Table of Contents

Intune per app vpn ios configuration guide for iOS per-app VPN with Microsoft Intune: setup, best practices, and troubleshooting

Intune per app VPN iOS lets you configure per-app VPN profiles to route traffic from specific apps through a VPN on iOS devices. In this guide, you’ll learn how to set up per-app VPN using Microsoft Intune, what prerequisites you need, best practices, common pitfalls, real-world usage scenarios, and how to troubleshoot when things don’t go as planned. If you’re evaluating mobile security for iOS and want a concrete path to protect app traffic, this article has you covered. For a quick security boost while you read, consider checking out NordVPN with this limited-time deal included here:

Introduction: what you’ll get in this post

A clear, step-by-step approach to enabling per-app VPN on iOS through Intune
A practical breakdown of prerequisites, limitations, and recommended configurations
Real-world examples showing where per-app VPN shines and where it might be less ideal
Troubleshooting tips you can implement right away
A robust FAQ with answers to at least 10 common questions

What is Intune per app VPN on iOS?
Per-app VPN is a feature that lets you route traffic from selected apps through a VPN connection managed by your enterprise. On iOS, Intune acts as the controller to deploy and enforce App VPN per-app VPN settings, while the iPhone or iPad handles the actual VPN tunnel using iOS networking capabilities. In practice, you pick apps by their bundle IDs, specify a VPN connection, and Intune makes sure those apps only send traffic through that VPN when they’re in use. This helps you minimize risk by ensuring sensitive app traffic never leaks out unencrypted or over an unsecured network, especially on public Wi-Fi.

Why use per-app VPN with Intune on iOS?

Granular control: Only business-critical applications go through the VPN, preserving device performance for other apps.
Stronger data protection: Traffic from protected apps is isolated and encrypted, reducing exposure on open networks.
Operational simplicity: IT can deploy a single VPN configuration across many devices while tailoring which apps participate.
Compliance support: Per-app VPN helps meet corporate policies around data in transit for mobile workforce scenarios.

Prerequisites you should have in place

An active Microsoft Intune account with the appropriate licensing usually part of Microsoft 365 business or enterprise suites.
iOS devices enrolled in Intune via MDM enrollment methods such as Automated Device Enrollment or Apple School/Business Manager workflows.
A VPN gateway that supports iOS App VPN IKEv2, IPSec-based, or compatible configurations. In practice, you’ll configure a VPN connection that iOS can connect to via the built-in VPN client.
A VPN client configuration that can be delivered to iOS devices via Intune certificate-based authentication is highly recommended for security.
A list of apps to be protected, identified by their bundle IDs e.g., com.company.app1, com.company.app2.
Sufficient permissions in the Intune admin center to create VPN profiles, per-app VPN policies, and assignment groups.
Optional but highly recommended: a device compliance policy and conditional access controls to ensure only compliant devices use the per-app VPN.

How the per-app VPN setup works on iOS with Intune high-level

You create a VPN connection profile in Intune that describes the gateway, authentication method, and underlying protocol.
You define a per-app VPN policy that ties that VPN connection to a set of apps by their bundle identifiers.
You publish or assign that policy to user or device groups.
On enrollment, the iOS device receives the VPN profile and the per-app VPN policy, and the iOS VPN client configures the tunnel automatically for the specified apps.
When a protected app runs, its traffic is directed through the VPN tunnel. Other apps are free to access the internet directly unless you’ve set up other policies.

Step-by-step: configuring per-app VPN in Intune for iOS admin guide
Note: The exact UI labels may change slightly as Microsoft updates the Intune console, but the overall flow remains consistent.

Prepare your VPN gateway and certificate

Ensure your VPN gateway supports iOS App VPN IKEv2/IPSec is common.
Create certificate-based authentication for devices. Use a trusted CA if possible.
Note down the gateway hostname, remote ID, and local/remote VPN endpoints. You’ll need these for the Intune VPN profile.

Create the VPN connection profile in Intune

In the Microsoft Intune admin center, go to Devices > Configuration profiles > + Create profile.
Platform: iOS/iPadOS
Profile type: VPN
Give the profile a descriptive name e.g., “App VPN – CompanyApps”.
Configure the VPN gateway details:
- Connection name
- Server address or gateway
- VPN type IKEv2/IPSec is typical for iOS App VPN
- Authentication method certificate-based is recommended. otherwise, use a trusted certificate or EAP-based method if your gateway supports it
- Authentication certificate details if using certificates
Save the VPN profile.

Create the per-app VPN policy

In Intune, go to Apps > App configuration policies or Apps > App protection policies, depending on how you structure protection in your tenant the exact navigation can vary by portal updates.
Create a new policy for per-app VPN and select “Per-app VPN” as the enforcement mode.
Associate the VPN profile you created in step 2 with this per-app VPN policy.
Specify the list of apps by their bundle identifiers that should use the VPN e.g., com.company.app1, com.company.app3.
Choose whether to enable “Always On” per-app VPN for the protected apps this keeps the VPN tunnel up as long as the app is allowed or to trigger connections on demand.
Save the policy.

Deploy to the right groups

Assign the per-app VPN policy to user or device groups that contain the target devices and users.
Ensure those devices have the VPN profile installed. Intune will push the VPN profile and per-app VPN policy together when devices check in.

Enforce app installation and protection

If you haven’t already, deploy the managed apps the protected apps to the same groups.
Verify the apps are installed on user devices and that they have the correct app IDs registered for per-app VPN.

Validate on a test device

Enroll a test iOS device and sign in with a test user account.
Install one of the protected apps and monitor the VPN status in iOS Settings > General > VPN & Device Management or within the Intune Company Portal app if supported.
Run the protected app and confirm that traffic is routed through the VPN by testing IP address exposure e.g., check what IP appears when accessing a public site from the app and verifying that the VPN tunnel is active.

Monitor and adjust

Use the Intune reporting features to track device enrollment status, VPN profile delivery, and per-app VPN policy application.
Periodically review app bundle IDs to ensure only the intended apps are protected, and update the policy as new apps are added or removed.

Best practices for per-app VPN on iOS

Prefer certificate-based authentication: It reduces the risk of credential leakage and simplifies automated trust management on devices.
Use strong, unique credentials for VPN gateways and rotate them per company policy.
Apply split-tunneling carefully: Decide whether only protected apps should route traffic via VPN or if the entire device should route traffic through the VPN. Split-tunneling can save bandwidth but may create exposure if non-protected apps access sensitive resources.
Limit per-app VPN to business-critical apps: More apps mean more maintenance and potential performance overhead.
Regularly review app lists: If an app is deprecated or replaced, remove it from the per-app VPN policy to avoid unnecessary tunnel overhead.
Combine with conditional access: Require devices be compliant before allowing VPN usage to access corporate resources.
Document your configuration: Keep a central artifact detailing which apps are protected, the VPN gateway details, certificate authorities, and rotation schedules.

Common pitfalls and how to avoid them

App not appearing in VPN scope: Verify the app’s bundle ID and ensure it’s added to the per-app VPN policy. Some apps use multiple binaries. ensure you cover all relevant IDs.
VPN not starting for a protected app: Check the VPN service status on the device. Ensure the VPN profile is installed and that the gateway is reachable from the device network.
Certificate issues: If the gateway uses certificates, ensure the device has the trusted root CA installed and that the device time is correct to avoid certificate validity problems.
Performance concerns: Per-app VPN adds overhead. If performance suffers, reassess which apps truly need VPN protection and consider adjusting tunnel settings or upgrading gateway capacity.
App updates require policy refresh: When an app is updated, sometimes the system needs a policy refresh to re-verify the app’s identity. Force a policy sync if needed.

Security and compliance considerations

Ensure encryption is enabled at all times and that you’re using strong VPN protocols compatible with iOS devices.
Use certificate-based mutual authentication whenever possible to reduce the attack surface.
Implement device compliance checks to ensure only compliant devices can establish VPN connections.
Monitor for anomalous VPN usage: Unusual traffic patterns can indicate misconfigurations or compromised devices.
Plan for incident response: Have a playbook for revoking VPN access if a device is lost or an employee leaves the organization.
Audit logs: Keep an audit trail of VPN profile deployments and per-app VPN policy changes to satisfy compliance requirements.

Real-world use cases and scenarios

Field workers accessing internal resources from mobile devices: Per-app VPN ensures sensitive data never leaves the corporate network unless the app is connected to the VPN tunnel.
Contractors using specific apps on BYOD devices: You can provide access to enterprise resources only through chosen apps, reducing risk on personal devices.
Retail or on-site employees using kiosk-like apps: Lock the device down to business apps and ensure those apps always route through corporate VPN when necessary.
Teams with remote work requirements: Combine per-app VPN with conditional access to ensure secure access from anywhere while keeping performance sane for non-work apps on the same device.

Choosing the right VPN provider and integration notes

Intune’s per-app VPN on iOS relies on the iOS App VPN framework. Any VPN gateway that supports standard IKEv2/IPSec and can issue device certificates typically works well.
You don’t have to rely on a single VPN brand for all scenarios. In many cases, organizations use their enterprise-grade VPN gateway with certificate-based authentication and pair it with Intune’s per-app VPN to enforce app-level routing.
If you’re evaluating a vendor’s VPN solution to pair with Intune, look for: strong encryption, reliable certificate-based authentication, straightforward certificate distribution, and solid logging for audit purposes.
NordVPN and similar services are great for consumer-grade needs, but for enterprise per-app VPN with Intune, you’ll typically need a corporate VPN gateway, not a consumer VPN, to properly support per-app VPN scenarios. That’s why it’s best paired with your enterprise VPN infrastructure.

Performance, scalability, and maintenance considerations

Plan capacity around your user base and protected apps. VPN gateways have connection limits. ensure you’ve sized the gateway for peak load.
Regularly review certificates’ expiration dates and automate renewal where possible to avoid gaps in connectivity.
Schedule periodic policy reviews to remove deprecated apps and add new protected apps as your mobile portfolio evolves.
Keep OS and Intune clients up to date. Apple and Microsoft release security patches that can affect per-app VPN behavior.

Alternatives and how this compares

Full-device VPN vs. per-app VPN: A full-device VPN routes all traffic through the VPN tunnel, which can impact performance and battery life. Per-app VPN is more selective and typically better for performance while maintaining security for critical apps.
MDM alternatives: Some MDM solutions offer similar per-app VPN capabilities, but the tight integration with iOS App VPN via Intune often provides a smoother admin experience when you already run Microsoft 365 and Azure AD.
Direct app-level encryption: For some apps, it’s possible to build in encryption or rely on TLS, but per-app VPN adds a robust network-layer protection layer that applies regardless of app internals.

Privacy considerations

Per-app VPN ensures that traffic from protected apps is tunneled and encrypted, but it does not eliminate all in-app telemetry or data collection by the app itself.
Be transparent with users: Provide clear policies about data handling when the VPN is active, including what traffic is tunneled and what isn’t.
Combine with other privacy controls, such as app-level privacy settings and enterprise data loss prevention DLP policies, to bolster your overall privacy program.

Troubleshooting quick-start tips

Verify device enrollment: Ensure the device has received the VPN profile and per-app VPN policy.
Check network reachability: Confirm that the VPN gateway is reachable from the device’s network corporate Wi-Fi, cellular, etc..
Confirm app IDs: Double-check bundle IDs in the per-app VPN policy. mismatches are a common source of issues.
Review logs: Look at iOS VPN logs and Intune policy sync events to identify where the failure occurs.
Test with a single app: Start with one protected app to simplify debugging, then expand to more apps.
Re-push profiles: If a device isn’t picking up changes, force a policy refresh from the Intune portal and re-enroll if necessary.
Check certificate validity: Ensure the device trusts the certificate authority and that the certificate isn’t expired.

FAQ: Frequently Asked Questions

What is per-app VPN on iOS with Intune?

Per-app VPN on iOS with Intune routes traffic from select apps through a VPN connection controlled by Intune, providing app-level security while leaving non-protected apps free to use the normal network path.

Which iOS versions support Intune per-app VPN?

App VPN functionality is supported on iOS versions that expose the Network Extension framework and allow per-app VPN configuration, typically iOS 9 and later, with broader stability on more recent iOS releases. Always check Apple’s current documentation for the exact OS compatibility matrix.

Do I need a dedicated VPN gateway to use per-app VPN with Intune?

Yes. You’ll need a VPN gateway that supports IKEv2/IPSec or another standard VPN protocol compatible with iOS App VPN, plus certificate-based authentication if you want strong security.

Can I use consumer VPN services for per-app VPN in Intune?

Per-app VPN in Intune is designed for enterprise-grade VPN gateways. Consumer VPN services are typically not suitable for per-app VPN in managed corporate environments because they don’t integrate with device management and policy enforcement in the same controlled way.

How do I test per-app VPN after configuring it in Intune?

Enroll a test iOS device, install one protected app, ensure the VPN profile and per-app VPN policy are delivered, and then run the app to verify traffic is routed through the VPN. Verify the external IP seen by services accessed from the app and monitor VPN status in iOS settings. How to turn on vpn on microsoft edge

Can per-app VPN be always-on for protected apps?

You can configure the policy to keep the VPN tunnel active for protected apps as long as the app is in use or the device is on, depending on your needs. Always-on configurations reduce churn but may impact battery life, so test performance impacts.

What are common limitations of per-app VPN on iOS?

Limitations often involve compatibility with specific apps, potential increases in device battery usage, and the need for careful management of certificate-based authentication. Some apps may require additional network settings or app-level configurations to ensure traffic funnels correctly through the VPN.

How does per-app VPN affect battery life and performance?

Enabling per-app VPN adds overhead due to the VPN tunnel, which can impact battery life and network performance, especially on older devices or with high-traffic apps. Optimizing which apps are protected and tuning the VPN gateway capacity helps mitigate this.

Can multiple VPN connections be used simultaneously for different apps on the same device?

Typically, you configure a single App VPN profile in Intune and assign it to a set of apps. If you need multiple VPN tunnels for different apps, you’ll generally manage this with separate VPN configurations and per-app VPN policies, though this can complicate management.

How do I roll back or remove per-app VPN?

To remove per-app VPN, remove the per-app VPN policy or deactivate the VPN profile from the Intune console, then redeploy to devices. Ensure a clean policy refresh so devices stop routing traffic through the VPN for the previously protected apps. Free vpn extension for edge: comprehensive guide to installing, using, and evaluating free edge vpn extensions in 2025

How often should I rotate certificates and update VPN configurations?

Rotate certificates on a schedule aligned with your security policy often every 1–3 years or sooner if the certificate authority requires it. Update VPN gateway settings and re-distribute profiles whenever the gateway changes or security requirements demand it.

Conclusion and next steps

By following the steps outlined above, you can confidently implement per-app VPN for iOS devices using Intune, giving your organization better control over which apps route traffic through your corporate VPN and how that traffic is protected.
Keep monitoring, stay compliant with your internal policies, and iterate on your configuration as apps and security needs evolve.

Useful resources and references unlinked text

Microsoft Learn: Configure per-app VPN for iOS in Intune
Microsoft Intune documentation on VPN profiles
Apple Developer documentation on App VPN and Network Extension
Best practices for certificate-based VPN authentication
Your organization’s VPN gateway vendor guides and certificate management policies

Note: The NordVPN offer linked earlier is included as an additional security option for personal device use or as a supplementary tool for non-corporate contexts. For enterprise per-app VPN setups, use your approved corporate VPN solution and configurations.

Nord vpn from china 在中国使用 NordVPN 的完整指南：绕过审查、提升隐私与上网自由的实用方案 Cyberghost vpn edge extension

Intune per app vpn ios