App-Layer VPN
com.apple.vpn.managed.applayer
The payload that configures a per-app VPN.
iOS 7.0+macOS 10.9+watchOS 10.0+visionOS 1.1+
Apple schemaRequires supervision on watchOS
Configuration Keys (10)
Showing 10 of 10 keys
| Key | Type | Description | Default | Range |
|---|---|---|---|---|
VPNUUIDstringrequired | string | A globally unique identifier for this VPN configuration. | Default: — | Range: — |
| string | A string representing the data network name (DNN) or app category identifying a Cellular Slice. The device forces the VPN tunnel to use the specified Cellular Slice. | Default: — | Range: — | |
SafariDomainsarraynot on watchOS | array | An array with entries that must each specify a domain that triggers the VPN connection in Safari. Each entry is in the format `www.apple.com`. | Default: — | Range: — |
SafariDomainsItemstringrequired | string | A domain. | Default: — | Range: — |
| array | An array with entries that must each specify a domain that triggers this VPN connection in Mail. Each entry is in the format `www.apple.com`. This property is deprecated in iOS 13.4 and later; use the `VPNUUID` property of the `Mail` or `ExchangeActiveSync` payload instead. | Default: — | Range: — | |
MailDomainsItemstringrequired | string | A domain. | Default: — | Range: — |
| array | An array with entries that must each specify a domain that triggers this VPN connection in Calendar. Each entry is in the format `www.apple.com`. This property is deprecated in iOS 13.4 and later; use the `VPNUUID` property of the `CalDAV` payload instead. | Default: — | Range: — | |
CalendarDomainsItemstringrequired | string | A domain. | Default: — | Range: — |
| array | An array with entries that must each specify a domain that triggers this VPN connection in Contacts. Each entry is in the format `www.apple.com`. This property is deprecated in iOS 13.4 and later; use the `VPNUUID` property of the `CardDAV` payload instead. | Default: — | Range: — | |
ContactsDomainsItemstringrequired | string | A domain. | Default: — | Range: — |
AssociatedDomainsarrayiOS 14.0+ · macOS 11.0+ | array | An array with entries that must each specify a domain that triggers this VPN. The domains must also be part of the `apple-app-site-association` file, as described in `Supporting associated domains`. | Default: — | Range: — |
AssociatedDomainsItemstringrequired | string | A domain. | Default: — | Range: — |
ExcludedDomainsarrayiOS 14.0+ · macOS 11.0+ | array | An array with entries that each specify a domain that doesn't trigger this VPN for connections to the domain. | Default: — | Range: — |
ExcludedDomainsItemstringrequired | string | A domain. | Default: — | Range: — |
OnDemandMatchAppEnabledboolean | boolean | If `true`, automatically connects the VPN when associated apps for this per-app VPN service initiate network communication. Otherwise, the user must initiate the connection manually before those apps can initiate network communication. If this key isn't present, the value of the `OnDemandEnabled` key determines the status of per-app VPN On Demand. | Default: — | Range: — |
SMBDomainsarrayiOS 13.0+ · not on macOS, watchOS | array | An array of SMB domains that's accessible through this VPN connection. | Default: — | Range: — |
SMBDomainsItemstringrequired | string | An SMB domain. | Default: — | Range: — |