The declaration to configure a VPN using the Always On sub-type.
| Setting | Type | Required | Default | Manual Install | Supported OS |
|---|---|---|---|---|---|
Visible name VisibleName The name of the VPN connection that the system displays on the device. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
UI toggle enabled UIToggleEnabled If `true`, allows the user to disable the VPN configuration. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
Tunnel configurations TunnelConfigurations An array that contains an arbitrary number of tunnel configurations. 1 subkey | array | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ A tunnel configuration element TunnelConfigurationElement 3 subkeys | dictionary | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
└─ └─ Protocol type ProtocolType The type of connection, which needs to be `IKEv2`. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ Interfaces Interfaces The interfaces to apply this configuration to. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Interfaces element InterfacesElement | string | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
└─ └─ IKEv2 configuration IKEV2 The IKEv2 configuration for this tunnel. 20 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Host name HostName The IP address or hostname of the VPN server. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Local identifier LocalIdentifier Identifier of the IKEv2 client. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Remote identifier RemoteIdentifier The remote identifier. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Authentication details Authentication Settings that control authentication. 5 subkeys | dictionary | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 5 subkeys (deeply nested - 5 subkeys). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ Provider details Provider Specifies details about the provider. 2 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 2 subkeys (deeply nested - 2 subkeys). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ Disconnect on idle settings. Idle Specifies details about how the system handles idle VPN connections. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 3 subkeys (deeply nested - 3 subkeys). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ On demand details OnDemand Specifies details about how the system controls on-demand VPN. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 3 subkeys (deeply nested - 3 subkeys). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ Use IPv4 / IPv6 internal subnet attributes UseConfigurationAttributeInternalIPSubnet If `true`, negotiations should use IKEv2 Configuration Attribute `INTERNAL_IP4_SUBNET` and `INTERNAL_IP6_SUBNET`. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Disable mobility and multihoming DisableMOBIKE If `true`, the system disables MOBIKE. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Disable redirect DisableRedirect If `true`, the system disables IKEv2 redirect. If not set, the system redirects an IKEv2 connection when it receives a redirect request from the server. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enable NAT keep alive offload EnableNATKeepAliveOffload If `true`, enables NAT keepalive offload for Always On VPN IKEv2 connections. The device sends keepalive packets to maintain NAT mappings for IKEv2 connections that have a NAT on the path. It sends keepalive packets at regular intervals when the device is awake. If `NATKeepAliveOffloadEnable` is `true`, the system offloads keepalive packets to hardware while the device is asleep.
NAT keepalive offload has an impact on the battery life due to the extra workload during sleep. The default interval for the keepalive offload packets is 20 seconds over Wi-Fi and 110 seconds over Cellular interface. The default NAT keepalive works well on networks with small NAT mapping timeouts but imposes a potential battery impact. If a network has larger NAT mapping timeouts, larger keepalive intervals may be safely used to minimize battery impact. Modify the keepalive interval through the `NATKeepAliveInterval` key. | boolean | optional | true | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ NAT keepalive interval NATKeepAliveInterval The NAT Keepalive interval for Always On VPN IKEv2 connections. This value controls the interval that the device sends keepalive offload packets. The minimum value is 20 seconds. If no key is specified, the default is 20 seconds over Wi-Fi and 110 seconds over a cellular interface. | integer | optional | 20 | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enable perfect forward secrecy EnablePFS If `true`, enables Perfect Forward Secrecy (PFS) for IKEv2 Connections. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enable certificate revocation check EnableCertificateRevocationCheck If `true`, the system performs a certificate revocation check for IKEv2 connections. This is a best-effort revocation check and server response timeouts won't cause it to fail. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enable fallback EnableFallback If `true`, the system enables a tunnel over cellular data to carry traffic that's eligible for Wi-Fi Assist and also requires VPN.
Enabling fallback requires that the server support multiple tunnels for a single user. | boolean | optional | false | ✗No | |
└─ └─ └─ Maximum transmission unit MTU The Maximum Transmission Unit (MTU) specifies the maximum size in bytes of each packet that the system sends over the IKEv2 VPN interface. Range: 1280 - 1400 | integer | optional | 1280 | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enforce strict algorithm selection EnforceStrictAlgorithmSelection If set to `true`, the device doesn't allow DES, 3DES, and Diffie-Hellman groups less than 14. Also the device requires the encryption algorithm specified in `IKESecurityAssociationParameters` to be at least as cryptographically strong as the algorithm specified in `ChildSecurityAssociationParameters`. The device rejects this configuration if these requirements aren't met. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Post quantum key exchange PostQuantumKeyExchange Post Quantum Key Exchange settings. 4 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 4 subkeys (deeply nested - 4 subkeys). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ IKE security association parameters IKESecurityAssociationParameters These parameters apply to Child Security Association unless `ChildSecurityAssociationParameters` is specified. 5 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 5 subkeys (deeply nested - 5 subkeys). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ Child security association parameters ChildSecurityAssociationParameters The `ChildSecurityAssociationParameters` dictionaries. 5 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 5 subkeys (deeply nested - 5 subkeys). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | ||
Service exceptions ServiceExceptions An array that contains an arbitrary number of service exceptions. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ A service exception element ServiceExceptionElement 2 subkeys | dictionary | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
└─ └─ Service name ServiceName The name of a service that's exempt from Always On VPN.
`CellularServices` exempts `VoLTE`, `IMS`, `MMS`, and Wi-Fi calling.
`DeviceCommunication` exempts network traffic used for communicating with devices connected via USB or Wi-Fi. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ Action Action The action to take with network connections from the named service. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
Application exceptions ApplicationExceptions An array that contains an arbitrary number of apps whose connections occur outside the VPN. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ A application exception element ApplicationExceptionElement 2 subkeys | dictionary | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
└─ └─ Bundle identifier BundleIdentifier The app's bundle identifier. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ Limit to protocols LimitToProtocols Limit the exception to only the specified list of protocols, with support for `UDP` only. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Limit to protocol element LimitToProtocolElement | string | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
Allow captive web sheet AllowCaptiveWebSheet If `true`, allows traffic from Captive Web Sheet outside the VPN tunnel. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
Allow all captive network plugins AllowAllCaptiveNetworkPlugins If `true`, allows traffic from all captive networking apps outside the VPN tunnel to perform captive network handling. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
Allowed captive network plugins AllowedCaptiveNetworkPlugins The array of captive networking apps whose traffic is allowed outside the VPN tunnel, to perform captive network handling. Used only when `AllowAllCaptiveNetworkPlugins` is `false`. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ An allowed captive network plugin element AllowedCaptiveNetworkPluginElement 1 subkey | dictionary | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
└─ └─ Bundle identifier BundleIdentifier The bundle identifier for the app that's allowed on the captive network. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
DNS DNS A dictionary to use for all VPN types. 9 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ DNS protocol Protocol The transport protocol to communicate with the DNS server. | string | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ Server URL ServerURL The URI template of a DNS-over-HTTPS server, as defined in RFC 8484, which needs to use the `https://` scheme. The system uses the hostname or address in the URL to validate the server certificate. If `ServerAddresses` isn't specified, the system uses the hostname or address in the URL to determine the server addresses. This key is required if the `DNSProtocol` is `HTTPS`. | string | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ Server name ServerName The hostname of a DNS-over-TLS server to validate the server certificate, as defined in RFC 7858. If `ServerAddresses` isn't specified, the system uses the hostname to determine the server addresses. This key is required if the `DNSProtocol` is `TLS`. | string | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ DNS server addresses ServerAddresses The array of DNS server IP address strings. These IP addresses can be a mixture of IPv4 and IPv6 addresses. 1 subkey | array | required | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ Server address element ServerAddressesElement | string | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
└─ DNS search domains SearchDomains The list of domain strings used to fully qualify single-label host names. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ Search domains element SearchDomainsElement | string | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
└─ Domain name DomainName The primary domain of the tunnel. | string | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ Supplemental match domains SupplementalMatchDomains The list of domain strings used to determine which DNS queries use the DNS resolver settings in `ServerAddresses`. The system uses this key to create a split DNS configuration where it resolves only hosts in certain domains using the tunnel's DNS resolver. The system uses the default resolver for hosts that aren't in one of the domains in this list.
If `SupplementalMatchDomains` contains the empty string it becomes the default domain.
Split-tunnel configurations can direct all DNS queries to the VPN DNS servers before the primary DNS servers. If the VPN tunnel becomes the network's default route, the servers listed in `ServerAddresses` become the default resolver and the system ignores the `SupplementalMatchDomains` list. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ Supplemental match domains element SupplementalMatchDomainsElement | string | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
└─ Supplemental match domains no search SupplementalMatchDomainsNoSearch If `true`, don't append the domains in the `SupplementalMatchDomains` list to the resolver's list of search domains. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ Identity asset reference IdentityAssetReference The identifier of a credential asset declaration that contains the identity that the system uses to authenticate the user to the DNS resolver. | string | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
Proxies Proxies The dictionary to use to configure `Proxies` for use with `VPN`. 5 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ Proxy auto config enable AutoConfigEnable If `true`, enables automatic proxy configuration. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ Proxy auto discovery enable AutoDiscoveryEnable If `true`, enables proxy auto discovery. | boolean | optional | true | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ Proxy server URL AutoConfigURLString The URL to the location of the proxy auto-configuration file. Used only when `ProxyAutoConfigEnable` is `true`. | string | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ Supplemental match domains SupplementalMatchDomains An array of domains that defines which hosts use proxy settings for hosts. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ Supplemental match domains element SupplementalMatchDomainsElement | string | — | ✓Yes | iOS (27.0+)visionOS (27.0+) | |
└─ Protocol Protocol The dictionary to use to configure HTTP servers for `Proxies` for use with `VPN`. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ HTTP protocol HTTP The dictionary to use to configure the HTTP (non-TLS) server. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enable HTTP Enable If `true`, enables proxy for HTTP traffic. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTP host name HostName The host name of the HTTP proxy. | string | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTP port Port The port number of the HTTP proxy. This field is required if `HostName` is specified. Range: 0 - 65535 | integer | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ HTTPS protocol HTTPS The dictionary to use to configure the HTTPS (TLS) server. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enable HTTPS Enable If `true`, enables proxy for HTTPS traffic. | boolean | optional | false | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTPS host name HostName The host name of the HTTPS proxy. | string | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTPS port Port The port number of the HTTPS proxy. This field is required if `HostName` is specified. Range: 0 - 65535 | integer | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
└─ └─ Credentials asset reference CredentialsAssetReference The identifier of an asset declaration that contains the credentials (user name and password) to authenticate with the proxy server. | string | optional | — | ✓Yes | iOS (27.0+)visionOS (27.0+) |
Explore the full catalogue of Apple Mobile Device Management (MDM) and Declarative Device Management (DDM) policies for macOS and iOS. Search, filter, and reference policy keys for use with Microsoft Intune, Jamf, or any standards-compliant MDM solution.
com.apple.wifi.managed – Wi-Fi network configurationcom.apple.vpn.managed – VPN configurationcom.apple.applicationaccess – App and feature restrictionscom.apple.security.pkcs1 – Certificate (PKCS#1) payloadcom.apple.security.pkcs12 – Identity certificate (PKCS#12) payloadcom.apple.security.scep – SCEP certificate enrolmentcom.apple.mail.managed – Mail account configurationcom.apple.eas.account – Exchange ActiveSync accountcom.apple.MCX – Managed Client (macOS) preferencescom.apple.MCX.FileVault2 – FileVault 2 disk encryptioncom.apple.dock – macOS Dock configurationcom.apple.screensaver – Screensaver configurationcom.apple.loginwindow – macOS login window configurationcom.apple.systempolicy.managed – Gatekeeper / system policycom.apple.systempreferences – System Preferences pane restrictionscom.apple.SoftwareUpdate – Software update behaviourcom.apple.TCC.configuration-profile-policy – Privacy Preferences Policy Control (PPPC)com.apple.notificationsettings – Per-app notification settingscom.apple.webcontent-filter – Web content filtercom.apple.dnsSettings.managed – DNS settings (DoH / DoT)com.apple.relay.managed – Network relay configurationcom.apple.extensiblesso – Extensible Single Sign-Oncom.apple.configuration.passcode.settings – DDM: passcode policycom.apple.configuration.softwareupdate.enforcement.specific – DDM: enforced software updatecom.apple.configuration.services.configuration-files – DDM: service configuration filescom.apple.configuration.management.status-subscriptions – DDM: status subscriptionscom.apple.activation.simple – DDM: simple activation predicatecom.apple.management.organization-info – DDM: organization information