how to provision vpn access for a contractor
Provisions VPN access for contractors with proper scoping and expiry. Covers account type, group assignment, time limits, and revocation. Use for contractor VPN requests. Not for employee VPN (standard onboarding).
TL;DR
Create the contractor in the contractor OU/group with an expiry date, assign only the VPN group (not employee groups), and set a calendar reminder for the end date. Contractors get time-boxed, least-privilege VPN access, never the employee profile.
The error
(Access request; no error. Contractor needs VPN.)Steps
- Verify the request: sponsor (employee) name, business justification, and end date. Expected: all three present. No end date, no VPN; "indefinite contractor" is how access lingers.
- Create or enable the contractor account in the designated contractor OU with account expiry set to the end date. Expected: expiry set. The expiry is the safety net.
- Assign the contractor VPN group only. Expected: no employee groups. Check effective access; contractors must not inherit employee file shares or apps through nesting.
- Send the contractor the VPN client, the gateway address, and setup instructions. Expected: contractor connects successfully. Test before their start date if possible.
- Set a reminder for one week before expiry to confirm extension or revocation. Expected: reminder set. On the end date, disable the account and remove VPN group membership.
When to use
- Contractor, vendor, or temp needs VPN
- Any non-employee remote access request
When not to use
- Employee VPN setup (standard process)
- Permanent access (contractors are temporary by definition)
Compatibility
- Any VPN with AD/Entra group-based authorization
Variants
Contractor needs specific internal apps too
Grant per-app access with the same expiry; do not widen the VPN group itself.
Extension requested
Require fresh sponsor approval; do not auto-extend.
Why it happens
Contractor access is the highest-risk VPN population: external people, vague durations, broad needs. Time-boxing and least privilege contain the risk, and the expiry date automates the cleanup.
Edge cases
- Contractors from acquired companies may already have accounts; audit before creating duplicates.
- MFA is mandatory for contractors; no exceptions.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_3oMdA7-PEwLkDoF0gcgS2Q