In a previous post, I showcased how to: Create a Single Gateway, Multi-Region, VPN Architecture in Microsoft Azure. If testing with Windows didn’t work, it may be because Windows has to have its route tables updated to know how to tunnel past the gateway into the different regions. MAC and Linux can use IKEv2 without additional route adding, because those clients pick up the pushed routes from the IKEv2 negotiation itself; the Windows VPN client does not, which is why it needs the fix below.

A. For Windows, by default, it chooses IKEv2, we need to add a route to your spoke VNET

Suppose the VNET spoke address space is 10.2.0.0 255.255.0.0, and Client VPN interface IP is 172.16.100.130

B. We also need to test the CMAK or manually create a SSTP VPN profile to Azure on Windows client.