Skip to main content

Glossary

Per-app VPN

Per-app VPN routes the traffic of selected applications through a corporate tunnel while everything else on the device goes straight out to the internet. For an IT team it is how a phone reaches an internal system without the company also carrying, inspecting and paying for the user's personal browsing.

How it works

On iOS and iPadOS the rule is strict and catches people out: per-app VPN only applies to managed apps. The app has to be installed by the MDM, and the MDM has to push a VPN payload that names it. An app the user installed from the App Store themselves cannot be mapped to the tunnel, even if it's the same app. The fix is to remove the personal copy and let the MDM install a managed one. Apple has supported this since iOS 7 in 2013, and modern tunnels are built on the NetworkExtension framework rather than legacy IPsec clients.

Android takes a different route. Inside an Android Enterprise work profile, the admin designates a VPN app as Always On, optionally with lockdown so work traffic is dropped rather than sent in the clear when the tunnel is down. The scoping is per profile rather than per app, which is often exactly what you want: everything in the work profile tunnels, everything personal doesn't. Finer per-app allowlists and denylists are then configured inside the VPN app through managed app configuration, and what's possible depends on the vendor rather than on the OS.

Beyond the split itself, the practical notes:

  • Certificates beat shared secrets for authentication, and the same MDM payload can deliver both the certificate and the VPN profile.
  • On-demand rules let the tunnel come up only for specific domains, so nothing runs while the app idles.
  • Split DNS matters. An app that resolves an internal hostname over the public resolver fails in a way that looks like a VPN bug.

Why it matters for a fleet

A full device VPN on a phone is a bad deal for everyone. The employee's private traffic crosses the company gateway, which is a privacy problem on a BYOD handset and a legal one in several European jurisdictions. Battery drains faster. Video and voice apps hairpin through the data center and degrade. Bandwidth you pay for carries holiday photos.

Scoping the tunnel to the apps that need it removes all four at once. And it makes the access story cleaner: the ERP client reaches the internal network, the browser doesn't.

This is also the mechanism modern ZTNA products ride on. Zscaler Private Access, Netskope and Cloudflare's client all ship as a NetworkExtension app on iOS or an Always On VPN app on Android, pushed and pre-configured by the MDM. So per-app VPN is less a competing technology than the delivery layer underneath them, which is worth knowing before a supplier tells you their agent replaces your MDM.

How Appaloosa handles it

Appaloosa installs the VPN or ZTNA client as a managed app from the enterprise app store, pushes the matching VPN payload with its per-app mapping on iOS or the Always On designation inside the Android work profile, and supplies the client certificate the tunnel authenticates with. Managed app configuration carries the tenant and gateway values so nothing has to be typed on the device. Removing the app or wiping the work side takes the tunnel and its credentials with it. The payloads and the enrollment modes they depend on are covered under Appaloosa's MDM capabilities.

Explore

See the full platform

Enrollment, apps, security, remote support: all in one place.

Explore Appaloosa →

See Appaloosa run on your fleet Book a demo

Frequently asked questions

Why is our per-app VPN not starting on iPhones?
Nine times out of ten the app was installed by the user rather than by the MDM. iOS only applies a per-app VPN mapping to managed apps, so a personal copy from the App Store will never use the tunnel. Remove it, push the app from the console, and check that the VPN payload lists the right bundle identifier.
Can we do per-app VPN on employee-owned phones?
Yes, and it is the right model there. In an Android work profile you make the VPN Always On for the work side only, and on iOS with User Enrollment the managed apps can be mapped to the tunnel. Personal traffic never touches your gateway, which keeps the deployment acceptable to employees and to works councils.
Does a ZTNA product remove the need for per-app VPN?
Not really, it uses it. ZTNA clients on iOS and Android are delivered as network extension or Always On VPN apps, and the MDM is what installs them, configures them and gives them a certificate. The access decisions move to the ZTNA policy engine, but the plumbing on the device stays the same.