DirectAccess removal: Moving forward with modern remote access

As part of our continued commitment to security, reliability, and modern connectivity, DirectAccess will be removed from future Windows Server releases. DirectAccess was announced as deprecated in June of 2026. The recommendation for organizations remains to transition to Always On VPN, the modern Microsoft remote access solution.

This change reflects the industry's shift toward cloud-ready networking technologies that better align with current security requirements and hybrid work environments. In this article, learn what this removal means, why the change is happening, and the steps organizations should take to prepare for future Windows Server releases.

Understanding end-of-lifecycle terminology

Before a feature or a product is removed, it goes through a deprecation phase. DirectAccess was already deprecated in Windows Server, signaling that no further investments or enhancements would be made. Deprecation was the first signal that organizations should begin planning their transition to newer technologies.

Timeline

• June 11, 2026 Deprecation announcement
• October 30, 2026 Removal announcement
• TBD Removal from the next major release of Windows Server

Why move away from DirectAccess?

DirectAccess was originally built for on-premises, domain-centric environments. It depends on technologies such as IPv6 transition mechanisms and Group Policy–based management. This dependency can make it less suitable for cloud-first environments and modern access-control models. To continue benefitting from the best available security, we recommend transitioning to Always On VPN.

Benefits of Always On VPN

• Modern and secure: Supports Microsoft Entra ID (formerly, Azure AD) integration, multifactor authentication (MFA), Conditional Access, and Windows Hello for Business. Always On VPN aligns with modern Zero Trust security models.
• Simpler networking: Works with IPv4 and IPv6 without requiring complex IPv6 transition technologies.
• Broader device support: Works with domain joined, Entra ID–joined, hybrid, and nondomain joined devices. Always On VPN enables bring-your-own-device (BYOD) and cloud-first scenarios.
• Granular access control: Enables traffic filtering and per-user or per-group access policies. Always On VPN allows least privilege network access.
• Modern management: Can be deployed and managed using Microsoft Intune and mobile device management (MDM), in addition to traditional tooling.
• Better performance and reliability: Uses modern virtual private network (VPN) protocols like IKEv2 that provide improved performance and resilience on unreliable networks.
• Flexible infrastructure: Can be integrated with Windows Routing and Remote Access Service (RRAS) or supported non-Microsoft VPN solutions, reducing infrastructure lock-in.

Preparing for the transition

For migration guidance, see Remote Access Always On VPN migration overview. At a high level, the migration process consists of four stages:

1. Plan the migration. Build migration rings and learn about Always On VPN (feature comparisons, enhancements, and technology).
2. Deploy a side-by-side VPN infrastructure.
3. Deploy certificates and configuration to the clients.
4. Remove and decommission DirectAccess from client and server devices.

Summary

The removal of DirectAccess in future Windows Server releases is the next step following its deprecation announcement and reflects the continued investment in modern, secure, and cloud-ready remote access technologies by Microsoft. By planning and executing a transition to Always On VPN, organizations can help ensure uninterrupted remote connectivity while benefiting from modern security, management, and deployment capabilities. We remain committed to supporting organizations throughout this transition. If you need help planning the transition, contact Microsoft Support or your Microsoft representative.