VPN Access Grant

The problem

VPN access requests are high-frequency in remote-first organizations. Each grant requires group-membership update, profile push to the user's device, and verification that the connection works. Manual provisioning takes 10-15 minutes per request and requires the user's device to be online — leading to back-and-forth scheduling that breaks the help desk's day.

What AscendCore does

A user requests VPN access in Microsoft Teams or Slack. AscendCore proposes adding them to the configured VPN security group, and on approval adds the user to the Entra group and triggers an immediate Intune sync on each of the user's enrolled devices so the VPN profile pushes without waiting for Intune's natural ~8-hour sync cycle.

Workflow

1. Trigger — /vpn-access <user-email> from Slack or vpn-access <user-email> from Teams
2. Verify — pre-flight check that the configured Intune VPN device configuration exists
3. Propose — admin approval card with target user + configured VPN group
4. Approve — IT admin approval (configurable to require security-team approval too)
5. Add — user added to the VPN Entra security group
6. Sync — for each of the user's Intune-enrolled devices, trigger an immediate sync
7. Audit: one record on the tamper-evident audit chain with the per-step outcomes

Integrations

• Microsoft Intune — device-configuration verification + per-device sync triggering
• Microsoft Entra ID — VPN security group membership management
• Slack + Microsoft Teams — Request triggers and confirmations

Configuration

The VPN security group, the Intune configuration the pre-flight checks, and whether to trigger an immediate device sync are set per organization during setup.

Status

Live in production — admin-initiated approval flow on Slack + Teams with full audit-chain coverage.