Manage VPN app mappings on iOS, macOS, and Windows devices

Each VPN configuration that includes one or more app mappings can be associated with one or more managed iOS, macOS, and Windows devices. VPN app mappings allow you to have better control over the data that goes through your VPN. For information about creating VPN app mappings, see Configure VPN app mappings for iOS, macOS, and Windows devices.

You can apply an existing app mapping directly to one or more managed devices, or alternatively use policies to add app mappings to specific devices.

To apply app mappings to a managed device:

1. To apply an app mapping directly to a device:
   1. Select the Devices tab in top navigation.
   2. Select a device in the list.
   3. In the right panel, choose VPN, and click Add.
   4. In the VPN Configuration Library view that appears, select the applicable app mapping.

      Each entry in the list consists of VPN configuration paired with an app mapping. If a VPN configuration has multiple app mappings, each app mapping has its own entry. For example:

      My VPN with test mapping

      My VPN with demo mapping

      Another VPN with testing

   5. Click Install on Device.

      When the app is used on the selected devices, it uses the VPN indicated in the app mapping. If the device does not have the app installed, the app mapping applies when the app is installed.

   For more information about working with devices using the Devices tab, see Managing devices.

2. To apply app mappings to managed devices using policies:
   1. Select the Policies tab in top navigation.
   2. Complete one of the following steps:
      • To create a policy, in the All Policies view, click Add New.
      • To edit an existing policy, in the All Policies view, click an individual policy to open the policy details.
   3. In the Applies Tosection, select one or more labels associated with target devices. For more details about labels, see Using labels to group similar items.
   4. In the right pane, in the Resources tab, click Add Resources to open the drop-down list, and then click VPN to open a dialog.
   5. Slide the Link toggle to link/unlink the VPN configuration.
      • To link the VPN configuration to policy, slide the Link toggle to right. The color of the toggle changes to green indicating the resource is linked.
      • To unlink a previously linked VPN configuration, slide the Link toggle to left. The color of the toggle changes to red indicating the resource is unlinked.
   6. (Optional) In the Options column, click the icon to open Resource Options dialog. Select one of the following Compliance Type:
      1. Include - Select this option to include the resource when determining the compliance status.

         NOTE: By default, all the Resources in a policy are included in compliance checks.

      2. Exclude - Select this option to exclude the Resource when determining the compliance status.
   7. Click Add Resources to associate the VPN configuration to the policy. You can view the resource in the Resources pane.
   8. Click Push Resource to deploy the added VPN configuration to the target devices or users.

      When the app is used on a device to which this newly updated policy applies, it uses the VPN indicated in the app mapping. If the device does not have the app installed, the app mapping applies when the app is installed.
      For more information about policies, see Using policies to manage device configurations.

3. Optional. Verify that your app mappings work as expected on a managed device.

   NOTE: The following example guides you through the process of testing your per-app VPN settings on an iOS device. While the VPN settings on macOS and Windows systems are not identical to those describe here, the steps follow the same logic.

   1. Log in to your managed device.
   2. Go to the VPN settings.
   3. On your iOS device, in the PER-APP VPN section, ensure that the VPN configuration with app mappings is listed, and is not currently connected.
   4. Start the app that uses the newly configured app mappings.

      On the managed iOS device, in the top-left corner, a VPN icon appears, indicating that a VPN connection is established.

   5. Go back to the VPN settings on the device, and confirm that the VPN configuration in the is connected.
   6. Close the app.

      The VPN icon no longer appears in the top-left corner, and the VPN configuration in the device's VPN settings is no longer connected.