apple_device-management/mdm/profiles/com.apple.vpn.managed.applayer.yaml

title: App-Layer VPN
description: ''
payload:
  payloadtype: com.apple.vpn.managed.applayer
  supportedOS:
    iOS:
      introduced: '7.0'
      multiple: true
      supervised: false
      allowmanualinstall: true
      sharedipad:
        mode: allowed
        devicechannel: true
        userchannel: false
      userenrollment:
        mode: allowed
    macOS:
      introduced: '10.9'
      multiple: true
      devicechannel: true
      userchannel: true
      requiresdep: false
      userapprovedmdm: false
      allowmanualinstall: true
      userenrollment:
        mode: allowed
    tvOS:
      introduced: n/a
    watchOS:
      introduced: '10.0'
      multiple: true
      supervised: true
      allowmanualinstall: false
  content: The fields in this payload are the same as the VPN payload, with the addition
    of the fields shown below. On watchOS, only the IKEv2 VPN type is supported.
payloadkeys:
- key: VPNUUID
  type: <string>
  presence: required
  content: A globally unique identifier for this VPN configuration.
- key: SafariDomains
  supportedOS:
    watchOS:
      introduced: n/a
  type: <array>
  presence: optional
  content: An array with entries that must each specify a domain that triggers the
    VPN connection in Safari. Each entry is in the format 'www.apple.com'.
  subkeys:
  - key: SafariDomainsItem
    type: <string>
    presence: required
    content: A domain.
- key: MailDomains
  supportedOS:
    iOS:
      introduced: '13.0'
      deprecated: '13.4'
    macOS:
      introduced: '10.15'
    watchOS:
      introduced: n/a
  type: <array>
  presence: optional
  content: |-
    An array with entries that must each specify a domain that triggers this VPN connection in Mail. Each entry is in the format 'www.apple.com'.
    This property is deprecated in iOS 13.4 and later; use the 'VPNUUID' property of the Mail or ExchangeActiveSync payload instead.
  subkeys:
  - key: MailDomainsItem
    type: <string>
    presence: required
    content: A domain.
- key: CalendarDomains
  supportedOS:
    iOS:
      introduced: '13.0'
      deprecated: '13.4'
    macOS:
      introduced: '10.15'
    watchOS:
      introduced: n/a
  type: <array>
  presence: optional
  content: |-
    An array with entries that must each specify a domain that triggers this VPN connection in Calendar. Each entry is in the format 'www.apple.com'.
    This property is deprecated in iOS 13.4 and later; use the 'VPNUUID' property of the CalDAV payload instead.
  subkeys:
  - key: CalendarDomainsItem
    type: <string>
    presence: required
    content: A domain.
- key: ContactsDomains
  supportedOS:
    iOS:
      introduced: '13.0'
      deprecated: '13.4'
    macOS:
      introduced: '10.15'
    watchOS:
      introduced: n/a
  type: <array>
  presence: optional
  content: |-
    An array with entries that must each specify a domain that triggers this VPN connection in Contacts. Each entry is in the format 'www.apple.com'.
    This property is deprecated in iOS 13.4 and later; use the 'VPNUUID' property of the CardDAV payload instead.
  subkeys:
  - key: ContactsDomainsItem
    type: <string>
    presence: required
    content: A domain.
- key: AssociatedDomains
  supportedOS:
    iOS:
      introduced: '14.0'
    macOS:
      introduced: '11.0'
  type: <array>
  presence: optional
  content: |-
    An array with entries that must each specify a domain that triggers this VPN. The domains must also be part of the 'apple-app-site-association' file, as described in Supporting associated domains.
    Available in iOS 14 and later, and macOS 11 and later.
  subkeys:
  - key: AssociatedDomainsItem
    type: <string>
    presence: required
    content: A domain.
- key: ExcludedDomains
  supportedOS:
    iOS:
      introduced: '14.0'
    macOS:
      introduced: '11.0'
  type: <array>
  presence: optional
  content: |-
    An array with entries that each specify a domain that doesn't trigger this VPN for connections to the domain.
    Available in iOS 14 and later, and macOS 11 and later.
  subkeys:
  - key: ExcludedDomainsItem
    type: <string>
    presence: required
    content: A domain.
- key: OnDemandMatchAppEnabled
  type: <boolean>
  presence: optional
  content: If 'true', automatically connects the VPN when associated apps for this
    per-app VPN service initiate network communication. Otherwise, the user must initiate
    the connection manually before those apps can initiate network communication.
    If this key isn't present, the value of the 'OnDemandEnabled' key determines the
    status of per-app VPN On Demand.
- key: SMBDomains
  supportedOS:
    iOS:
      introduced: '13.0'
    macOS:
      introduced: n/a
    watchOS:
      introduced: n/a
  type: <array>
  presence: optional
  content: |-
    An array of SMB domains that's accessible through this VPN connection.
    Available in iOS 13 and later.
  subkeys:
  - key: SMBDomainsItem
    type: <string>
    presence: required
    content: An SMB domain.