FortiClient Always-On VPN blocks captive portals - how to handle authentication on public Wi-Fi?

We introduced a always-on VPN on our company laptop, which is enforced using FortiClient , managed via FortiEMS. The system runs Windows 11 Enterprise, and the firewall/antivirus is Windows Defender. The Problem: The issue arises when connecting to public Wi-Fi networks that use captive portals (e.g., in hotels, airports, cafés). Because the VPN is always-on, it immediately tries to establish a secure tunnel before the captive portal can be accessed, which blocks the portal and prevents authentication with the Wi-Fi network. Most users are in a home office or at client sites and cannot use the

Question by Lossos on Super User, licensed CC BY-SA. We show a short excerpt and link to the original thread as credit.