When the new Per App VPN feature is triggered, does that VPN connection only apply to those apps, or does it apply to all traffic on the device?

Also, when the connection is triggered by the domain in Safari, does Safari use the VPN for all open pages, or only those triggered by the SafariDomains key?


  1. The VPN applies only to those apps, not all the traffic from the device. See Per app VPN (enterpriseios.com)

    Apps can phone home through a VPN tunnel as soon as they are launched, and send all their network traffic (and only their network traffic) through it. This is controlled by the MDM admin, not the app developer.

  2. It will use it for all domains. The SafariDomains key specifies only those domains that trigger the VPN connection.
Additional reference - Configuration Profile Reference sections:
Per-App VPN Payload
VPN Payload

  • Thanks for the references! I read through the Per-App VPN Payload document, and I see where it says that it triggers the connection in Safari, but I don't see anything that says if it does, or does not apply to other pages. Are we just reading the documentation differently? Or have you actually used the feature with Per-App VPN and found that to be how it works? Sep 24 '13 at 14:15
  • I understood in the discussions I have had about Per-App VPN that it would not apply to other pages. If it does, I think that is a weakness in the implementation. I will be interested to see more documentation on the issue, which we should see once Mavericks is finally released.
    – Dave
    Sep 25 '13 at 14:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .