Journalist 
Intune per-app vpn globalprotect: comprehensive guide to configuring per-app VPN with Intune and GlobalProtect for secure app traffic
Intune per-app VPN GlobalProtect lets you deploy per-app VPN profiles to route selected apps through GlobalProtect gateways. In this guide, you’ll get a practical, step-by-step walkthrough, from prerequisites to troubleshooting, plus real-world tips, best practices, and common pitfalls. We’ll cover: what per-app VPN is, how GlobalProtect fits in, how to configure it in Intune across supported platforms, troubleshooting tips, and how to measure success with metrics. If you’re looking to add an extra layer of protection for app traffic while staying compliant with corporate policies, you’re in the right place. Plus, if you’re looking to supplement your overall security posture beyond VPNs, check out this NordVPN deal for additional protection during general web browsing: . Here are some useful resources to get you started: Apple Website – apple.com, Microsoft Intune documentation – docs.microsoft.com/en-us/mem/intune/, Palo Alto Networks GlobalProtect – paloaltonetworks.com/products/globalprotect, VPN best practices – cisco.com, Network security for enterprise – en.wikipedia.org/wiki/Computer_network_security.
What is Intune per-app VPN with GlobalProtect?
Intune per-app VPN is a feature that lets you define VPN connections that apply only to specific apps on a device, rather than forcing all network traffic through the VPN. GlobalProtect is Palo Alto Networks’ VPN solution that can serve as the gateway for these connections. When you combine Intune’s per-app VPN capabilities with GlobalProtect, you can ensure that only chosen apps send traffic through a secured tunnel to a designated gateway, while other apps access the internet directly. This granularity is especially useful in bring-your-own-device BYOD scenarios and in environments with mixed trust levels across apps.
Key benefits:
- Granular control: route only critical or sensitive apps through VPN
- Better performance: non-critical apps bypass VPN to save battery and bandwidth
- Centralized policy management: leverage Intune for deployment and updates
- Consistent security posture: traffic to corporate resources goes through a controlled gateway
How per-app VPN works with GlobalProtect in Intune
- A per-app VPN profile is created in the Intune admin center and configured to use GlobalProtect as the VPN type.
- You map specific apps to this VPN connection, so only those apps establish the VPN tunnel.
- On the device, the Intune client enforces the policy, starting the GlobalProtect VPN connection when the mapped app launches and stopping it when the app closes or based on session policies you define.
- You can specify gateway address, authentication method certificate-based or user/password where supported, and split-tunneling rules, so only corporate destinations go through the VPN.
Important: platform support and exact UI paths change over time. Always verify the latest Microsoft documentation for per-app VPN and Palo Alto GlobalProtect integration on your device platforms Windows, macOS, iOS/iPadOS, Android.
Prerequisites
- Microsoft Intune subscription with appropriate device enrollment capabilities Windows, macOS, iOS/iPadOS, Android.
- GlobalProtect gateways configured and reachable, with a valid gateway address, portal URL, and authentication method certificate-based is common for managed deployments.
- Suitable licenses for GlobalProtect and the chosen authentication method certificates or SSO that your organization uses.
- Devices enrolled in Intune and compliant with your policies.
- Admin access to both Microsoft Intune admin center and GlobalProtect management console for coordinating VPN gateway settings and app mappings.
- For iOS/iPadOS/macOS, you may need the Network Extension entitlement or equivalent permissions, plus appropriate app configuration in Intune.
- Network and firewall rules that allow traffic to and from the GlobalProtect gateway and the corporate resources you intend to access.
Supported platforms and considerations
- Windows: Per-app VPN in Windows often relies on the Routing and Remote Access RRAS or VPN client profiles that Intune can push, aligned with GlobalProtect as the VPN gateway. Ensure the GlobalProtect client on Windows is compatible with the Intune per-app VPN policy and supports the required VPN type.
- macOS: macOS devices can receive per-app VPN configurations via Intune, utilizing GlobalProtect as the gateway, with attention to certificate trust and keychain management.
- iOS/iPadOS: Per-app VPN is commonly supported through iOS Network Extension-based configurations. GlobalProtect must expose an API compatible with the per-app VPN payloads Intune can deploy.
- Android: Per-app VPN support via Intune is present for Android with appropriate VPN type configuration. Ensure you’re using a GlobalProtect client version that supports per-app VPN policies on Android.
Tip: start with a test device or a small pilot group to validate each platform’s behavior before broader rollout.
Step-by-step guide to configure Intune per-app VPN with GlobalProtect
Note: The exact UI labels can vary by portal version and updates. The flow below reflects a typical sequence and may require slight adaptations. Browsec vpn edge extension
Step 1: Prepare GlobalProtect gateway and config
- Ensure your GlobalProtect gateway is reachable and that clients can authenticate using certificate-based or SSO credentials as configured.
- Create a dedicated VPN gateway profile for per-app VPN traffic, specifying the corporate resources that will be accessible through the VPN.
- Generate or prepare the necessary certificates, trust anchors, and any required client configuration files that will be deployed to endpoints.
- Define split-tunneling rules if you want only corporate destinations to go through the VPN.
Step 2: Create an Intune per-app VPN profile
- Sign in to the Microsoft Intune admin center.
- Navigate to Devices > iOS/iPadOS or Windows/macOS/Android, depending on the platform > Configuration profiles > Create profile.
- Choose the platform and select the profile type that corresponds to per-app VPN the label may vary by platform and Intune version.
- Set the VPN type to GlobalProtect or the appropriate VPN gateway type that maps to GlobalProtect in your environment.
- Enter the gateway address URL or IP and authentication method certificate-based is common. you’ll specify the certificate or SSO settings as appropriate.
- Define any required DNS suffixes, split-tunnel rules, and Microsoft Defender/endpoint protection integration if you have those in place.
- Save the profile and prepare it for assignment.
Step 3: Map apps to the per-app VPN profile
- In Intune, create an App configuration or App protection policy that links the per-app VPN profile to specific apps.
- Add the app package identifiers bundle IDs for iOS/macOS, application IDs for Windows, package names for Android that should trigger the VPN.
- Ensure you’ve tested the mapping with at least one pilot app to confirm that launching the app triggers the VPN as intended.
- You can group apps into an App Group for easier management and to apply multiple app mappings at once.
Step 4: Assign the policy to devices or user groups
- Scope the per-app VPN profile to the intended user or device groups. For example, you might target a group of corporate devices while excluding personal devices.
- Consider creating a phased rollout plan pilot group first, then broader deployment to catch edge cases early.
- If you have conditional access policies or compliance rules, ensure they align with the VPN deployment so that devices remain compliant while the VPN is active.
Step 5: Monitor, verify, and refine
- Use Intune reports and device diagnostics to verify which devices have the per-app VPN profile applied and whether the VPN tunnels establish correctly when the mapped apps launch.
- Validate that traffic intended for corporate resources is routed through GlobalProtect and that non-corporate traffic remains outside the VPN when appropriate.
- Collect feedback from users about app performance, connection stability, and any device battery impact, and adjust split-tunnel rules or gateway configurations as needed.
Best practices and tips
- Start with a narrow scope: begin with a couple of critical apps that access sensitive data and gradually expand to more apps as you validate stability.
- Use certificate-based authentication where possible for stronger security and reduced user friction.
- Implement strict split-tunnel rules to ensure only corporate destinations go through GlobalProtect, minimizing unnecessary VPN traffic.
- Regularly rotate certificates and review gateway configurations to maintain security posture.
- Test on all target platforms Windows, macOS, iOS, Android since per-app VPN behavior can vary by OS.
- Document the app mappings and gateway configurations for IT staff and for audits.
- Consider combining per-app VPN with device posture checks from Intune compliance policies to ensure devices meet security requirements before traffic is allowed.
Troubleshooting and common issues
- Issue: VPN tunnel not establishing when the mapped app starts.
- Check that the per-app VPN profile references the correct gateway and that the app mapping is correct bundle IDs, app identifiers.
- Verify that the correct certificates are installed on the device and trusted by the client.
- Review device logs or Intune diagnostics for VPN connection errors.
- Issue: Traffic not routing through VPN despite the per-app mapping.
- Confirm split-tunneling rules are configured as intended.
- Ensure the VPN service on the device is not blocked by another security client.
- Validate that the GlobalProtect gateway is reachable from the device network firewall rules, NAT, and VPN gateway health.
- Issue: App performance degradation when VPN is active.
- Consider adjusting split-tunnel scope to minimize VPN traffic.
- Check gateway load and scale the GlobalProtect gateway resources if needed.
- Look for DNS resolution issues that can slow down app requests and adjust DNS settings in the VPN profile.
- Issue: Certificate trust or enrollment failures.
- Reissue or rebind the correct certificates, confirm the trust chain, and verify that device clocks are synchronized certificate validity relies on accurate time.
- Issue: Cross-platform inconsistencies.
- Some OS versions might require different payloads or have different limitations for per-app VPN. Always test new OS updates in a controlled pilot.
Real-world use cases and scenarios
- Remote workforce with sensitive corporate apps: Map only the key enterprise apps to the per-app VPN so that users aren’t bogged down by a VPN for every activity.
- Contractors and guests: Use per-app VPN for specific apps to protect corporate data while allowing personal apps to run outside the VPN.
- BYOD programs: Enforce VPN for certain apps without forcing entire device VPN configuration, preserving user privacy for non-work-related traffic.
- Compliance-driven access: Tier access by app and resource. only apps that touch sensitive data route via VPN to trusted gateways, with logs and auditing baked into Intune and GlobalProtect.
Security considerations and compliance
- Always enforce strong authentication methods for VPN gateways certificates, trusted CA chains, SSO where supported.
- Monitor and log per-app VPN activity to detect anomalies which apps are using the VPN, which gateways are being hit, and timing patterns.
- Use device posture checks in Intune to ensure only compliant devices can run the mapped apps via VPN.
- Regularly review app mappings to remove access for apps that no longer require VPN coverage.
- Align per-app VPN with broader security controls like conditional access, data loss prevention DLP, and endpoint protection to create a layered defense.
Performance and monitoring
- Expect some overhead when the VPN is active, especially for mobile devices. carefully select apps that truly need VPN routing.
- Implement health checks and gateway failover strategies so that if one GlobalProtect gateway fails, traffic can route through a backup gateway with minimal disruption.
- Use Intune and GlobalProtect dashboards to monitor connection success rates, latency, and VPN tunnel uptime. Track the number of devices actively using per-app VPN and the resources consumed by VPN gateways.
Alternatives to per-app VPN if not using GlobalProtect
- Full-device VPN: Route all device traffic through VPN. simpler to manage but can impact performance and battery life.
- App-level encryption and secure app containers: Use app-level security controls without relying solely on VPN to protect data in transit.
- Identity-driven access with zero trust: Combine conditional access with app-aware policies to minimize trust assumptions without a full VPN footprint.
- Other VPN gateways: Use alternative gateways that support per-app VPN with Intune, depending on your vendor contracts and compatibility.
Frequently Asked Questions
What is Intune per-app VPN?
Intune per-app VPN is a capability that allows IT admins to create VPN connections that apply only to specific apps on a device, rather than all traffic from the device. It helps protect data in transit for corporate apps while keeping non-work apps outside the VPN.
How does GlobalProtect fit into per-app VPN with Intune?
GlobalProtect serves as the VPN gateway for the per-app VPN profiles deployed via Intune. The per-app VPN policy tells the device which apps should trigger the GlobalProtect tunnel to reach corporate resources securely.
Which platforms support Intune per-app VPN with GlobalProtect?
Windows, macOS, iOS/iPadOS, and Android devices can support per-app VPN deployments through Intune, with the GlobalProtect gateway configured to handle the VPN connections. Exact support and UI paths can vary by OS version and Intune updates.
Do I need a separate GlobalProtect license for per-app VPN?
Per-app VPN usage typically relies on your existing GlobalProtect deployment, but licensing requirements can vary by deployment model and gateway configuration. Check with Palo Alto Networks and your licensing terms to confirm.
How do I map specific apps to the VPN?
In Intune, you map apps by their package identifiers bundle IDs on Apple platforms, application IDs on Windows, or package names on Android. You then associate those apps with the per-app VPN profile or with an app group that uses the VPN policy. Microsoft edge vpn built in
Can I use split-tunneling with per-app VPN?
Yes, split-tunneling is commonly used to ensure only corporate destinations go through the VPN, while non-corporate traffic goes directly to the internet. Define the allowed corporate destinations and DNS suffixes accordingly.
What authentication methods are supported?
Certificate-based authentication is common and preferred for VPNs in managed environments. Some setups may support SSO or username/password where appropriate, depending on the gateway configuration and platform.
How do I troubleshoot a failing per-app VPN deployment?
Start by verifying the app mappings, VPN gateway settings, and certificate trust. Check Intune policy assignments, device logs, and GlobalProtect client status. Use test devices in a pilot group to isolate issues.
How do I verify success after deployment?
Use Intune reports to confirm policy application, check VPN tunnel status on target devices, monitor gateway health, and perform end-to-end tests by launching mapped apps and confirming traffic reaches corporate resources through the VPN.
What are common performance impacts to expect?
VPNs add some latency and can affect battery life, particularly on mobile devices. Narrow the scope with per-app VPN, optimize gateway load, and ensure split-tunnel rules are carefully tuned to minimize unnecessary VPN usage. Adguard vpn cost: complete guide to pricing, plans, features, speeds, privacy, and comparisons in 2025
Can per-app VPN be rolled out incrementally?
Absolutely. A phased rollout—starting with a small pilot group and gradually expanding—helps catch edge cases, device platform variations, and user feedback before widespread deployment.
How do I maintain security with per-app VPN?
Pair per-app VPN with device compliance policies, regular certificate renewal, gateway hardening, access controls, and audit logging. Use monitoring dashboards to detect anomalies and respond quickly to incidents.
Are there any platform-specific gotchas I should know?
Yes. iOS/macOS may require Network Extension entitlements and careful management of app identifiers, while Windows deployments may depend on RRAS/VPN client compatibility. Always test updates on all platforms in your environment.
How does per-app VPN affect user experience?
It can improve user experience by limiting VPN usage to required apps, reducing battery drain and bandwidth during normal app usage. Some apps may experience initial connection latency while the VPN establishes, which can be mitigated with pre-warming and caching strategies.
Where can I find official documentation for Intune per-app VPN and GlobalProtect?
Start with Microsoft Intune documentation for per-app VPN and Windows/macOS/iOS support, and Palo Alto Networks GlobalProtect documentation for gateway configuration and client behavior. These sources are updated regularly with platform-specific guidance and best practices. Mullvad vpn vs expressvpn