Deploying VPN to Supervised Devices with MDM
Deploy VPN profiles and control what users can change inside Vylos across supervised Apple devices.
Vylos answers these through three managed app configuration keys that are read on every app launch and foreground transition.
Pushing Managed Tunnels
Managed tunnels are delivered through standard Apple .mobileconfig profiles containing VPN payloads. These profiles can be installed manually, distributed through a web portal, or pushed via MDM.
Each tunnel configuration includes standard WireGuard fields such as keys, endpoint, and Allowed IPs. It can also include On-Demand activation rules.
Managed tunnels appear in a dedicated "Managed Tunnels" section in Vylos. Users can see status and connection details there, while Apple Settings provides the manual on/off control; Vylos does not modify, delete, or toggle them.
Restricting User Access
Three restriction keys control what users can do:
Blocking Manual Tunnels
Setting allowManualTunnels to false removes all user-facing tunnel management. The "My Tunnels" section disappears, the Add Tunnel button is hidden, and existing app tunnel VPN entries are suspended from Apple Settings.
The tunnel data stays preserved locally and returns when the restriction is lifted.
This is the key setting for environments where users should only use IT-approved VPN configurations. Schools deploying Vylos to student iPads, businesses with compliance requirements, or any organization that needs predictable VPN behavior across devices.
Locking Down Settings
Setting allowSettings to false hides the Settings icon from the toolbar entirely. If the screen is reached through another path, it displays a "Settings are managed by your organization" message.
Users cannot change the app protection method, export tunnel archives, or view logs.
Enforcing Device Integrity
Setting blockJailbrokenDevices to true activates layered jailbreak detection on iOS. Vylos looks for signs of jailbreak tooling, sandbox compromise, and runtime tampering without publishing its exact indicators as a bypass checklist.
If any check fails, the app displays a full-screen "Device Policy Violation" message that cannot be dismissed. Vylos disconnects every tunnel, disarms On-Demand, and refuses reconnect attempts until the block is resolved.
Tunnel data is preserved; nothing is deleted.
The check runs when the home view loads, so it catches jailbreaks that happen after initial deployment.
Handling Delayed Configuration
Managed VPN profile delivery is not always instant. After Vylos returns to the foreground, it checks for delayed device-wide or per-app VPN profiles for up to 30 seconds.
The separate Managed App Configuration dictionary is refreshed at launch and when the app or a scene becomes active.
App Lock Bypass
When any managed app configuration is present, Vylos automatically bypasses its built-in app lock (Face ID, Touch ID, or TOTP). The assumption is that device-level authentication is already enforced by the MDM policy, so a second authentication layer inside the app is unnecessary.
Getting Started
Device-wide tunnel profiles use standard .mobileconfig VPN payloads and can be installed without MDM. Configure restriction keys through your MDM solution's Managed App Configuration channel.
Vylos treats true and 1 as true, and false and 0 as false, regardless of whether the MDM sends a boolean, number, or string. Missing or malformed values use each key's documented default.
See Managed App Configuration for the complete key contract and .mobileconfig Profiles for deployment examples.