The declaration to configure a VPN using the IKEv2 sub-type.
| Setting | Type | Required | Default | Manual Install | Supported OS |
|---|---|---|---|---|---|
Visible name VisibleName The name of the VPN connection that the system displays on the device. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Host name HostName The IP address or hostname of the VPN server. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Local identifier LocalIdentifier Identifier of the IKEv2 client. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Remote identifier RemoteIdentifier The remote identifier. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Authentication details Authentication Settings that control authentication. 5 subkeys | dictionary | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Authentication method Method The type of authentication method for the VPN.
To enable EAP-only authentication, set this to `None` and `ExtendedAuthEnabled` to `true`. If this is `None` and the `ExtendedAuthEnabled` key isn't set, the authentication configuration defaults to `SharedSecret`. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Credentials asset reference CredentialsAssetReference The identifier of an asset declaration that contains the credentials (password) to authenticate with the VPN server. Required when `Authentication.Method` is set to `SharedSecret`. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Certificate type IdentityCertificateType The type of key used by the identity set in the `IdentityAssetReference` to use for IKEv2 machine authentication. If this key is included, the system requires a value for `ServerCertificateIssuerCommonName`. | string | optional | RSA | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Identity asset reference IdentityAssetReference The identifier of a credential asset declaration that contains the identity that this account requires to authenticate with the VPN server. If the value of `AuthenticationMethod` is `Certificate`, the system sends this certificate out for IKEv2 machine authentication. If extended authentication (EAP) is used, the system sends this certificate out for EAP-TLS authentication. Required when `Authentication.Method` is set to `Certificate`. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Extended authentication (EAP) ExtendedAuth Specifies details about extended authentication (EAP). 6 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Enabled Enabled If `true`, enables EAP-only authentication. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Credentials asset reference CredentialsAssetReference The identifier of an asset declaration that contains the credentials (user name and password) to authenticate with the VPN server. Required when `Enabled` is set to `true`. Implies the use of EAP-MSCHAPv2. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Server certificate issuer common name ServerCertificateIssuerCommonName Common Name of the server certificate issuer. If set, this field causes IKE to send a certificate request based on this certificate issuer to the server. This key is required if the `IdentityCertificateType` key is included and the `ExtendedAuth.Enabled` key is `true`. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Server certificate common name ServerCertificateCommonName The common name of the server certificate. The system uses this name to validate the certificate sent by the IKE server. If not set, the system uses the remote identifier to validate the certificate. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ TLS minimum version TLSMinimumVersion The minimum TLS version to use with EAP-TLS authentication. | string | optional | 1.0 | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ TLS maximum version TLSMaximumVersion The maximum TLS version to use with EAP-TLS authentication. | string | optional | 1.2 | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Network routing details NetworkRouting Specifies details about how the VPN routes different types of network traffic. 6 subkeys | dictionary | optional | — | ✗No | |
└─ Enforce routes EnforceRoutes If `true`, all the VPN's non-default routes take precedence over any locally defined routes.
If `IncludeAllNetworks` is `true`, the system ignores the value of `EnforceRoutes`. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Include all networks IncludeAllNetworks If `true`, routes all traffic through the VPN, with some exclusions. Several of the exclusions can be controlled with the `ExcludeLocalNetworks`, `ExcludeCellularServices`, `ExcludeAPNs` and `ExcludeDeviceCommunication` properties. The following traffic is always excluded from the tunnel:
- Traffic necessary for connecting and maintaining the device's network connection, such as DHCP.
- Traffic necessary for connecting to captive networks.
- Certain cellular services traffic that's not routable over the internet and is instead directly routed to the cellular network. See the ExcludeCellularServices property for more details. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Exclude local networks ExcludeLocalNetworks If `true` and `IncludeAllNetworks` is `true`, routes all local network traffic outside the VPN. | boolean | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Exclude cellular services ExcludeCellularServices If `true` and `IncludeAllNetworks` is `true`, then the system excludes internet-routable network traffic for cellular services (VoLTE, Wi-Fi Calling, IMS, MMS, Visual Voicemail, etc.) from the tunnel. Note that some cellular carriers route cellular services traffic directly to the carrier network, bypassing the internet. Such cellular services traffic is always excluded from the tunnel. | boolean | optional | true | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Exclude APNs ExcludeAPNs If `true` and `IncludeAllNetworks` is `true`, then the system excludes the network traffic for the Apple Push Notification service (APNs) from the tunnel. | boolean | optional | true | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Exclude device communication ExcludeDeviceCommunication If set to `true` and `IncludeAllNetworks` is set to `true`, the device excludes network traffic used for communicating with devices connected via USB or Wi-Fi from the tunnel. | boolean | optional | true | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Disconnect on idle settings. Idle Specifies details about how the system handles idle VPN connections. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Enable disconnect on idle Disconnect If `true`, disconnects after an on-demand connection idles. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Disconnect on idle time Timer The length of time to wait, in seconds, before disconnecting an on-demand connection. | integer | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Dead peer detection rate DeadPeerDetectionRate One of the following:
- `None`: No keepalive.
- `Low`: Send keepalive every 30 minutes.
- `Medium`: Send keepalive every 10 minutes.
- `High`: Send keepalive every 1 minute. | string | optional | Medium | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
On demand details OnDemand Specifies details about how the system controls on-demand VPN. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Enable VPN on demand Enabled If `true`, enables VPN On Demand. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Prevent users from toggling VPN on demand DisableUserOverride If `true`, the device disables the Connect On Demand toggle in Settings for this configuration. | boolean | optional | false | ✗No | |
└─ On demand rules Rules An array of dictionaries defining On Demand Rules. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Rules element RulesElement 7 subkeys | dictionary | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | |
└─ └─ └─ On demand action Action The action to take if this dictionary matches the current network. Possible values are:
- `Allow`: Deprecated. Allow VPN On Demand to connect if triggered.
- `Connect`: Unconditionally initiate a VPN connection on the next network attempt.
- `Disconnect`: Tear down the VPN connection and don't reconnect on demand as long as this dictionary matches.
- `EvaluateConnection`: Evaluate the ActionParameters array for each connection attempt.
- `Ignore`: Leave any existing VPN connection up, but don't reconnect on demand as long as this dictionary matches. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Action parameters ActionParameters An array of dictionaries that provides rules similar to the `OnDemandRules` dictionary, but evaluated on each connection instead of when the network changes. This value is only for use with dictionaries in which the `Action` value is `EvaluateConnection`. The system evaluates these dictionaries in order and the first dictionary that matches determines the behavior. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ DNS domain match DNSDomainMatch An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list.
The system supports a wildcard (`\*`) prefix. For example, `\*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ DNS server address match DNSServerAddressMatch An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array.
The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8` subnet. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ Interface type match InterfaceTypeMatch An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ SSID match SSIDMatch An array of SSIDs to match against the current network. If the network isn't a Wi-Fi network or if the SSID doesn't appear in this array, the match fails.
Omit this key and the corresponding array to match against any SSID. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ URL string probe URLStringProbe A URL to probe. This rule matches when this URL is successfully fetched (returns a `200` HTTP status code) without redirection. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Use IPv4 / IPv6 internal subnet attributes UseConfigurationAttributeInternalIPSubnet If `true`, negotiations should use IKEv2 Configuration Attribute `INTERNAL_IP4_SUBNET` and `INTERNAL_IP6_SUBNET`. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Disable mobility and multihoming DisableMOBIKE If `true`, the system disables MOBIKE. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Disable redirect DisableRedirect If `true`, the system disables IKEv2 redirect. If not set, the system redirects an IKEv2 connection when it receives a redirect request from the server. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Enable perfect forward secrecy EnablePFS If `true`, enables Perfect Forward Secrecy (PFS) for IKEv2 Connections. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Enable certificate revocation check EnableCertificateRevocationCheck If `true`, the system performs a certificate revocation check for IKEv2 connections. This is a best-effort revocation check and server response timeouts won't cause it to fail. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Enable fallback EnableFallback If `true`, the system enables a tunnel over cellular data to carry traffic that's eligible for Wi-Fi Assist and also requires VPN.
Enabling fallback requires that the server support multiple tunnels for a single user. | boolean | optional | false | ✗No | |
Maximum transmission unit MTU The Maximum Transmission Unit (MTU) specifies the maximum size in bytes of each packet that the system sends over the IKEv2 VPN interface. Range: 1280 - 1400 | integer | optional | 1280 | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Enforce strict algorithm selection EnforceStrictAlgorithmSelection If set to `true`, the device doesn't allow DES, 3DES, and Diffie-Hellman groups less than 14. Also the device requires the encryption algorithm specified in `IKESecurityAssociationParameters` to be at least as cryptographically strong as the algorithm specified in `ChildSecurityAssociationParameters`. The device rejects this configuration if these requirements aren't met. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Post quantum key exchange PostQuantumKeyExchange Post Quantum Key Exchange settings. 4 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Post-quantum pre-shared key PPK The Post-quantum Pre-shared key (PPK) the device uses for this VPN. This key is is used with VPN servers that support RFC 8784. If this key is present `PPKIdentifier` must also be present. | data | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Post-quantum pre-shared key identifier PPKIdentifier The identifier for the Post-quantum Pre-shared key (PPK) the device uses for this VPN. This key is is used with VPN servers that support RFC 8784. If this key is present `PPK` must also be present. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Post-quantum pre-shared key mandatory PPKMandatory If set to `true`, the VPN doesn't establish a connection if the server doesn't support RFC 8784 or doesn't accept the PPK identifier specified in `PPKIdentifier`. The device ignores this key if `PPK` and `PPKIdentifier` aren't present. | boolean | optional | true | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Allow post-quantum key exchange fallback AllowFallback If set to `false`, the VPN doesn't establish a connection if the server doesn't support or doesn't allow post-quantum key exchanges. Thd device ignores this key if `PostQuantumKeyExchangeMethods` isn't present in `IKESecurityAssociationParameters` or `ChildSecurityAssociationParameters`. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
IKE security association parameters IKESecurityAssociationParameters These parameters apply to Child Security Association unless `ChildSecurityAssociationParameters` is specified. 5 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Encryption algorithm EncryptionAlgorithm The encryption algorithm.
On tvOS, the default value is `AES-256-GCM`. | string | optional | AES-256 | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Integrity algorithm IntegrityAlgorithm The integrity algorithm. | string | optional | SHA2-256 | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Diffie hellman group DiffieHellmanGroup The Diffie-Hellman group.
For `AlwaysOn` VPN, the minimum allowed value is `14`. | integer | optional | 14 | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Post-quantum key exchange methods PostQuantumKeyExchangeMethods An array of integers representing postquantum key exchange methods the device uses during SA establishment and rekey. You can specify up to seven items, which correspond to ADDKE1 - ADDKE7 from RFC 9370. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Post-quantum key exchange method PostQuantumKeyExchangeMethod | integer | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | |
└─ Life time in minutes LifeTimeInMinutes The SA lifetime (rekey interval) in minutes. Range: 10 - 1440 | integer | optional | 1440 | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Child security association parameters ChildSecurityAssociationParameters The `ChildSecurityAssociationParameters` dictionaries. 5 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Encryption algorithm EncryptionAlgorithm The encryption algorithm.
On tvOS, the default value is `AES-256-GCM`. | string | optional | AES-256 | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Integrity algorithm IntegrityAlgorithm The integrity algorithm. | string | optional | SHA2-256 | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Diffie hellman group DiffieHellmanGroup The Diffie-Hellman group.
For `AlwaysOn` VPN, the minimum allowed value is `14`. | integer | optional | 14 | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Post-quantum key exchange methods PostQuantumKeyExchangeMethods An array of integers representing postquantum key exchange methods the device uses during SA establishment and rekey. You can specify up to seven items, which correspond to ADDKE1 - ADDKE7 from RFC 9370. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Post-quantum key exchange method PostQuantumKeyExchangeMethod | integer | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | |
└─ Life time in minutes LifeTimeInMinutes The SA lifetime (rekey interval) in minutes. Range: 10 - 1440 | integer | optional | 1440 | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
DNS DNS A dictionary to use for all VPN types. 6 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ DNS server addresses ServerAddresses The array of DNS server IP address strings. These IP addresses can be a mixture of IPv4 and IPv6 addresses. 1 subkey | array | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Server address element ServerAddressesElement | string | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | |
└─ DNS search domains SearchDomains The list of domain strings used to fully qualify single-label host names. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Search domains element SearchDomainsElement | string | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | |
└─ Domain name DomainName The primary domain of the tunnel. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Supplemental match domains SupplementalMatchDomains The list of domain strings used to determine which DNS queries use the DNS resolver settings in `ServerAddresses`. The system uses this key to create a split DNS configuration where it resolves only hosts in certain domains using the tunnel's DNS resolver. The system uses the default resolver for hosts that aren't in one of the domains in this list.
If `SupplementalMatchDomains` contains the empty string it becomes the default domain.
Split-tunnel configurations can direct all DNS queries to the VPN DNS servers before the primary DNS servers. If the VPN tunnel becomes the network's default route, the servers listed in `ServerAddresses` become the default resolver and the system ignores the `SupplementalMatchDomains` list. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Supplemental match domains element SupplementalMatchDomainsElement | string | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | |
└─ Supplemental match domains no search SupplementalMatchDomainsNoSearch If `true`, don't append the domains in the `SupplementalMatchDomains` list to the resolver's list of search domains. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Identity asset reference IdentityAssetReference The identifier of a credential asset declaration that contains the identity that the system uses to authenticate the user to the DNS resolver. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Proxies Proxies The dictionary to use to configure `Proxies` for use with `VPN`. 5 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Proxy auto config enable AutoConfigEnable If `true`, enables automatic proxy configuration. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Proxy auto discovery enable AutoDiscoveryEnable If `true`, enables proxy auto discovery. | boolean | optional | true | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Proxy server URL AutoConfigURLString The URL to the location of the proxy auto-configuration file. Used only when `ProxyAutoConfigEnable` is `true`. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Supplemental match domains SupplementalMatchDomains An array of domains that defines which hosts use proxy settings for hosts. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Supplemental match domains element SupplementalMatchDomainsElement | string | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | |
└─ Protocol Protocol The dictionary to use to configure HTTP servers for `Proxies` for use with `VPN`. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ HTTP protocol HTTP The dictionary to use to configure the HTTP (non-TLS) server. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enable HTTP Enable If `true`, enables proxy for HTTP traffic. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTP host name HostName The host name of the HTTP proxy. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTP port Port The port number of the HTTP proxy. This field is required if `HostName` is specified. Range: 0 - 65535 | integer | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ HTTPS protocol HTTPS The dictionary to use to configure the HTTPS (TLS) server. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enable HTTPS Enable If `true`, enables proxy for HTTPS traffic. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTPS host name HostName The host name of the HTTPS proxy. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTPS port Port The port number of the HTTPS proxy. This field is required if `HostName` is specified. Range: 0 - 65535 | integer | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Credentials asset reference CredentialsAssetReference The identifier of an asset declaration that contains the credentials (user name and password) to authenticate with the proxy server. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Explore the full catalogue of Apple Mobile Device Management (MDM) and Declarative Device Management (DDM) policies for macOS and iOS. Search, filter, and reference policy keys for use with Microsoft Intune, Jamf, or any standards-compliant MDM solution.
com.apple.wifi.managed – Wi-Fi network configurationcom.apple.vpn.managed – VPN configurationcom.apple.applicationaccess – App and feature restrictionscom.apple.security.pkcs1 – Certificate (PKCS#1) payloadcom.apple.security.pkcs12 – Identity certificate (PKCS#12) payloadcom.apple.security.scep – SCEP certificate enrolmentcom.apple.mail.managed – Mail account configurationcom.apple.eas.account – Exchange ActiveSync accountcom.apple.MCX – Managed Client (macOS) preferencescom.apple.MCX.FileVault2 – FileVault 2 disk encryptioncom.apple.dock – macOS Dock configurationcom.apple.screensaver – Screensaver configurationcom.apple.loginwindow – macOS login window configurationcom.apple.systempolicy.managed – Gatekeeper / system policycom.apple.systempreferences – System Preferences pane restrictionscom.apple.SoftwareUpdate – Software update behaviourcom.apple.TCC.configuration-profile-policy – Privacy Preferences Policy Control (PPPC)com.apple.notificationsettings – Per-app notification settingscom.apple.webcontent-filter – Web content filtercom.apple.dnsSettings.managed – DNS settings (DoH / DoT)com.apple.relay.managed – Network relay configurationcom.apple.extensiblesso – Extensible Single Sign-Oncom.apple.configuration.passcode.settings – DDM: passcode policycom.apple.configuration.softwareupdate.enforcement.specific – DDM: enforced software updatecom.apple.configuration.services.configuration-files – DDM: service configuration filescom.apple.configuration.management.status-subscriptions – DDM: status subscriptionscom.apple.activation.simple – DDM: simple activation predicatecom.apple.management.organization-info – DDM: organization information