apple_device-management/mdm/profiles/com.apple.vpn.managed.applayer.yaml

title: App-Layer VPN
description: The payload that configures a per-app VPN.
payload:
  payloadtype: com.apple.vpn.managed.applayer
  supportedOS:
    iOS:
      introduced: '7.0'
      multiple: true
      supervised: false
      allowmanualinstall: true
      sharedipad:
        mode: allowed
        devicechannel: true
        userchannel: false
      userenrollment:
        mode: allowed
    macOS:
      introduced: '10.9'
      multiple: true
      devicechannel: true
      userchannel: true
      supervised: false
      requiresdep: false
      userapprovedmdm: false
      allowmanualinstall: true
      userenrollment:
        mode: allowed
    tvOS:
      introduced: n/a
    visionOS:
      introduced: '1.1'
      multiple: true
      supervised: false
      allowmanualinstall: true
      userenrollment:
        mode: allowed
    watchOS:
      introduced: '10.0'
      multiple: true
      supervised: true
      allowmanualinstall: false
  content: The fields in this payload are the same as the VPN payload, with the addition
    of the fields shown below. On watchOS, only the IKEv2 VPN type is supported.
payloadkeys:
- key: VPNUUID
  type: <string>
  presence: required
  content: A globally unique identifier for this VPN configuration.
- key: CellularSliceUUID
  title: Cellular Slice UUID
  supportedOS:
    iOS:
      introduced: '18.0'
    macOS:
      introduced: n/a
    tvOS:
      introduced: n/a
    visionOS:
      introduced: n/a
  type: <string>
  presence: optional
  content: A string representing the data network name (DNN) or app category identifying
    a Cellular Slice. The device forces the VPN tunnel to use the specified Cellular
    Slice.
- key: SafariDomains
  supportedOS:
    watchOS:
      introduced: n/a
  type: <array>
  presence: optional
  content: An array with entries that must each specify a domain that triggers the
    VPN connection in Safari. Each entry is in the format `www.apple.com`.
  subkeys:
  - key: SafariDomainsItem
    type: <string>
    presence: required
    content: A domain.
- key: MailDomains
  supportedOS:
    iOS:
      introduced: '13.0'
      deprecated: '13.4'
    macOS:
      introduced: '10.15'
    visionOS:
      introduced: n/a
    watchOS:
      introduced: n/a
  type: <array>
  presence: optional
  content: |-
    An array with entries that must each specify a domain that triggers this VPN connection in Mail. Each entry is in the format `www.apple.com`.

    This property is deprecated in iOS 13.4 and later; use the `VPNUUID` property of the `Mail` or `ExchangeActiveSync` payload instead.
  subkeys:
  - key: MailDomainsItem
    type: <string>
    presence: required
    content: A domain.
- key: CalendarDomains
  supportedOS:
    iOS:
      introduced: '13.0'
      deprecated: '13.4'
    macOS:
      introduced: '10.15'
    visionOS:
      introduced: n/a
    watchOS:
      introduced: n/a
  type: <array>
  presence: optional
  content: |-
    An array with entries that must each specify a domain that triggers this VPN connection in Calendar. Each entry is in the format `www.apple.com`.

    This property is deprecated in iOS 13.4 and later; use the `VPNUUID` property of the `CalDAV` payload instead.
  subkeys:
  - key: CalendarDomainsItem
    type: <string>
    presence: required
    content: A domain.
- key: ContactsDomains
  supportedOS:
    iOS:
      introduced: '13.0'
      deprecated: '13.4'
    macOS:
      introduced: '10.15'
    visionOS:
      introduced: n/a
    watchOS:
      introduced: n/a
  type: <array>
  presence: optional
  content: |-
    An array with entries that must each specify a domain that triggers this VPN connection in Contacts. Each entry is in the format `www.apple.com`.

    This property is deprecated in iOS 13.4 and later; use the `VPNUUID` property of the `CardDAV` payload instead.
  subkeys:
  - key: ContactsDomainsItem
    type: <string>
    presence: required
    content: A domain.
- key: AssociatedDomains
  supportedOS:
    iOS:
      introduced: '14.0'
    macOS:
      introduced: '11.0'
  type: <array>
  presence: optional
  content: An array with entries that must each specify a domain that triggers this
    VPN. The domains must also be part of the `apple-app-site-association` file, as
    described in `Supporting associated domains`.
  subkeys:
  - key: AssociatedDomainsItem
    type: <string>
    presence: required
    content: A domain.
- key: ExcludedDomains
  supportedOS:
    iOS:
      introduced: '14.0'
    macOS:
      introduced: '11.0'
  type: <array>
  presence: optional
  content: An array with entries that each specify a domain that doesn't trigger this
    VPN for connections to the domain.
  subkeys:
  - key: ExcludedDomainsItem
    type: <string>
    presence: required
    content: A domain.
- key: OnDemandMatchAppEnabled
  type: <boolean>
  presence: optional
  content: If `true`, automatically connects the VPN when associated apps for this
    per-app VPN service initiate network communication. Otherwise, the user must initiate
    the connection manually before those apps can initiate network communication.
    If this key isn't present, the value of the `OnDemandEnabled` key determines the
    status of per-app VPN On Demand.
- key: SMBDomains
  supportedOS:
    iOS:
      introduced: '13.0'
    macOS:
      introduced: n/a
    watchOS:
      introduced: n/a
  type: <array>
  presence: optional
  content: An array of SMB domains that's accessible through this VPN connection.
  subkeys:
  - key: SMBDomainsItem
    type: <string>
    presence: required
    content: An SMB domain.
notes:
- title: ''
  content: This profile defines per-app VPN behavior and applies only to VPN services
    of type `VPN`, `IPsec`, and `IKEv2`. All the properties of VPN apply to the top
    level of this profile as well.
examples:
- title: Profile example
  files:
  - file: examples/mdm/profiles/com.apple.vpn.managed.applayer/example1.plist