Always On VPN Device Tunnel deployed as device configuration profile during Autopilot (ProfileXML)

Yes—the Always On VPN device-tunnel profile should be removed after the device is excluded from the assigned group, the assignment change propagates, and the Windows device checks in with Intune. Three hours is not necessarily abnormal: change notifications can take up to a few hours, while the normal Windows maintenance check-in is approximately every eight hours. Intune reporting can lag behind the device state as well. ^1^

Trigger and verify removal

1. Confirm the device no longer belongs to Autopilot - Always On VPN Device Tunnel Devices and that no other group assigned to the same profile still includes it.
2. In the Intune admin center, open Devices → All devices → select the device → Sync.
3. On the device, sign in with the Microsoft Entra user and trigger another sync:
   • Company Portal → Settings → Sync, or
   • Company Portal → Devices → select this device → Check status.
4. Keep the device powered on and internet-connected. Wait for the assignment change and subsequent device check-in—potentially through the next approximately eight-hour maintenance cycle.
5. Check the actual VPN profile on the device rather than relying only on the Intune report, because portal status can update later than the endpoint.

The VPNv2 CSP supports Delete on the device-scoped profile node, so the profile created under:

./Device/Vendor/MSFT/VPNv2/{ProfileName}/ProfileXML

is technically removable through MDM; it is not inherently permanent or “tattooed.” Microsoft’s VPNv2 guidance also treats deletion of the entire {ProfileName} node as the supported way to remove or replace a VPN configuration. ^2^

If it remains after assignment propagation and sync

If the device is definitely excluded, has completed a successful Intune sync, and the tunnel remains beyond the normal refresh window:

• Check whether another Intune profile assigns the same VPN profile name or VPNv2 OMA-URI.
• Confirm the configuration profile’s device status no longer shows the device as currently targeted; remember that report status may lag.
• Collect the device’s MDM diagnostics and open an Intune support request if no delete operation reaches the device. The relevant expected operation is deletion of the complete device-scoped VPNv2 {ProfileName} node—not merely setting AlwaysOn to false.
• Avoid manually deleting the tunnel until its Intune assignment is confirmed removed. Otherwise, an outstanding assignment can recreate it at the next sync.

Removing the profile can also remove the connectivity path used to reach the domain, certificates, or Intune endpoints. Verify that FortiClient or another internet path is available before forcing cleanup.

References

1. Common questions, answers, and scenarios with policies and profiles in Microsoft Intune
2. VPNv2 CSP