Configure Microsoft Entra authentication for the Point-to-Site VPN gateway. Microsoft explicitly states that Microsoft Entra ID authentication for Azure VPN Gateway P2S connections supports Conditional Access policies, allowing organizations to enforce controls such as multifactor authentication, user/group restrictions, sign-in risk requirements, and other identity-based access conditions during VPN authentication. Microsoft Learn

For Azure VPN Gateway, Microsoft Entra authentication uses the OpenVPN protocol and the Azure VPN Client. The gateway is configured with Microsoft Entra tenant, audience, and issuer information, and users authenticate with their Microsoft Entra identities when establishing the VPN connection. Microsoft Learn

Certificate authentication can authenticate P2S clients but does not provide the Microsoft Entra sign-in flow required for Conditional Access enforcement. Forced tunneling is a traffic-routing configuration, not an authentication mechanism. A custom IPsec/IKE policy controls cryptographic parameters used for VPN tunnels and likewise does not implement identity-based Conditional Access.

Therefore, to apply Conditional Access during VPN sign-ins, the required authentication method is:

Correct answer: C. Microsoft Entra authentication