Include rarely connected clients in each DirectAccess migration ring

Source facts

Microsoft recommends running DirectAccess and Always On VPN alongside one another during a planned migration. An incorrect task order can leave remote users without access to organizational resources. Migration rings divide the work into successive phases. Microsoft recommends including users who visit the office frequently and those who do not in each phase. Remote clients can take longer to receive the migration update. Microsoft documentation.

Applicability

Identify the remote-user groups, device update paths, application access requirements, and support contacts. Review the complete migration sequence before changing the existing remote-access configuration.

DSE recommendation

Build each ring from both regularly connected and infrequently connected devices. Define how completion will be observed for each group and who can assist a user who cannot reconnect. Ask the service owner to approve the criteria for progressing to the next ring and for pausing the migration.

Verification

Track actual update receipt and test the required remote applications from each participating group. Include a device that has been away from the office for a representative period. Reconcile missing devices and user feedback before expanding a ring or withdrawing their former access route.

Official references

Microsoft Learn: Remote Access Always On VPN migration planning. Source reviewed September 8, 2026.