Moved from SSL vpn (radius) to IPSecV2 (SAML) - Could I do better

I would say what you’ve done is a pretty common approach when moving from a fully on-prem environment to a hybrid Microsoft 365 / Entra ID setup.

A lot of organizations start moving VPN authentication toward Entra ID so they can use the same cloud identity, MFA, and Conditional Access policies they are already using for Microsoft 365.

That said, there’s nothing wrong with continuing to use the existing RADIUS/NPS setup either. It can still be integrated with MFA and may make sense if you already have other systems depending on RADIUS.

So in practice, it’s common to see both methods running in parallel for a while. You can keep the existing RADIUS-based VPN for legacy requirements while gradually moving users toward Entra ID + MFA.

Hi Prash

As said by Chris you did well.

You definitely did it more secure than before, since you have now IPsec instead of SSL, and 2FA instead of password only.
Regarding the auth source (RADIUS vs EntraID) it is up to you, but since you can do MFA with EntraID and (apparently) not with your RADIUS server then EntraID is better for security.

The move to IKEv2 with Entra ID and MFA sounds like a sensible step for a hybrid environment. It removes the dependency on the old RADIUS-only authentication while taking advantage of Entra ID and MFA.

That said, I’d be interested to hear what others are doing in similar hybrid setups. Keeping RADIUS with MFA could still make sense in some environments, while Entra-based authentication may be simpler if the organization is already heavily invested in Microsoft 365.