Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry UEM 12.20
  3. Managing secure connections
  4. Managing work connections using profiles
  5. Enabling and assigning per-app VPN settings

Enabling and assigning per-app VPN settings

You can set up per-app VPN for
iOS
,
iPadOS
,
Samsung Knox
, and
Windows
 devices to specify which apps on devices must use a VPN for their data in transit. Per-app VPN helps decrease the load on your organization’s VPN by enabling only certain work traffic to use the VPN (for example, accessing application servers or web pages behind the firewall). In on-premises environments, this feature also supports user privacy and increases connection speed for personal apps by not sending the personal traffic through the VPN.
Devices
App settings
iOS
 and
iPadOS
Apps are associated with a VPN profile when you assign the app or app group to a user, user group, or device group.
Samsung Knox
 devices with
Android Enterprise
 and
Samsung Knox Workspace
 activations
Apps are added to the "Apps allowed to use the VPN connection" setting in the VPN profile.
Windows 10
Apps are added to the "App trigger list" setting in the VPN profile.
Only one VPN profile can be assigned to an app or app group.
BlackBerry UEM
 uses the following rules to determine which per-app VPN settings to assign to an app on
iOS
 and
iPadOS
 devices:
Per-app VPN settings
Precedence
If associated with an app directly
Takes precedence over per-app VPN settings associated indirectly by an app group.
If associated with a user directly
Take precedence over per-app VPN settings associated indirectly by a user group.
If assigned to a required app
Takes precedence over per-app VPN settings assigned to an optional instance of the same app.
If associated with the user group name that appears earlier in the alphabetical list
Takes precedence if the following conditions are met:
  • An app is assigned to multiple user groups
  • The same app appears in the user groups
  • The app is assigned in the same way, either as a single app or an app group
  • The app has the same disposition in all assignments, either required or optional
For example, you assign
Cisco WebEx Meetings
 as an optional app to the user groups Development and Marketing. When a user is in both groups, the per-app VPN settings for the Development group is applied to the
WebEx Meetings
 app for that user.
If a per-app VPN profile is assigned to a device group, it takes precedence over the per-app VPN profile that is assigned to the user account for any devices that belong to the device group.