# Virtual Private Network (VPN)

Last updated: August 14, 2026

This page explains how IT admins can configure Virtual Private Network (VPN) profiles for Windows devices managed by Mobile Device Manager Plus. It covers supported VPN types — including built-in options like L2TP, PPTP, and IKEv2, as well as plug-in VPNs such as F5 Access, Pulse Secure, SonicWall Mobile Connect, and Check Point Mobile VPN. The page also details per-app VPN configuration to restrict tunneling to corporate apps only, certificate-based authentication, and the full set of profile parameters required for each VPN type.

A Virtual Private Network (VPN) as the name suggests establishes a logical private tunnel on the Internet to ensure only authorized users can access confidential web resources of the organization from any network. VPN ensures all the device-web resource communication happens on a secure channel preventing any kind of unauthorized access. VPN also boosts productivity as it ensures employees can work from anywhere without worrying about lack of access to specific resource/data. With mobile devices extensively becoming a part of corporate productivity, it has become mandatory for IT admins to configure on VPN on mobile devices which can be easily and efficiently done using MDM.

## Per-app VPN

When a VPN is set up, all the data from the devices, including the personal data is routed through the VPN. Some organizations require a VPN to be set up only for the corporate apps in which case, the admin can make use of per-app VPN.

Configure the VPN used by your organization and specify the apps for which VPN is to be enabled.

The following built-in VPN connection types are supported by MDM:

- L2TP
- PPTP
- IKEv2

In addition to the above mentioned built-in VPNs, Mobile Device Manager Plus also supports the following plug-in VPNs. These VPN types require an additional app to be installed on the devices.

- [F5 Access](https://www.microsoft.com/en-in/p/f5-access/9wzdncrdsfn0?activetab=pivot%3Aoverviewtab)
- [Pulse Secure](https://www.microsoft.com/en-in/p/pulse-secure/9nblggh3b0bp?activetab=pivot%3Aoverviewtab)
- [SonicWall Mobile Connect](https://www.microsoft.com/en-in/p/sonicwall-mobile-connect/9wzdncrdsfkz?activetab=pivot%3Aoverviewtab)
- [Check Point Mobile VPN](https://www.microsoft.com/en-ie/p/check-point-capsule-vpn/9wzdncrdjxtj?activetab=pivot:overviewtab)

F5 Acess, Pulse Secure, SonicWALL Mobile Connect, and Check Point Mobile VPN require the corresponding third-party app to be installed in the device for setting up the VPN configuration.

## Using Certificate for Authentication

In addition to configuring VPN on the managed devices, MDM also provides you with the option of provisioning VPN on the devices using certficate as the means of authentication. Authentication, as we all know plays as a major role in establishment of VPN connection and certificate is generally considered to be much more secure form of authentication than pre-shared key. Further, in case of large VPN networks, managing large quantity of pre-shared keys can be cumbersome. Certificates in this case is a much more scalable alternative. Additionally, pre-shared keys are bound to an IP address but certificates are not bound to an IP address ensuring remote users with a dynamically assigned IP address can authenticate using identification information contained in the certificate. You can configure certificate as [explained here](https://www.manageengine.com/mobile-device-management/help/profile_management/windows/mdm_windows_certificate.html) and distribute them on a large scale as [explained here](https://www.manageengine.com/mobile-device-management/help/profile_management/windows/mdm_windows_scep.html).

## Profile Details

To configure a VPN policy, you need to configure certain common parameters and parameters specific to a VPN type. To know the parameters to be configured for a particular VPN type, click on the VPN type name from the tabs given.

## Frequently Asked Questions

**What's the difference between a built-in VPN and a plug-in VPN?**

Built-in VPN types (L2TP, PPTP, IKEv2) don't need an extra app, while plug-in VPNs such as F5 Access, Pulse Secure, SonicWall Mobile Connect, and Check Point Mobile VPN require the corresponding third-party app to be installed on the device.

**When should I use per-app VPN instead of a device-wide VPN?**

Use per-app VPN when you only need to route traffic for specific corporate apps through the VPN, instead of routing all device data, including personal data, through the tunnel.

**Why use certificates instead of a pre-shared key for VPN authentication?**

Certificates are more secure and scalable than pre-shared keys, aren't bound to an IP address, and let remote users with dynamically assigned IP addresses authenticate using the identification information in the certificate.