VPN Access Control: Users, Groups and Permissions

When people choose a company VPN, they usually ask about the tunnel: which protocol, how fast, how many people can connect. The more important question is what happens after someone connects. Can an accountant reach the developers' servers? Can a contractor see the whole office network? Does a former employee's account still work? Those questions are about access control, and in practice they decide whether a VPN is a strong gate or merely an unlocked door with a nice lock on it.

This article is a practical guide to VPN access control for small and mid-sized organisations. It covers the building blocks (users, groups and permissions), the principle of least privilege, how to separate networks, how to handle joiners, movers and leavers, and how to review access without it becoming a full-time job. It is written for someone who runs the VPN for a team, not for a person using a VPN app for personal privacy. If you are unsure which of those you are, start with our comparison of business VPN vs personal VPN.

The three questions access control answers

Every access decision comes down to three questions, asked in this order.

1. Who are you? This is authentication. The system checks a password, a second factor, a certificate or a combination.
2. Are you allowed to connect? This is authorisation at the front gate. It decides whether your account may use the VPN at all and from which kind of device.
3. What may you reach once connected? This is authorisation inside the network. It decides which servers, ports and applications your session can touch.

Many small organisations do the first thing well enough and almost nothing about the third. The result is a flat network: once a person is in, they can see everything. That is the single most common weakness in company VPN setups, and it turns one stolen laptop or one phished password into a company-wide problem.

Good design therefore pushes control inward. It does not stop at "can this person connect?" but continues to "which doors can this person open?".

Start with individual accounts

The foundation is simple and often skipped: every person has their own account.

• No shared logins. A shared account called "office" or "support" makes it impossible to know who connected, and impossible to remove one person without disrupting everyone.
• Names tied to a real directory. Accounts should be created from the same list of employees that HR and IT use, so that nobody exists on the VPN who is not a current member of the team.
• Separate admin accounts. The people who manage the VPN should use a normal account for daily work and a separate privileged account only for administration.
• Service accounts documented. Machines that connect on their own, such as a branch device, need accounts too. Give them narrow permissions and a named owner.

A directory of users, with each person's role, is the single source of truth for everything that follows. If you already use an identity system for email and documents, connecting the VPN to it saves a great deal of duplicated work.

Use groups, not one-off permissions

Setting permissions person by person works for five people and falls apart at twenty. The better pattern is to define groups that represent roles, give permissions to groups, and put people into groups.

Typical groups for a small organisation:

• Everyone, with access only to common services such as email and chat.
• Finance, with access to the accounting system and the finance share.
• Engineering, with access to development servers and code hosting.
• Support, with access to the ticketing system and customer tools.
• IT administrators, with access to management interfaces, used through separate admin accounts.
• Contractors, with narrow, time-limited access to one project only.

When someone joins, you place them in the right group and they have what they need. When someone changes role, you move them. When they leave, you remove them and everything goes with it. This also makes reviews readable: a list of five groups is much easier to check than a list of one hundred individual rules.

Apply least privilege

Least privilege means giving each group the minimum access that lets it do its work, and nothing more. In a VPN, that has three practical layers.

Network layer. Decide which subnets or addresses each group may reach. Finance may reach the accounting server; it has no reason to reach the build servers.

Port and service layer. Even within a network, allow only the ports that are needed. A group that needs a web application does not need access to the database port behind it.

Time and device layer. Some access may be allowed only during working hours, from managed devices, or for a fixed period such as the length of a project.

The reasoning is the same one set out in NIST's telework and remote access guidance: reduce what a remote device can reach to what it needs and protect the link between the two ends. The more complete model, in which every request is checked on its own merits, is described in NIST's zero trust architecture, and our comparison of zero trust and VPN explains how it relates to a traditional VPN.

A sample permission matrix

A matrix like this is worth writing down, even for a ten-person company. It turns "who can reach what" from a feeling into a document.

Group	Email and chat	File share	Accounting system	Dev servers	Ticketing	Admin interfaces
Everyone	Yes	General folders	No	No	No	No
Finance	Yes	Finance folder	Yes	No	No	No
Engineering	Yes	Engineering folder	No	Yes	No	No
Support	Yes	Support folder	No	No	Yes	No
IT administrators	Yes	All, as needed	No	Limited	Yes	Yes, through admin accounts
Contractors	Yes	Their project folder	No	Only their project	Only if required	No

Notice what the matrix shows. Nobody has access to everything. The administrator row is wide but still not unrestricted, and uses separate accounts. A contractor sees one project, not the company. Each "No" is a door that a stolen account cannot open.

Separate networks inside the tunnel

Groups work best when the network itself is divided, so that a group's permissions map to real boundaries. This is called segmentation. A simple model for a small organisation:

• A general segment for ordinary office services.
• A finance segment for accounting systems and sensitive documents.
• A development segment for build servers and test environments.
• A management segment for network equipment and admin interfaces, reachable only by a small group.
• A guest and contractor segment for outside people, with access only to what a project needs.

The VPN then assigns each group an address range or a firewall rule that matches its segment. If a contractor's laptop is infected, the malware sees only the contractor segment. If you also keep servers patched and monitored, the damage is limited to a small area.

Authentication that matches the risk

Passwords alone are the weakest option. A VPN is the front door of the organisation, so its authentication deserves the most care.

1. Multi-factor sign-in for everyone. A second factor from an authenticator app or a security key makes stolen passwords far less useful. CISA's guide to multi-factor authentication and our article on two-factor authentication explain the choices. Prefer app-based or hardware factors to text messages when you can.
2. Device certificates for managed laptops, so that only devices you issued can connect even if a password leaks. See how VPN certificates work.
3. Strong password rules based on length, not on forced frequent changes, in line with NIST's digital identity guidelines.
4. Lockouts and alerts for repeated failures, so someone notices when an account is being guessed.
5. Short sessions for sensitive groups, so a laptop left open does not stay connected for days.

Choose the strength by group. A contractor with narrow access may need only a strong password and a second factor. An administrator reaching network equipment should need a hardware key and a managed device.

Joiners, movers and leavers

Most access problems appear at transitions. A simple, written process prevents them.

Joiners.

1. A manager requests access for a named person, stating the role.
2. IT creates the account, adds the person to the matching group and issues the second factor.
3. The new starter enrols their device and tests the connection.
4. The record says who approved the access and when.

Movers. When a person changes team, the old group is removed on the same day the new one is added. Accumulated permissions from past roles are one of the most common ways that a quiet employee ends up with far more access than anyone intended.

Leavers. On the last day, disable the VPN account, revoke any certificates and tokens, and end active sessions. Do not wait until the end of the month. Accounts of departed staff are a favourite target because nobody is watching them.

Contractors and temporary staff. Give every outside account an end date at the time you create it. When the date arrives the account should expire unless someone actively renews it.

Logging, monitoring and regular reviews

Access control that nobody checks drifts. Plan three simple habits.

• Keep sign-in logs. Record who connected, from which device and when, and keep the logs for a period that matches your obligations. Do not keep more personal data than you need.
• Watch for oddities. Repeated failures, connections at unusual hours, or one account signing in from two distant places in a short time deserve a look.
• Review quarterly. Ask each group owner to confirm that every member still needs access. For wide-access accounts, review monthly. Remove anything that nobody can justify.

Reviews do not have to be heavy. A one-page list per group, signed off by the manager, is enough for most small organisations and creates a record that clients and auditors appreciate.

Three examples

A ten-person agency. The agency has a single office router with a VPN, and everyone shares one login. After a laptop is stolen, they realise they cannot tell which logins to change. They move to individual accounts with a second factor, define three groups (staff, finance and contractors) and limit contractors to one project folder. Setup takes an afternoon. The quarterly review takes fifteen minutes.

A thirty-person software firm. Developers need development servers, support staff need the ticketing tool, and finance has its own system. The firm creates segments for each and maps the groups to them. Administrators use separate accounts with hardware keys. When a developer moves into support, the engineering group is removed on the same day.

A clinic with outside specialists. Visiting specialists need access to one records system for a few hours a week. Instead of full VPN access, they get a contractor group with that single system, a second factor and an account that expires at the end of the contract. The clinic can show precisely who could reach patient records, which matters for its own compliance.

Mistakes to avoid

• A flat network behind the VPN. Authentication at the gate with no limits inside is a hallway with every door open.
• Shared accounts. They remove accountability and make offboarding messy.
• Permissions that only grow. Without reviews, access accumulates.
• Forgetting service and contractor accounts. These are the ones nobody notices.
• Trusting the device because the password is right. Check the device where you can.
• Using a consumer VPN app for this job. A VPN service for individuals protects one person's traffic. It does not let you decide who in your organisation reaches which internal system. For that you need a VPN or gateway that you run or buy for business use.

Summary

Access control decides whether a company VPN is a strong gate or just a tunnel. Give every person their own account, organise people into role-based groups, grant each group the least access that lets it work, and separate the network so that permissions map to real boundaries. Protect sign-in with a second factor and, for managed laptops, a device certificate. Handle joiners, movers and leavers with a written process, keep sign-in logs, and review access on a fixed schedule.

If you are also looking at a personal VPN for your own travel or public Wi-Fi use, the pricing page shows how a prepaid pass works, but remember that it protects your own traffic and is separate from the access controls your organisation runs.