Need help with Intune Custom VPN (VPNv2 CSP) - Windows unable to parse XML data (EAP-TLS)

Hi,

I am trying to deploy a native Windows IKEv2 Split-Tunnel VPN profile via Microsoft Intune using a Custom OMA-URI policy. The goal is to enforce strict EAP-TLS authentication using device/user certificates.

Target OMA-URI: ./Device/Vendor/MSFT/VPNv2/Windows%20Native%20VPN/ProfileXML

Data Type: String (XML file)

The Problem: Whenever the client machine syncs, the profile fails to apply.

-I used PowerShell ($Vpn.EapConfigXmlStream.OuterXml) to extract the working, raw <EapHostConfig> block directly from that successful manual connection.

-When I wrap that exact, system-generated EAP block inside the master Intune <VPNProfile> template, the local Windows MDM configuration manager completely rejects it as unparseable. I suspect it's a strict schema sequence (xs:sequence) issue or a hidden tag layout conflict inside my outer XML wrapper.

Does anyone have a known-working ProfileXML template for an IKEv2 EAP-TLS split-tunnel connection that cleanly passes the Windows MDM parser, or can you spot which specific element in my outer XML layout is violating the CSP's strict schema sequence?

<VPNProfile>
  <ProfileName>Windows Native VPN</ProfileName>
  <NativeProfile>
    <Servers>x.x.x.x</Servers>
    <RoutingPolicyType>SplitTunnel</RoutingPolicyType>
    <NativeProtocolType>IKEv2</NativeProtocolType>
    <Authentication>
      <UserMethod>Eap</UserMethod>
      <Eap>
        <Configuration><![CDATA[<EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><EapMethod><Type xmlns="http://www.microsoft.com/provisioning/EapCommon">13</Type><VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId><VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType><AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId></EapMethod><Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"><Type>13</Type><EapType xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV1"><CredentialsSource><CertificateStore><SimpleCertSelection>true</SimpleCertSelection></CertificateStore></CredentialsSource><ServerValidation><DisableUserPromptForServerValidation>false</DisableUserPromptForServerValidation><ServerNames></ServerNames><TrustedRootCA>YOUR_THUMBPRINT_1</TrustedRootCA><TrustedRootCA>YOUR_THUMBPRINT_2</TrustedRootCA></ServerValidation><DifferentUsername>false</DifferentUsername><PerformServerValidation xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">true</PerformServerValidation><AcceptServerName xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">true</AcceptServerName><TLSExtensions xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2"><FilteringInfo xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV3"><CAHashList Enabled="true"><IssuerHash>YOUR_THUMBPRINT_1</IssuerHash><IssuerHash>YOUR_THUMBPRINT_2</IssuerHash></CAHashList></FilteringInfo></TLSExtensions></EapType></Eap></Config></EapHostConfig>]]></Configuration>
      </Eap>
    </Authentication>
  </NativeProfile>
  <Route>
    <Address>10.0.0.0</Address>
    <PrefixSize>8</PrefixSize>
  </Route>
  <DomainNameInformation>
    <DomainName>.x.x.com</DomainName>
    <DnsServers>x.x.x.x,x.x.x.x</DnsServers>
  </DomainNameInformation>
</VPNProfile>