Network-to-network & hybrid connectivity
AWS Client VPN vs Azure VPN Gateway point-to-site
AWS Client VPN maps to point-to-site VPN on Azure VPN Gateway (or user VPN in Virtual WAN).
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | AWS Client VPN | Azure VPN Gateway point-to-site |
| Lifecycle | Generally available | Generally available |
| What it is | Managed OpenVPN-based remote-access VPN with certificate, Active Directory, or SAML federated authentication. | Remote-access VPN over OpenVPN, IKEv2, or SSTP, with certificate, RADIUS, or Microsoft Entra ID authentication. |
| Pricing model | Per endpoint association-hour plus per active connection-hour. | Included with the VPN gateway SKU (up to a connection limit), billed per gateway-hour. Virtual WAN user VPN is billed per scale unit and connection. |
| Docs | AWS Client VPN docs | Azure VPN Gateway point-to-site docs |
| Pricing page | AWS Client VPN pricing | Azure VPN Gateway point-to-site pricing |
| Exams | ANS-C01 Retiring SCS-C03 | AZ-700 |
Key differences
- Protocols. Client VPN is OpenVPN-based. Azure point-to-site supports OpenVPN, IKEv2, and SSTP (Windows only).
- Authentication. Client VPN supports certificates, Active Directory, and SAML federation. Azure supports certificates, RADIUS, and Microsoft Entra ID (OpenVPN only).
- Zero trust alternatives. For app-level access without a network VPN, AWS has Verified Access and Microsoft has Entra Private Access (covered under identity and security).
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Per endpoint association-hour plus per active connection-hour. AWS Client VPN pricing →
- Azure
- Included with the VPN gateway SKU (up to a connection limit), billed per gateway-hour. Virtual WAN user VPN is billed per scale unit and connection. Azure VPN Gateway point-to-site pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Advanced Networking – Specialty ANS-C01 | AWS | Specialty | retiring The exam is being retired. The last day to take it is Dec 31, 2026. Existing certifications stay active for their three-year period. |
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| Microsoft Certified – Azure Network Engineer Associate AZ-700 | Azure | Associate | current |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of AWS Client VPN?
AWS Client VPN maps to point-to-site VPN on Azure VPN Gateway (or user VPN in Virtual WAN).
How does pricing compare between AWS Client VPN and Azure VPN Gateway point-to-site?
AWS: Per endpoint association-hour plus per active connection-hour. Azure: Included with the VPN gateway SKU (up to a connection limit), billed per gateway-hour. Virtual WAN user VPN is billed per scale unit and connection. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Advanced Networking – Specialty (ANS-C01) [retiring]; AWS Certified Security – Specialty (SCS-C03); Microsoft Certified – Azure Network Engineer Associate (AZ-700).