The declaration to configure a VPN using the VPN plugin sub-type.
| Setting | Type | Required | Default | Manual Install | Supported OS |
|---|---|---|---|---|---|
Visible name VisibleName The name of the VPN connection that the system displays on the device. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Host name HostName The IP address or hostname of the VPN server. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
VPN subtype SubType An identifier for a vendor-specified configuration dictionary.
If the configuration targets a VPN solution that uses a VPN plugin, then this field contains the bundle identifier of the plugin. Here are some examples:
- Cisco AnyConnect: `com.cisco.anyconnect.applevpn.plugin`
- Juniper SSL: `net.juniper.sslvpn`
- F5 SSL: `com.f5.F5-Edge-Client.vpnplugin`
- SonicWALL Mobile Connect: `com.sonicwall.SonicWALL-SSLVPN.vpnplugin`
- ``Aruba VIA: `com.arubanetworks.aruba-via.vpnplugin`
If the configuration targets a VPN solution that uses a network extension provider, then this field contains the bundle identifier of the app that contains the provider. Contact the VPN solution vendor for the value of the identifier. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Vendor configuration dictionary VendorConfig The vendor-specific configuration dictionary, which the system reads only when `SubType` has a value. 4 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Realm Realm The Kerberos realm name, which needs to be properly capitalized. Valid only for Juniper SSL and Pulse Secure. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Role Role The role to select when connecting to the server. Valid only for Juniper SSL and Pulse Secure. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Group Group The group to connect to on the head end. Valid for Cisco AnyConnect and Cisco Legacy AnyConnect. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Login group or domain LoginGroupOrDomain The login group or domain. Valid only for SonicWALL Mobile Connect. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Authentication details Authentication Settings that control authentication. 3 subkeys | dictionary | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Authentication method Method The authentication method to use. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Credentials asset reference CredentialsAssetReference The identifier of an asset declaration that contains the credentials (user name and password) to authenticate with the VPN server. Required when `Authentication.Method` is set to `Password`. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Identity asset reference IdentityAssetReference The identifier of a credential asset declaration that contains the identity that this account requires to authenticate with the VPN server. Required when `Authentication.Method` is set to `Certificate`. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Provider details Provider Specifies details about the provider. 2 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Type Type The type of VPN service. If the value is `app-proxy`, the service tunnels traffic at the app level. If the value is `packet-tunnel`, the service tunnels traffic at the IP layer. | string | optional | packet-tunnel | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Composed identifier ComposedIdentifier If the `SubType` field contains the bundle identifier of an app that contains multiple VPN providers of the same type (app-proxy or packet-tunnel), then the system uses this field to choose which provider to use for this configuration. If the VPN provider is implemented as a System Extension, then this field is required.
In iOS, tvOS, and visionOS, the identifier is a bundle ID, for example, "com.example.app".
In macOS, the identifier is a composed identifier. The format of the composed identifier is either "Bundle-ID" or "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string from the code signature of the provider. For example, "com.example.app" for the bundle ID format, or "com.example.app {anchor apple generic}" for the designated requirement format. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Network routing details NetworkRouting Specifies details about how the VPN routes different types of network traffic. 6 subkeys | dictionary | optional | — | ✗No | |
└─ Enforce routes EnforceRoutes If `true`, all the VPN's non-default routes take precedence over any locally defined routes.
If `IncludeAllNetworks` is `true`, the system ignores the value of `EnforceRoutes`. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Include all networks IncludeAllNetworks If `true`, routes all traffic through the VPN, with some exclusions. Several of the exclusions can be controlled with the `ExcludeLocalNetworks`, `ExcludeCellularServices`, `ExcludeAPNs` and `ExcludeDeviceCommunication` properties. The following traffic is always excluded from the tunnel:
- Traffic necessary for connecting and maintaining the device's network connection, such as DHCP.
- Traffic necessary for connecting to captive networks.
- Certain cellular services traffic that's not routable over the internet and is instead directly routed to the cellular network. See the ExcludeCellularServices property for more details. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Exclude local networks ExcludeLocalNetworks If `true` and `IncludeAllNetworks` is `true`, routes all local network traffic outside the VPN. | boolean | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Exclude cellular services ExcludeCellularServices If `true` and `IncludeAllNetworks` is `true`, then the system excludes internet-routable network traffic for cellular services (VoLTE, Wi-Fi Calling, IMS, MMS, Visual Voicemail, etc.) from the tunnel. Note that some cellular carriers route cellular services traffic directly to the carrier network, bypassing the internet. Such cellular services traffic is always excluded from the tunnel. | boolean | optional | true | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Exclude APNs ExcludeAPNs If `true` and `IncludeAllNetworks` is `true`, then the system excludes the network traffic for the Apple Push Notification service (APNs) from the tunnel. | boolean | optional | true | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Exclude device communication ExcludeDeviceCommunication If set to `true` and `IncludeAllNetworks` is set to `true`, the device excludes network traffic used for communicating with devices connected via USB or Wi-Fi from the tunnel. | boolean | optional | true | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Disconnect on idle settings. Idle Specifies details about how the system handles idle VPN connections. 2 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Enable disconnect on idle Disconnect If `true`, disconnects after an on-demand connection idles. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Disconnect on idle time Timer The length of time to wait, in seconds, before disconnecting an on-demand connection. | integer | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
On demand details OnDemand Specifies details about how the system controls on-demand VPN. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Enable VPN on demand Enabled If `true`, enables VPN On Demand. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Prevent users from toggling VPN on demand DisableUserOverride If `true`, the device disables the Connect On Demand toggle in Settings for this configuration. | boolean | optional | false | ✗No | |
└─ On demand rules Rules An array of dictionaries defining On Demand Rules. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Rules element RulesElement 7 subkeys | dictionary | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | |
└─ └─ └─ On demand action Action The action to take if this dictionary matches the current network. Possible values are:
- `Allow`: Deprecated. Allow VPN On Demand to connect if triggered.
- `Connect`: Unconditionally initiate a VPN connection on the next network attempt.
- `Disconnect`: Tear down the VPN connection and don't reconnect on demand as long as this dictionary matches.
- `EvaluateConnection`: Evaluate the ActionParameters array for each connection attempt.
- `Ignore`: Leave any existing VPN connection up, but don't reconnect on demand as long as this dictionary matches. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Action parameters ActionParameters An array of dictionaries that provides rules similar to the `OnDemandRules` dictionary, but evaluated on each connection instead of when the network changes. This value is only for use with dictionaries in which the `Action` value is `EvaluateConnection`. The system evaluates these dictionaries in order and the first dictionary that matches determines the behavior. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ DNS domain match DNSDomainMatch An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list.
The system supports a wildcard (`*`) prefix. For example, `*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ DNS server address match DNSServerAddressMatch An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array.
The system supports matching with a single wildcard. For example, `17.*` matches any DNS server in the `17.0.0.0/8` subnet. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ Interface type match InterfaceTypeMatch An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ SSID match SSIDMatch An array of SSIDs to match against the current network. If the network isn't a Wi-Fi network or if the SSID doesn't appear in this array, the match fails.
Omit this key and the corresponding array to match against any SSID. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure. | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | ||
└─ └─ └─ URL string probe URLStringProbe A URL to probe. This rule matches when this URL is successfully fetched (returns a `200` HTTP status code) without redirection. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
DNS DNS A dictionary to use for all VPN types. 9 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ DNS protocol Protocol The transport protocol to communicate with the DNS server. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Server URL ServerURL The URI template of a DNS-over-HTTPS server, as defined in RFC 8484, which needs to use the `https://` scheme. The system uses the hostname or address in the URL to validate the server certificate. If `ServerAddresses` isn't specified, the system uses the hostname or address in the URL to determine the server addresses. This key is required if the `DNSProtocol` is `HTTPS`. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Server name ServerName The hostname of a DNS-over-TLS server to validate the server certificate, as defined in RFC 7858. If `ServerAddresses` isn't specified, the system uses the hostname to determine the server addresses. This key is required if the `DNSProtocol` is `TLS`. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ DNS server addresses ServerAddresses The array of DNS server IP address strings. These IP addresses can be a mixture of IPv4 and IPv6 addresses. 1 subkey | array | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Server address element ServerAddressesElement | string | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | |
└─ DNS search domains SearchDomains The list of domain strings used to fully qualify single-label host names. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Search domains element SearchDomainsElement | string | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | |
└─ Domain name DomainName The primary domain of the tunnel. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Supplemental match domains SupplementalMatchDomains The list of domain strings used to determine which DNS queries use the DNS resolver settings in `ServerAddresses`. The system uses this key to create a split DNS configuration where it resolves only hosts in certain domains using the tunnel's DNS resolver. The system uses the default resolver for hosts that aren't in one of the domains in this list.
If `SupplementalMatchDomains` contains the empty string it becomes the default domain.
Split-tunnel configurations can direct all DNS queries to the VPN DNS servers before the primary DNS servers. If the VPN tunnel becomes the network's default route, the servers listed in `ServerAddresses` become the default resolver and the system ignores the `SupplementalMatchDomains` list. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Supplemental match domains element SupplementalMatchDomainsElement | string | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | |
└─ Supplemental match domains no search SupplementalMatchDomainsNoSearch If `true`, don't append the domains in the `SupplementalMatchDomains` list to the resolver's list of search domains. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Identity asset reference IdentityAssetReference The identifier of a credential asset declaration that contains the identity that the system uses to authenticate the user to the DNS resolver. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Proxies Proxies The dictionary to use to configure `Proxies` for use with `VPN`. 5 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Proxy auto config enable AutoConfigEnable If `true`, enables automatic proxy configuration. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Proxy auto discovery enable AutoDiscoveryEnable If `true`, enables proxy auto discovery. | boolean | optional | true | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Proxy server URL AutoConfigURLString The URL to the location of the proxy auto-configuration file. Used only when `ProxyAutoConfigEnable` is `true`. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Supplemental match domains SupplementalMatchDomains An array of domains that defines which hosts use proxy settings for hosts. 1 subkey | array | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Supplemental match domains element SupplementalMatchDomainsElement | string | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) | |
└─ Protocol Protocol The dictionary to use to configure HTTP servers for `Proxies` for use with `VPN`. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ HTTP protocol HTTP The dictionary to use to configure the HTTP (non-TLS) server. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enable HTTP Enable If `true`, enables proxy for HTTP traffic. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTP host name HostName The host name of the HTTP proxy. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTP port Port The port number of the HTTP proxy. This field is required if `HostName` is specified. Range: 0 - 65535 | integer | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ HTTPS protocol HTTPS The dictionary to use to configure the HTTPS (TLS) server. 3 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Enable HTTPS Enable If `true`, enables proxy for HTTPS traffic. | boolean | optional | false | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTPS host name HostName The host name of the HTTPS proxy. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ HTTPS port Port The port number of the HTTPS proxy. This field is required if `HostName` is specified. Range: 0 - 65535 | integer | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ Credentials asset reference CredentialsAssetReference The identifier of an asset declaration that contains the credentials (user name and password) to authenticate with the proxy server. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Explore the full catalogue of Apple Mobile Device Management (MDM) and Declarative Device Management (DDM) policies for macOS and iOS. Search, filter, and reference policy keys for use with Microsoft Intune, Jamf, or any standards-compliant MDM solution.
com.apple.wifi.managed – Wi-Fi network configurationcom.apple.vpn.managed – VPN configurationcom.apple.applicationaccess – App and feature restrictionscom.apple.security.pkcs1 – Certificate (PKCS#1) payloadcom.apple.security.pkcs12 – Identity certificate (PKCS#12) payloadcom.apple.security.scep – SCEP certificate enrolmentcom.apple.mail.managed – Mail account configurationcom.apple.eas.account – Exchange ActiveSync accountcom.apple.MCX – Managed Client (macOS) preferencescom.apple.MCX.FileVault2 – FileVault 2 disk encryptioncom.apple.dock – macOS Dock configurationcom.apple.screensaver – Screensaver configurationcom.apple.loginwindow – macOS login window configurationcom.apple.systempolicy.managed – Gatekeeper / system policycom.apple.systempreferences – System Preferences pane restrictionscom.apple.SoftwareUpdate – Software update behaviourcom.apple.TCC.configuration-profile-policy – Privacy Preferences Policy Control (PPPC)com.apple.notificationsettings – Per-app notification settingscom.apple.webcontent-filter – Web content filtercom.apple.dnsSettings.managed – DNS settings (DoH / DoT)com.apple.relay.managed – Network relay configurationcom.apple.extensiblesso – Extensible Single Sign-Oncom.apple.configuration.passcode.settings – DDM: passcode policycom.apple.configuration.softwareupdate.enforcement.specific – DDM: enforced software updatecom.apple.configuration.services.configuration-files – DDM: service configuration filescom.apple.configuration.management.status-subscriptions – DDM: status subscriptionscom.apple.activation.simple – DDM: simple activation predicatecom.apple.management.organization-info – DDM: organization information