Missing split tunnel route

For Windows VPN scenarios, the recommended approach is to configure split tunneling routes for the VPN connection and add the organization’s internal destination prefixes there so traffic for those subnets uses the VPN, while other traffic can use the local network.

If the VPN is managed through Intune on Windows devices:

1. Open the Windows VPN profile settings in Intune.
2. Go to Split Tunneling.
3. Set Split tunneling to Enable.
4. In Split tunneling routes for this VPN connection, add each internal subnet as a route by entering:
   • the destination prefix
   • the prefix size

This is the supported way to include internal IP ranges in the VPN path.

If the issue is specific to Microsoft 365 optimization, only Microsoft 365 Optimize endpoints should be excluded from the VPN path, while internal corporate subnets should remain in the VPN inclusion list. For Windows built-in VPN, this model is described as Force Tunneling with Exclusions, where defined destinations can use the physical interface and all other traffic continues through the VPN.

• Windows and Windows Holographic device settings to add VPN connections using Intune
• Optimize Microsoft 365 traffic for remote workers with the Windows VPN client