The declaration to configure a VPN using the IPSec sub-type.
| Setting | Type | Required | Default | Manual Install | Supported OS |
|---|---|---|---|---|---|
Visible name VisibleName The name of the VPN connection that the system displays on the device. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
Host name HostName The IP address or hostname of the VPN server. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
Authentication details Authentication Settings that control authentication. 7 subkeys | dictionary | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ Authentication method Method The authentication method to use. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ Credentials asset reference CredentialsAssetReference The identifier of an asset declaration that contains the credentials
(password) to authenticate with the VPN servers.
Only use this with Cisco IPSec VPNs and if the `Authentication.Method` key is to `SharedSecret`. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ Identity asset reference IdentityAssetReference The identifier of a credential asset declaration that contains the identity
that this account requires to authenticate with the VPN servers.
Only use this with Cisco IPSec VPNs and if the `Authentication.Method` key is to `Certificate`. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ Local identifier LocalIdentifier The name of the group. For hybrid authentication, the string needs to end with "hybrid".
Present only for Cisco IPSec if `Authentication.Method` is `SharedSecret`. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ Local identifier type LocalIdentifierType Present only if `Authentication.Method` is `SharedSecret`. The value is `KeyID`. The system uses this value for Cisco IPSec VPNs. | string | optional | KeyID | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ Prompt for PIN PromptForVPNPIN If `true`, prompts for a PIN when connecting to Cisco IPSec VPNs. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ XAuth details XAuth Settings that control XAuth. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ XAuth enabled Enabled If `true`, enables Xauth for Cisco IPSec VPNs. | boolean | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ Credentials asset reference CredentialsAssetReference The identifier of an asset declaration that contains the credentials (user name and password) required for XAuth. Required when `Enabled` key is set to `true`. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ XAuth password encryption PasswordEncryption A string that either has the value `Prompt` or isn't present. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
Disconnect on idle settings. Idle Specifies details about how the system handles idle VPN connections. 2 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ Enable disconnect on idle Disconnect If `true`, disconnects after an on-demand connection idles. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ Disconnect on idle time Timer The length of time to wait, in seconds, before disconnecting an on-demand connection. | integer | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
On demand details OnDemand Specifies details about how the system controls on-demand VPN. 2 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ Enable VPN on demand Enabled If `true`, enables VPN On Demand. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ On demand rules Rules An array of dictionaries defining On Demand Rules. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ Rules element RulesElement 7 subkeys | dictionary | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) | |
└─ └─ └─ On demand action Action The action to take if this dictionary matches the current network. Possible values are:
- `Allow`: Deprecated. Allow VPN On Demand to connect if triggered.
- `Connect`: Unconditionally initiate a VPN connection on the next network attempt.
- `Disconnect`: Tear down the VPN connection and don't reconnect on demand as long as this dictionary matches.
- `EvaluateConnection`: Evaluate the ActionParameters array for each connection attempt.
- `Ignore`: Leave any existing VPN connection up, but don't reconnect on demand as long as this dictionary matches. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Action parameters ActionParameters An array of dictionaries that provides rules similar to the `OnDemandRules` dictionary, but evaluated on each connection instead of when the network changes. This value is only for use with dictionaries in which the `Action` value is `EvaluateConnection`. The system evaluates these dictionaries in order and the first dictionary that matches determines the behavior. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ DNS domain match DNSDomainMatch An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list.
The system supports a wildcard (`\*`) prefix. For example, `\*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ DNS server address match DNSServerAddressMatch An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array.
The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8` subnet. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ Interface type match InterfaceTypeMatch An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ └─ SSID match SSIDMatch An array of SSIDs to match against the current network. If the network isn't a Wi-Fi network or if the SSID doesn't appear in this array, the match fails.
Omit this key and the corresponding array to match against any SSID. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ URL string probe URLStringProbe A URL to probe. This rule matches when this URL is successfully fetched (returns a `200` HTTP status code) without redirection. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
DNS DNS A dictionary to use for all VPN types. 6 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ DNS server addresses ServerAddresses The array of DNS server IP address strings. These IP addresses can be a mixture of IPv4 and IPv6 addresses. 1 subkey | array | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ Server address element ServerAddressesElement | string | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) | |
└─ DNS search domains SearchDomains The list of domain strings used to fully qualify single-label host names. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ Search domains element SearchDomainsElement | string | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) | |
└─ Domain name DomainName The primary domain of the tunnel. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ Supplemental match domains SupplementalMatchDomains The list of domain strings used to determine which DNS queries use the DNS resolver settings in `ServerAddresses`. The system uses this key to create a split DNS configuration where it resolves only hosts in certain domains using the tunnel's DNS resolver. The system uses the default resolver for hosts that aren't in one of the domains in this list.
If `SupplementalMatchDomains` contains the empty string it becomes the default domain.
Split-tunnel configurations can direct all DNS queries to the VPN DNS servers before the primary DNS servers. If the VPN tunnel becomes the network's default route, the servers listed in `ServerAddresses` become the default resolver and the system ignores the `SupplementalMatchDomains` list. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ Supplemental match domains element SupplementalMatchDomainsElement | string | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) | |
└─ Supplemental match domains no search SupplementalMatchDomainsNoSearch If `true`, don't append the domains in the `SupplementalMatchDomains` list to the resolver's list of search domains. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ Identity asset reference IdentityAssetReference The identifier of a credential asset declaration that contains the identity that the system uses to authenticate the user to the DNS resolver. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
Proxies Proxies The dictionary to use to configure `Proxies` for use with `VPN`. 5 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ Proxy auto config enable AutoConfigEnable If `true`, enables automatic proxy configuration. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ Proxy auto discovery enable AutoDiscoveryEnable If `true`, enables proxy auto discovery. | boolean | optional | true | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ Proxy server URL AutoConfigURLString The URL to the location of the proxy auto-configuration file. Used only when `ProxyAutoConfigEnable` is `true`. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ Supplemental match domains SupplementalMatchDomains An array of domains that defines which hosts use proxy settings for hosts. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ Supplemental match domains element SupplementalMatchDomainsElement | string | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) | |
└─ Protocol Protocol The dictionary to use to configure HTTP servers for `Proxies` for use with `VPN`. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ HTTP protocol HTTP The dictionary to use to configure the HTTP (non-TLS) server. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enable HTTP Enable If `true`, enables proxy for HTTP traffic. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTP host name HostName The host name of the HTTP proxy. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTP port Port The port number of the HTTP proxy. This field is required if `HostName` is specified. Range: 0 - 65535 | integer | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ HTTPS protocol HTTPS The dictionary to use to configure the HTTPS (TLS) server. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enable HTTPS Enable If `true`, enables proxy for HTTPS traffic. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTPS host name HostName The host name of the HTTPS proxy. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTPS port Port The port number of the HTTPS proxy. This field is required if `HostName` is specified. Range: 0 - 65535 | integer | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
└─ └─ Credentials asset reference CredentialsAssetReference The identifier of an asset declaration that contains the credentials (user name and password) to authenticate with the proxy server. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)visionOS (27.0+) |
Explore the full catalogue of Apple Mobile Device Management (MDM) and Declarative Device Management (DDM) policies for macOS and iOS. Search, filter, and reference policy keys for use with Microsoft Intune, Jamf, or any standards-compliant MDM solution.
com.apple.wifi.managed – Wi-Fi network configurationcom.apple.vpn.managed – VPN configurationcom.apple.applicationaccess – App and feature restrictionscom.apple.security.pkcs1 – Certificate (PKCS#1) payloadcom.apple.security.pkcs12 – Identity certificate (PKCS#12) payloadcom.apple.security.scep – SCEP certificate enrolmentcom.apple.mail.managed – Mail account configurationcom.apple.eas.account – Exchange ActiveSync accountcom.apple.MCX – Managed Client (macOS) preferencescom.apple.MCX.FileVault2 – FileVault 2 disk encryptioncom.apple.dock – macOS Dock configurationcom.apple.screensaver – Screensaver configurationcom.apple.loginwindow – macOS login window configurationcom.apple.systempolicy.managed – Gatekeeper / system policycom.apple.systempreferences – System Preferences pane restrictionscom.apple.SoftwareUpdate – Software update behaviourcom.apple.TCC.configuration-profile-policy – Privacy Preferences Policy Control (PPPC)com.apple.notificationsettings – Per-app notification settingscom.apple.webcontent-filter – Web content filtercom.apple.dnsSettings.managed – DNS settings (DoH / DoT)com.apple.relay.managed – Network relay configurationcom.apple.extensiblesso – Extensible Single Sign-Oncom.apple.configuration.passcode.settings – DDM: passcode policycom.apple.configuration.softwareupdate.enforcement.specific – DDM: enforced software updatecom.apple.configuration.services.configuration-files – DDM: service configuration filescom.apple.configuration.management.status-subscriptions – DDM: status subscriptionscom.apple.activation.simple – DDM: simple activation predicatecom.apple.management.organization-info – DDM: organization information