# Include rarely connected clients in each DirectAccess migration ring

> How should DirectAccess-to-Always-On-VPN migration rings account for remote clients?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260908-106-include-rarely-connected-clients-in-each-directaccess-migration-ring/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-08T18:15:25+00:00
- Modified: 2026-09-08T18:23:26+00:00
- Last reviewed by DSE: 2026-09-08
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

How should DirectAccess-to-Always-On-VPN migration rings account for remote clients?

## Potentially affected

Administrators planning a phased DirectAccess migration to Always On VPN.

## DSE recommendation

Build each ring from both regularly connected and infrequently connected devices.

## Article

## Source facts

Microsoft recommends running DirectAccess and Always On VPN alongside one another during a planned migration. An incorrect task order can leave remote users without access to organizational resources. Migration rings divide the work into successive phases. Microsoft recommends including users who visit the office frequently and those who do not in each phase. Remote clients can take longer to receive the migration update. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/remote/remote-access/da-always-on-vpn-migration/da-always-on-migration-planning).

## Applicability

Identify the remote-user groups, device update paths, application access requirements, and support contacts. Review the complete migration sequence before changing the existing remote-access configuration.

## DSE recommendation

Build each ring from both regularly connected and infrequently connected devices. Define how completion will be observed for each group and who can assist a user who cannot reconnect. Ask the service owner to approve the criteria for progressing to the next ring and for pausing the migration.

## Verification

Track actual update receipt and test the required remote applications from each participating group. Include a device that has been away from the office for a representative period. Reconcile missing devices and user feedback before expanding a ring or withdrawing their former access route.

## Official references

[Microsoft Learn: Remote Access Always On VPN migration planning](https://learn.microsoft.com/en-us/windows-server/remote/remote-access/da-always-on-vpn-migration/da-always-on-migration-planning). Source reviewed September 8, 2026.

## Primary reference

- Name: Remote Access Always On VPN migration planning
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/windows-server/remote/remote-access/da-always-on-vpn-migration/da-always-on-migration-planning
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Include rarely connected clients in each DirectAccess migration ring,” DSE Security, https://update.dsesecurity.com/updates/dse-20260908-106-include-rarely-connected-clients-in-each-directaccess-migration-ring/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.