One App registration for different application

Create a separate Microsoft Entra enterprise application for the second VPN endpoint if it has different SAML sign-on, logout, Entity ID, claims, assignments, or signing requirements.

Recommended configuration

For two independently addressable VPN gateways:

1. In the Microsoft Entra admin center, go to Entra ID → Enterprise apps → All applications → New application.
2. Select Create your own application.
3. Select Integrate any other application you don't find in the gallery (Non-gallery), and create the application.
4. Open Single sign-on → SAML → Basic SAML Configuration.
5. Configure the second VPN gateway’s:
   • Identifier (Entity ID) — use the value supplied by that VPN instance.
   • Reply URL (Assertion Consumer Service URL) — use its HTTPS ACS endpoint.
   • Sign-on URL, Relay State, and Logout URL, if required.
6. Configure its claims and download or copy its SAML certificate/metadata.
7. Import that metadata into the second VPN gateway, assign a test user or group, and test both sign-in and logout.

The Entity ID must be unique among applications in the tenant. Creating the application requires an appropriate role such as Application Administrator or Cloud Application Administrator.^1^

This design isolates configuration and allows each VPN instance to have its own certificate, claims, assignments, Conditional Access targeting, and lifecycle. Microsoft describes separate service principals as the multi-instance design when application instances require instance-specific configuration or signing keys.^2^

When one enterprise application can be reused

One enterprise application can contain:

• Multiple Identifiers
• Multiple Reply URLs (ACS URLs)

Therefore, reuse can work when both VPN connections are instances of the same logical SAML service provider, accept the same claims and signing configuration, and differ only in the ACS endpoint. Under Enterprise apps → your application → Single sign-on → SAML → Basic SAML Configuration, use Add identifier and Add reply URL as needed.^1^

However, this does not provide a complete independent SAML configuration for each VPN connection. Settings such as the optional Sign-on URL and Logout URL are configured at the enterprise-application level, rather than as separate endpoint profiles tied to each reply URL.

Also ensure each VPN sends an explicit ACS URL in its SP-initiated SAML request. If the request omits that value, Microsoft Entra can select any reply URL configured for the application, which can send the response to the wrong VPN endpoint.^3^

Practical decision

• Same VPN service, same Entity ID and SAML policy, redundant network endpoint only: one enterprise application may work, provided the VPN product supports multiple ACS endpoints and sends the intended ACS URL in each request.
• Different Entity IDs, logout URLs, claims, certificates, access assignments, or independently managed VPN appliances: create two enterprise applications.
• Same Entity ID required by both appliances but separate enterprise applications desired: verify the VPN vendor’s multi-instance guidance. Microsoft Entra requires unique Entity IDs across enterprise applications, and the documented multi-instancing flow may require targeting each service principal explicitly.^2^

The VPN vendor’s SAML documentation ultimately determines whether an active/standby pair should share one Entity ID and metadata configuration or use two independent SAML integrations.

References

1. Enable single sign-on for an enterprise application with a relying party STS
2. Configure app multi-instancing
3. Microsoft Entra ID is sending the token to an incorrect reply URL endpoint or localhost