from the VPN company instead, and that's the trade you're quietly making. Picture someone on a work trip opening their personal email on the hotel's network. The VPN doesn't change the email itself, but it stops the hotel's network from building a tidy list of every site that person visited that evening. Public WiFi is the second place it earns its keep because on a hotel or airport network, you have no idea who else is listening. A VPN keeps your traffic unreadable to everyone sharing that connection, though. The honest caveat is that most sites already use HTTPs. The padlock in your browser is doing real work on its own, and Google is pushing the whole web that direction with Chrome one fifty four In October twenty twenty six, the browser is set to turn on always use secure connections. By default, a VPN adds privacy. On top of that, rather than being the only lock on the door. Location is the third case, and it's the one you hear about. Most connect to a server in another country, and websites behave as though you're sitting there, which is how people reach content that's blocked where they live. That trick works, though. The big streaming platforms are good at spotting it and will sometimes refuse to play. It also matters more in some countries than others. A VPN is legal in most places, but restricted or banned in a few, and using one there can carry real consequences. The fourth case is the one you might already live with. If your job gives you a VPN, it isn't there for privacy at all because it's a tunnel into the company's own network. That's how you open the internal file share, or the line of business app that never touches the open internet. It's also the thread that leads straight into Microsoft three hundred sixty five. Notice what these four cases have in common, because none of them is about vanishing from the internet. Each one is about keeping a specific set of eyes off a specific slice of your traffic. The trouble starts when people expect those four cases to cover everything, because the list of what a VPN can't do is longer than most ads. Admit what a VPN won't do for you. Now let's look at the part the ads skip. A VPN is a privacy tool, not a cloak of invisibility. And it never was. When you connect, your traffic still has to go somewhere and the VPN provider becomes the one carrying it. You've changed who can watch, which helps, but you haven't made yourself anonymous. Think about what else identifies you online. The accounts you log into, the card you pay with, and the fingerprint your browser leaves behind can all point back to you. None of that changes because your IP address did. If someone is determined to trace you and address swap is not the wall they hit. It also doesn't stop the things that hurt most people. A VPN can't clean up malware already running on your laptop, and it can't rescue you from a convincing phishing page where you typed in your password. Security companies are blunt about this, saying a VPN doesn't protect against threats that bypass the tunnel, like local malware or a deceptive phishing site. It's worth saying plainly because the fear sells and the tool can't actually deliver that kind of safety. What it can do is narrow. Who sees your traffic along the way, which is a smaller promise and a fair one? One more thing it doesn't hide is the fact that you're using a VPN at all. Anyone watching the network can often tell your traffic is going into a tunnel, even when they can't read a word inside it. A useful way to hold all of this is to think of a VPN as protecting the journey, not the destination. Once your traffic arrives, the site you're using can still follow you with cookies, and your account still knows exactly who you are. And it certainly doesn't replace your antivirus or your judgment. If you click a bad link and hand over a login, no tunnel in the world will catch that for you. Because the tunnel only protects data while it's moving. The paid version then, is narrower than advertised, which makes the free version worth a much harder look. Why free VPNs usually cost more than they save if the paid version is narrower than the ads promise, the free version deserves even more suspicion. Independent researchers installed the one hundred most popular free Android VPNs and put each one through a series of tests, and the results were grim. Those apps had grown from about two hundred and sixty million installs in twenty eighteen to more than two and a half billion. This is not some fringe corner of the app stores. Eighty eight of them leaked data in some form, and eighty three leaked the DNS requests that reveal which sites you visited. Eleven had outright encryption failures, which means traffic that was supposed to be scrambled simply wasn't. Then there's the gap between what those apps claimed and what they actually did. Seventy one of the one hundred shared personal data with third parties, and ninety three carried privacy labels that didn't match their own privacy policies. Roughly one in five was flagged as malware by antivirus scanners, and more than a third used weaker encryption than they should. The reason comes down to basic math servers and bandwidth cost money, and if you aren't paying, something else is covering the bill. With most free VPNs, that something is your browsing activity packaged up and sold to whoever wants it. When an app promises not to keep logs, you're taking its word for it, and the label mismatches above are exactly why that word deserves a second look. This isn't a rule that every free option is a trap. A few legitimate ones exist, but they come with trade offs like data caps, slower speeds, or a short list of locations. The lesson isn't. Never use free. It's. Check who's behind it before you hand over your traffic. And if you think the free app is the only place this goes wrong, the VPN your employer hands you is about to surprise you. The work VPN and Microsoft three hundred sixty five. This is the part that surprises people who work in Microsoft's world every day. The work VPN isn't there for privacy because it exists to put you inside your company's private network. For years, that tunnel carried almost everything because almost everything lived on company servers. Then the work moved to the cloud and the traffic flipped. Microsoft's own documentation describes that shift, and the numbers are striking. Customers reported that traffic, which used to be about eighty percent internal, dropped to twenty percent or lower. More than eighty percent of it now heads out to cloud services. The old model kept forcing all of that through the VPN anyway, which is how you end up with teams calls that stutter and SharePoint pages that crawl. So Microsoft's guidance now says the opposite of what you'd expect. Route the heavy Microsoft three hundred sixty five traffic directly to Microsoft instead of through the VPN that lets teams SharePoint and Exchange Online connect on their own while the tunnel stays reserved for the traffic that genuinely needs it. That approach is called split tunneling, and it's the single biggest fix for a slow work VPN. The traffic Microsoft wants sent direct is a small, tightly defined set of endpoints, and the numbers explain why it matters. Those endpoints are currently about twenty IP subnets, yet they carry roughly seventy to eighty percent of the Microsoft three hundred sixty five traffic volume, sending them direct freeze the tunnel for everything else, and Microsoft says the change can be made in a matter of hours. Two practical details are worth keeping in your back pocket. Microsoft recommends configuring this by IP ranges rather than by web addresses, because the address based approach can miss scenarios that matter, and the advice carries one clear exception, since it doesn't hold for users in China on the World wide Service because of cross-border congestion, there's a simple way to picture the fix, even if you never touch the settings yourself. Think of the VPN as a narrow service road, useful for reaching the company's private buildings and a poor route for the busy public highway that is Microsoft three hundred sixty five. Split tunneling just keeps each kind of traffic on the road it belongs on. The reassuring part for anyone worried about safety is that nothing gets thrown overboard here. The security checks people assume only live on the network like data loss prevention, antivirus, multi-factor authentication and access control are built into Microsoft three hundred sixty five itself. That's exactly why Microsoft is comfortable letting that traffic skip the tunnel. Now that Microsoft is telling people to root around the VPN. The next question is what Azure actually offers when you really need one. Azure VPN tools in plain English. If the work VPN connects you to your company's network, Azure VPN gateway is the same idea where the network lives in Microsoft's cloud, it sends encrypted traffic between an Azure virtual network and your on premises locations over the public internet. It can also link Azure Networks to each other over Microsoft's own network. You'll hear two shapes of it most often site to site joins a whole office or data center to Azure using an encrypted tunnel between the gateway and a VPN device on your side. Point to site is the one that looks like the classic Remote Worker VPN, because it lets a single laptop connect into Azure from home or a hotel. Microsoft also supports a third shape that links to Azure Virtual Networks directly, which is handy when the services inside them need to talk to each other. The scale is worth putting into plain terms. The smallest gateway benchmarks around one hundred megabits per second. The largest zone. Redundant ones reach up to ten gigabits per second and can hold up to ten thousand point to site connections. A gateway can also be spread across Azure Availability Zones, so a failure in one zone doesn't take your connectivity down with it. A smarter arrangement exists than leaning on a tunnel for everything. Azure VPN gateway can act as a backup path for Expressroute, Microsoft's private dedicated connection, which turns the encrypted tunnel into a safety net rather than the main road. A business bothers with any of this for a simple reason. It might keep a database in Azure that only its own apps should reach. The gateway gives those apps a private path without exposing that database to the open internet. For the person working from a kitchen table, point to site is what turns a laptop into a trusted guest on the company's cloud network. And because the gateway sits in Microsoft's cloud rather than a closet down the hall, it can be spun up in minutes and scaled down again once the rush passes. The cost model is simple enough to state in one breath you pay an hourly rate for the gateway itself, plus a charge for data, leaving it. There's one friendly exception, since traffic between virtual networks in the same region carries no data charge at all, and the ground underneath all of this is shifting because the tools are starting to change shape. The quiet shift away from VPNs, a company that sells you VPN tools, is now telling you that you'll need them less, and that tension is worth sitting with. Microsoft markets enter Private Access as the best alternative to a VPN, and that says something about where access is heading. The difference is easiest to see as a question of scope. A traditional VPN usually grants broad access once you're inside the tunnel, so a single login can open a lot of doors at once. The newer identity based model checks who you are and which device you're on, then hands Hence you only the specific app you asked for. That's tighter by design, and it's why Microsoft calls it more granular than a VPN. The umbrella name for all of it is Global Secure Access, which covers both internet access and private app access. It runs on a network spanning seventy regions and more than one hundred and ninety edge locations, so the service is rarely far from the person using it. That shift matters for how you think about security, because a tunnel that lets you reach everything is also a tunnel that lets a lot reach you. Narrow per app access shrinks that surface, and it does it without asking the user to understand networking. It's a quite a change than a new app, but it reshapes what a company network even means. The catch is that this is a licensed direction, not a switch you flip overnight and your private access needs an entry ID, P1 or P2 licence or the intra suite, and it's sold per user. So the VPN isn't vanishing tomorrow. But the direction of travel is clear and it points toward identity rather than tunnels, and that direction is worth holding on to because it changes what the VPN on your desk is, even for mistakes, limits. And one question for you. So let's pull this together. A VPN is an encrypted tunnel that hides your address and keeps your provider from seeing the sites you open. That's the honest scope of it. It's not a magic cloak, and inside Microsoft's world, it's increasingly something you root around rather than hide behind. The good news is that none of this asks you to become technical. You just need to know what the tunnel is for and what it quietly is not. Once that clicks, the ads stop working on you and the settings start making sense. The mistakes keep repeating in the same few ways. People treat a VPN as anonymity when all it really does is move. Who gets to watch? They trust a free one without asking who runs it and how it pays for itself. And they force every bit of their Microsoft three hundred sixty five work through a tunnel, then blame Microsoft for teams calls that stutter. The limits deserve one more line because they matter more than the feature list. A VPN won't stop malware, and it won't save you from handing your password to a fake login page. So let me leave you with one question. If you checked right now, would you know who runs the VPN on your phone or what they do with your traffic? Tell me in the comments because I read every one. If this made the topic feel less intimidating, subscribe to M365 FM to master the tools and the mindset shaping the future of work.