Hello Apple Developer Team / Community,
I’m developing an iOS app that needs to read a VPN configuration profile that’s pushed via Intune MDM using the NEVPNManager / NETunnelProviderManager APIs — specifically the loadAllFromPreferences() method.
I understand that certain entitlements and capabilities are required when working with the Network Extension / VPN frameworks. I came across the entitlement key com.apple.developer.vpn.managed (also referred to as the “Managed VPN” entitlement) and would like some clarification:
Is this entitlement mandatory for my use case — that is, reading a VPN profile that has been pushed via MDM? Or are there alternative entitlements or capabilities that would suffice?
If it is required, what is the exact process to request and enable this entitlement for my app? Could you please outline the necessary steps (e.g., updates in the Apple Developer portal → App ID → Capabilities → Provisioning Profiles, etc.)?
Context:
The app targets iOS and iPadOS.
Currently, the app creates and saves the VPN profile itself using NETunnelProviderManager and saveToPreferences(), which works perfectly.
However, we now want to deliver the same VPN configuration via MDM, so that users don’t have to manually install the profile or enter their device passcode during installation.
The goal is for the app to be able to read (not necessarily modify) the MDM-pushed VPN profile through NETunnelProviderManager.loadAllFromPreferences().
Thank you in advance for any guidance — especially a clear “yes, you need it” or “no, you can do without it” answer, along with any step-by-step instructions to request the entitlement (if it’s required).
Is this entitlement mandatory for my use case … ?
It depends |-:
If the MDM system installs a profile for your VPN, you will be able to see that configuration. The com.apple.managed.vpn.shared keychain access group comes into play if that profile references a credential in the standard way, meaning either a password or a digital identity. Those credentials get stored in the com.apple.managed.vpn.shared keychain access group. Third-party apps don’t have access to that group by default. If you have an enterprise-focused VPN product that needs such access, you should apply for it.
For information on how to apply, see FAQ#9 in Network Extension Framework Entitlements.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"