NOTE: Microsoft recently (June 2026) announced that they will retire “Azure VPN Client for Linux” on August 31, 2026. There are possible migration path, but if you rely on Microsoft Entra ID (AAD) authentication, you are screwed and probably need to ask your sysadmin to switch to a different authentication method.

Microsoft (in 2024) released a linux client to access the VPN, but for now, there is only an ubuntu 22.04 package.

These are the steps to get it running under fedora 40-44. USE AT YOUR OWN RISK!

  • Download the deb from the MS repository
  • Install alien and run alien -r -g -v microsoft-azurevpnclient_3.0.0_amd64.deb to get the package unpacked
  • Fix the spec file: remove the line %dir "/var/lib/polkit-1/" as that conflicts with polkit-pkla-compat (if you install the rpm, and it shows you any other conflict of a directory, just remove that line as well)
  • If you vpn policy sets a DNS server: in var/lib/polkit-1/localauthority/50-local.d/10-microsoft-azurevpnclient.pkla change the Identity=unix-group:sudo to Identity=unix-group:wheel
  • Create a resulting rpm with sudo rpmbuild --target x86_64 --buildroot $(pwd)/microsoft-azurevpnclient-3.0.0 -bb $(pwd)/microsoft-azurevpnclient-3.0.0/microsoft-azurevpnclient-3.0.0-2.spec (Note: the rpm will be build in .., so make sure that it’s fine to have it there)
  • Install the resulting rpm, overwriting the libcurl mismatch: sudo rpm -Uhv --nodeps ../microsoft-azurevpnclient-3.0.0-2.x86_64.rpm
  • Fix the missing capability: sudo setcap 'cap_net_admin=ep' /opt/microsoft/microsoft-azurevpnclient/microsoft-azurevpnclient

Afterward, you can login as described by importing the downloaded connection file.

It works… But obviously, a native Fedora package would be nice.

UPDATE, Fedora 42: it broke, the “Certificate Information” was greyed out and connecting errored out.

greyed out “certificate Information”

The error in the systemd journal:

AzureVPNClient[1035536]: TId:[1039625] No cert verification callback from client
AzureVPNClient[1035536]: TId:[1039625] Invalid certificate data at index 0
AzureVPNClient[1035536]: TId:[1039625] Verification result for certificate chain: 0
AzureVPNClient[1035536]: TId:[1039625] [Primary] OPENVPNFRAMING: OpenVpnFraming hit error processing packet, initiating teardown of tunnel error: 610970100000012 from tls_openssl_common.cpp line 151, facility MobileAccess with detail: Root cert validation failed

A colleague at work found the culprit via some strace magic: Azure VPN for Linux does not follow the symlinks in /etc/pki/tls/certs from some hash(?) to the actual *.pem file.

  • On Fedora 42, I had to copy the actual *.pem file into /etc/pki/tls/certs: sudo cp /etc/pki/ca-trust/extracted/pem/directory-hash/<the cert your need>.pem /etc/pki/tls/certs/.
  • On Fedora 44 and on Debian, it needs to be copied into /etc/ssl/certs (on Fedora 42, that was a symlink to /etc/pki/tls/certs but now is a separate directory).

This lets the cert show up (might need a new import) and connecting works again.

UPDATE, 2025-09-26: A newer alien seems to generate some slightly different spec file, which does not conflict with a second directory anymore, but now needs to be called from outside by rpmbuild. Which means the resulting rpm is in a different place. Also added a fix for not being able to set the DNS server by changing the unix group in the for the .pkla file.

UPDATE, 2025-11-11: verified that the above still work with Fedora 43.

UPDATE, Fedora 44: After upgrading to Fedora 44, the “Certificate Information” was again greyed out, and you now have to copy the right *.pem file into /etc/ssl/certs directory.