The declaration to configure a VPN using the Always On sub-type.
| Setting | Type | Required | Default | Manual Install | Supported OS |
|---|---|---|---|---|---|
Visible name VisibleName The name of the VPN connection that the system displays on the device. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
UI toggle enabled UIToggleEnabled If `true`, allows the user to disable the VPN configuration. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
Tunnel configurations TunnelConfigurations An array that contains an arbitrary number of tunnel configurations. 1 subkey | array | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ A tunnel configuration element TunnelConfigurationElement 3 subkeys | dictionary | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
└─ └─ Protocol type ProtocolType The type of connection, which needs to be `IKEv2`. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ Interfaces Interfaces The interfaces to apply this configuration to. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Interfaces element InterfacesElement | string | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
└─ └─ IKEv2 configuration IKEV2 The IKEv2 configuration for this tunnel. 17 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Host name HostName The IP address or hostname of the VPN server. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Local identifier LocalIdentifier Identifier of the IKEv2 client. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Remote identifier RemoteIdentifier The remote identifier. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Authentication details Authentication Settings that control authentication. 5 subkeys | dictionary | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 5 subkeys (deeply nested - 5 subkeys). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ Disconnect on idle settings. Idle Specifies details about how the system handles idle VPN connections. 1 subkey | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ Use IPv4 / IPv6 internal subnet attributes UseConfigurationAttributeInternalIPSubnet If `true`, negotiations should use IKEv2 Configuration Attribute `INTERNAL_IP4_SUBNET` and `INTERNAL_IP6_SUBNET`. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Disable mobility and multihoming DisableMOBIKE If `true`, the system disables MOBIKE. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Disable redirect DisableRedirect If `true`, the system disables IKEv2 redirect. If not set, the system redirects an IKEv2 connection when it receives a redirect request from the server. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enable NAT keep alive offload EnableNATKeepAliveOffload If `true`, enables NAT keepalive offload for Always On VPN IKEv2 connections. The device sends keepalive packets to maintain NAT mappings for IKEv2 connections that have a NAT on the path. It sends keepalive packets at regular intervals when the device is awake. If `NATKeepAliveOffloadEnable` is `true`, the system offloads keepalive packets to hardware while the device is asleep.
NAT keepalive offload has an impact on the battery life due to the extra workload during sleep. The default interval for the keepalive offload packets is 20 seconds over Wi-Fi and 110 seconds over Cellular interface. The default NAT keepalive works well on networks with small NAT mapping timeouts but imposes a potential battery impact. If a network has larger NAT mapping timeouts, larger keepalive intervals may be safely used to minimize battery impact. Modify the keepalive interval through the `NATKeepAliveInterval` key. | boolean | optional | true | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ NAT keepalive interval NATKeepAliveInterval The NAT Keepalive interval for Always On VPN IKEv2 connections. This value controls the interval that the device sends keepalive offload packets. The minimum value is 20 seconds. If no key is specified, the default is 20 seconds over Wi-Fi and 110 seconds over a cellular interface. | integer | optional | 20 | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enable perfect forward secrecy EnablePFS If `true`, enables Perfect Forward Secrecy (PFS) for IKEv2 Connections. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enable certificate revocation check EnableCertificateRevocationCheck If `true`, the system performs a certificate revocation check for IKEv2 connections. This is a best-effort revocation check and server response timeouts won't cause it to fail. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Maximum transmission unit MTU The Maximum Transmission Unit (MTU) specifies the maximum size in bytes of each packet that the system sends over the IKEv2 VPN interface. Range: 1280 - 1400 | integer | optional | 1280 | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enforce strict algorithm selection EnforceStrictAlgorithmSelection If set to `true`, the device doesn't allow DES, 3DES, and Diffie-Hellman groups less than 14. Also the device requires the encryption algorithm specified in `IKESecurityAssociationParameters` to be at least as cryptographically strong as the algorithm specified in `ChildSecurityAssociationParameters`. The device rejects this configuration if these requirements aren't met. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Post quantum key exchange PostQuantumKeyExchange Post Quantum Key Exchange settings. 4 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 4 subkeys (deeply nested - 4 subkeys). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ IKE security association parameters IKESecurityAssociationParameters These parameters apply to Child Security Association unless `ChildSecurityAssociationParameters` is specified. 5 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 5 subkeys (deeply nested - 5 subkeys). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ Child security association parameters ChildSecurityAssociationParameters The `ChildSecurityAssociationParameters` dictionaries. 5 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 5 subkeys (deeply nested - 5 subkeys). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | ||
Service exceptions ServiceExceptions An array that contains an arbitrary number of service exceptions. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ A service exception element ServiceExceptionElement 2 subkeys | dictionary | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
└─ └─ Service name ServiceName The name of a service that's exempt from Always On VPN.
`CellularServices` exempts `VoLTE`, `IMS`, `MMS`, and Wi-Fi calling.
`DeviceCommunication` exempts network traffic used for communicating with devices connected via USB or Wi-Fi. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ Action Action The action to take with network connections from the named service. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
Application exceptions ApplicationExceptions An array that contains an arbitrary number of apps whose connections occur outside the VPN. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ A application exception element ApplicationExceptionElement 2 subkeys | dictionary | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
└─ └─ Bundle identifier BundleIdentifier The app's bundle identifier. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ Limit to protocols LimitToProtocols Limit the exception to only the specified list of protocols, with support for `UDP` only. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Limit to protocol element LimitToProtocolElement | string | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
Allow captive web sheet AllowCaptiveWebSheet If `true`, allows traffic from Captive Web Sheet outside the VPN tunnel. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
Allow all captive network plugins AllowAllCaptiveNetworkPlugins If `true`, allows traffic from all captive networking apps outside the VPN tunnel to perform captive network handling. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
Allowed captive network plugins AllowedCaptiveNetworkPlugins The array of captive networking apps whose traffic is allowed outside the VPN tunnel, to perform captive network handling. Used only when `AllowAllCaptiveNetworkPlugins` is `false`. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ An allowed captive network plugin element AllowedCaptiveNetworkPluginElement 1 subkey | dictionary | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
└─ └─ Bundle identifier BundleIdentifier The bundle identifier for the app that's allowed on the captive network. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
Explore the full catalogue of Apple Mobile Device Management (MDM) and Declarative Device Management (DDM) policies for macOS and iOS. Search, filter, and reference policy keys for use with Microsoft Intune, Jamf, or any standards-compliant MDM solution.
com.apple.wifi.managed – Wi-Fi network configurationcom.apple.vpn.managed – VPN configurationcom.apple.applicationaccess – App and feature restrictionscom.apple.security.pkcs1 – Certificate (PKCS#1) payloadcom.apple.security.pkcs12 – Identity certificate (PKCS#12) payloadcom.apple.security.scep – SCEP certificate enrolmentcom.apple.mail.managed – Mail account configurationcom.apple.eas.account – Exchange ActiveSync accountcom.apple.MCX – Managed Client (macOS) preferencescom.apple.MCX.FileVault2 – FileVault 2 disk encryptioncom.apple.dock – macOS Dock configurationcom.apple.screensaver – Screensaver configurationcom.apple.loginwindow – macOS login window configurationcom.apple.systempolicy.managed – Gatekeeper / system policycom.apple.systempreferences – System Preferences pane restrictionscom.apple.SoftwareUpdate – Software update behaviourcom.apple.TCC.configuration-profile-policy – Privacy Preferences Policy Control (PPPC)com.apple.notificationsettings – Per-app notification settingscom.apple.webcontent-filter – Web content filtercom.apple.dnsSettings.managed – DNS settings (DoH / DoT)com.apple.relay.managed – Network relay configurationcom.apple.extensiblesso – Extensible Single Sign-Oncom.apple.configuration.passcode.settings – DDM: passcode policycom.apple.configuration.softwareupdate.enforcement.specific – DDM: enforced software updatecom.apple.configuration.services.configuration-files – DDM: service configuration filescom.apple.configuration.management.status-subscriptions – DDM: status subscriptionscom.apple.activation.simple – DDM: simple activation predicatecom.apple.management.organization-info – DDM: organization information