Skip Navigation

Enabling and assigning per-app VPN settings

You can set up per-app VPN for
Samsung Knox
, and
devices to specify which apps on devices must use a VPN for their data in transit. Per-app VPN helps decrease the load on your organization’s VPN by enabling only certain work traffic to use the VPN (for example, accessing application servers or web pages behind the firewall). In on-premises environments, this feature also supports user privacy and increases connection speed for personal apps by not sending the personal traffic through the VPN.
App settings
Apps are associated with a VPN profile when you assign the app or app group to a user, user group, or device group.
Samsung Knox
devices with
Android Enterprise
Samsung Knox Workspace
Apps are added to the "Apps allowed to use the VPN connection" setting in the VPN profile.
Windows 10
Apps are added to the "App trigger list" setting in the VPN profile.
Only one VPN profile can be assigned to an app or app group.
BlackBerry UEM
uses the following rules to determine which per-app VPN settings to assign to an app on
Per-app VPN settings
If associated with an app directly
Takes precedence over per-app VPN settings associated indirectly by an app group.
If associated with a user directly
Take precedence over per-app VPN settings associated indirectly by a user group.
If assigned to a required app
Takes precedence over per-app VPN settings assigned to an optional instance of the same app.
If associated with the user group name that appears earlier in the alphabetical list
Takes precedence if the following conditions are met:
  • An app is assigned to multiple user groups
  • The same app appears in the user groups
  • The app is assigned in the same way, either as a single app or an app group
  • The app has the same disposition in all assignments, either required or optional
For example, you assign
Cisco WebEx Meetings
as an optional app to the user groups Development and Marketing. When a user is in both groups, the per-app VPN settings for the Development group is applied to the
WebEx Meetings
app for that user.
If a per-app VPN profile is assigned to a device group, it takes precedence over the per-app VPN profile that is assigned to the user account for any devices that belong to the device group.