AppLayerVPN device management payload settings for Apple devices

You can add an AppLayerVPN device management payload to configure add-on VPN software for users of an iPhone, iPad, Shared iPad, Mac, Apple Watch, or Apple Vision Pro.

The AppLayerVPN payload supports the following. For more information, see Payload information.

Supported payload identifier: com.apple.vpn.managed.applayer
Supported operating systems and channels: iOS, iPadOS, Shared iPad device, macOS device, macOS user, watchOS 10, visionOS 1.1.
Supported enrollment methods: User Enrollment, Device Enrollment, Automated Device Enrollment.
Duplicates allowed: False—only one AppLayerVPN payload can be delivered to a user or device.

You can use the settings in the table below with the AppLayerVPN payload.

Setting	Description	Required
Associated domains	A list of domains that trigger this VPN. The domains also need to be part of the apple-app-site-association file, as described in Supporting Associated Domains in Apple Developer documentation.	No
Excluded domains	A list of domains that don’t trigger this VPN.	No
On demand matching	Automatically connects the VPN when associated apps for this per-app VPN service initiate network communication.	No
Safari domains	A list of domains that—when visited from Safari—trigger this VPN.	No
SMB domains	A list of SBM domains that can be accessed through this VPN.	No
VPNUUID	A globally unique identifier for this VPN configuration.	Yes
VPN	A dictionary with additional VPN settings.	No

Note: Each device management service developer implements these settings differently. To learn how various AppLayerVPN settings are applied to your devices and users, consult your developer’s device management service documentation.

Kasulik?

Apple Platform Deployment

AppLayerVPN device management payload settings for Apple devices