---
locale: "en"
updated_at: "2026-03-26T11:08:24.877Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/reference/modules/userlock-vpn-connect"
---

# UserLock VPN Connect

Application to improve MFA on VPN logons.

## Overview

**Without UserLock VPN Connect**, users protected by UserLock can connect through standard VPN clients, but the MFA process depends on each client’s capabilities. This often leads to:

- **inconsistent** workflows,
- **confusing** prompts,
- connection **failures** due to timing or input errors.

👉 UserLock VPN Connect integrates MFA directly into the Windows VPN logon dialog, providing a **consistent, one-step experience**.

## Why use VPN Connect

Users can connect to a VPN protected by UserLock in three different ways.
The table below compares these methods and highlights their main strengths and limitations.

| **Connection method** | **MFA process** | **Pros** | **Limitations** |
| --- | --- | --- | --- |
| VPN client** with RADIUS Challenge ** | MFA handled in two steps: after credentials, a challenge requests the OTP code. | Clear MFA separation, reliable experience (if supported). | Requires VPN client compatibility with RADIUS Challenge. |
| VPN client **without RADIUS Challenge** | User adds MFA code manually (in username or password field). | Works with any VPN client. | Confusing syntax, prone to user error or expired codes. |
| **UserLock VPN Connect** | MFA handled automatically before VPN starts. | Simple one-step workflow, clear error messages, supports multiple profiles and remote enrollment. | Requires [installing the VPN Connect client](/userlock/docs/guides/installation/install-userlock-vpn-connect). |

VPN Connect eliminates the most common pain points of MFA authentication via VPN by:

- Combining VPN and MFA in a single, seamless step.
- Validating MFA **before** the VPN tunnel is created, preventing failed or dropped connections.
- Allowing users to **enroll MFA remotely** through the UserLock IIS web page.
- Supporting multiple VPN profiles with **centralized GPO configuration**.
- Providing clear, detailed messages for easier troubleshooting.

## How to install UserLock VPN Connect

UserLock VPN Connect is a lightweight Windows client that can be installed and configured in two ways:

- **Manually**, by running the installer on each computer, or
- **Automatically**, using standard software deployment tools or Group Policy software installation.

📘 Read the guide [Installing the UserLock VPN Connect](/userlock/docs/guides/installation/install-userlock-vpn-connect) for more details.

## Features

### Easy VPN connection

- Manage multiple VPN profiles.
- Allows users to select a profile and log in with their Windows credentials.
- Shows detailed connection feedback and error messages (e.g., invalid credentials, unreachable server).

![Windows VPN account credentials](https://a.storyblok.com/f/122374/332x490/8af5ecd8cf/windows-vpn-account-credentials.png)

### MFA prompt

- When MFA is required, VPN Connect automatically displays the appropriate prompt **before** starting the VPN session.
- For **TOTP**, users enter the verification code from their authenticator app.

![](https://a.storyblok.com/f/122374/333x476/4da47290a0/userlock-vpn-connect-mfa-code.png)

- For **Push**, users simply approve the notification on their mobile device.

![](https://a.storyblok.com/f/122374/384x522/b768c0b217/userlock-vpn-connect-verify-identity.png)

### MFA enrollment

- If the user isn’t enrolled, a *Register* button opens the [UserLock IIS MFA](/userlock/docs/guides/mfa-implementation/mfa-iis-apps) web page for remote enrollment.

![](https://a.storyblok.com/f/122374/334x367/fbca4ce329/userlock-vpn-connect-mfa-register.png)

> **Note**
>
> See also: [How to apply MFA to VPN](/userlock/docs/guides/mfa-implementation/vpn-mfa) guide.