AppLayerVPN MDM payload settings for Apple devices

You can add an AppLayerVPN MDM payload to configure add-on VPN software for users of an iPhone, iPad, Shared iPad, Mac, Apple Watch, and Apple Vision Pro.

The AppLayerVPN payload supports the following. For more information, see Payload information.

Supported payload identifier: com.apple.vpn.managed.applayer
Supported operating systems and channels: iOS, iPadOS, Shared iPad device, macOS device, macOS user, watchOS 10, visionOS 1.1.
Supported enrollment methods: User Enrollment, Device Enrollment, Automated Device Enrollment.
Duplicates allowed: False—only one AppLayerVPN payload can be delivered to a user or device.

You can use the settings in the table below with the AppLayerVPN payload.

Setting	Description	Required
Associated domains	A list of domains that trigger this VPN. The domains must also be part of the apple-app-site-association file, as described in Supporting Associated Domains on the Apple Developer website.	No
Excluded domains	A list of domains that don’t trigger this VPN.	No
On demand matching	Automatically connects the VPN when associated apps for this per-app VPN service initiate network communication.	No
Safari domains	A list of domains that—when visited from Safari—trigger this VPN.	No
SMB domains	A list of SBM domains that can be accessed through this VPN.	No
VPNUUID	A globally unique identifier for this VPN configuration.	Yes
VPN	A dictionary with additional VPN settings.	No

Note: Each MDM vendor implements these settings differently. To learn how various AppLayerVPN settings are applied to your devices and users, consult your MDM vendor’s documentation.

Helpful?

Apple Platform Deployment

AppLayerVPN MDM payload settings for Apple devices