News 
Setting up per-app VPN with Intune and GlobalProtect for secure remote access is possible and increasingly common for organizations that want fine-grained control over what apps can access the corporate network. This guide walks you through the setup, configurations, best practices, and common pitfalls so you can get your users securely connected in minutes, not hours.
Quick fact: Per-app VPN provides app-level tunnel protection, ensuring only approved apps route traffic through the VPN, while other apps stay off the corporate network.
Useful resources in plain text not clickable links:
Apple Website – apple.com, Microsoft Intune official site – docs.microsoft.com/en-us/mem/intune/, Palo Alto Networks GlobalProtect – paloaltonetworks.com/products/globalprotect, VPN security best practices – en.wikipedia.org/wiki/Virtual_private_network, Zero Trust Network Access – muy.org/zero-trust, IT admin guides – techcommunity.microsoft.com Las mejores vpn gratis para android tv box en 2026 guia completa y alternativas
- What you’ll learn: how to configure Intune per-app VPN with GlobalProtect, how to define per-app policies, how to deploy using Intune, and how to test and monitor the setup.
- Why it matters: secure remote access without exposing your entire device to the corporate network, better control over app access, and easier compliance reporting.
- Quick-start outline:
- Plan the per-app VPN architecture which apps, which networks, which user groups
- Prepare GlobalProtect with the required portal and gateway configurations
- Create and deploy Intune VPN profiles and per-app VPN policies
- Configure app-level access rules and split tunneling if needed
- Enforce user experience with single sign-on SSO and certificate-based authentication
- Validate connectivity, monitor VPN health, and adjust as required
Key takeaways:
- Per-app VPN is ideal for BYOD or mixed device environments where you want to restrict corporate access at the app level.
- GlobalProtect supports robust authentication methods, including certificates and MFA, to strengthen security.
- A well-planned policy in Intune reduces user friction while keeping security tight.
Timeline and deployment plan:
- Week 1: Design and gather app inventory, define user groups, and prepare GlobalProtect gateways.
- Week 2: Build Intune VPN profiles, per-app VPN rules, and test on a few pilot devices.
- Week 3: Expand deployment to all users, implement monitoring and incident response playbooks.
- Week 4+: Tweaks based on feedback, scale testing, and ensure ongoing maintenance.
What you’ll need
- GlobalProtect portal URL and gateway addresses
- GlobalProtect client installation method Win, macOS, iOS, Android
- Intune tenant with appropriate admin permissions
- List of apps that require VPN and their app IDs/Bundle IDs
- Certificates or a trusted CA for device and user authentication optional but recommended
- MFA setup and conditional access policies recommended
Section overview
- Part A: Design considerations and prerequisites
- Part B: GlobalProtect setup for per-app VPN
- Part C: Intune configuration for per-app VPN
- Part D: App policy creation and deployment
- Part E: User onboarding and experience
- Part F: Testing, monitoring, and troubleshooting
- Part G: Security considerations and maintenance
- Part H: Advanced tips and common pitfalls
Part A: Design considerations and prerequisites Vpn gratuita microsoft edge as melhores extensoes seguras e como instalar
- Determine scope: Which apps must go through the VPN? Which apps can access the internet directly?
- Choose a gateway model: single gateway plus a failover gateway, or multiple gateways for region-based routing.
- Decide on tunneling mode: full tunnel vs. split tunnel. In most per-app VPN scenarios, you’ll use split tunneling to route only required traffic through the VPN.
- Authentication method: certificate-based vs. username/password with MFA. Certificate-based is more seamless for users and more secure, but requires PKI management.
- Device compliance: Ensure devices are enrolled in Intune and meet minimum security requirements before VPN access is granted.
- Policy naming conventions: Keep names consistent and descriptive, e.g., per-app-vpn-globalprotect-prod-windows, per-app-vpn-ios-salesforce, etc.
- Data protection and logging: Plan how you’ll collect logs from GlobalProtect and Intune for auditing purposes.
Part B: GlobalProtect setup for per-app VPN
- Portal and gateway configuration:
- Set up a GlobalProtect portal with a resolvable DNS name and valid certificate.
- Add at least one gateway; configure gateway health checks and tunnel modes.
- Authentication:
- Enable MFA and certificate-based authentication if possible.
- Map user groups to access policies to restrict who can use the per-app VPN, and for which apps.
- App tunnel policies:
- Create per-app VPN policies by associating apps with their own internal routing policies.
- Use App IDs or FQDNs for precise tunnel routing.
- Client configuration:
- Distribute a consistent GlobalProtect profile to devices via Intune. This includes portal address, VPN type, and token/cert details.
- Security posture:
- Enforce minimum TLS versions, disable weak ciphers, enable endpoint posture checks if supported, and enable split tunneling where appropriate.
Part C: Intune configuration for per-app VPN
- Prerequisites in Intune:
- A supported Windows, macOS, iOS, or Android profile type for VPN custom profiles if needed.
- Conditional Access policies aligned with VPN use to block non-compliant devices.
- App policy configuration to specify which apps use the VPN connection.
- Create a VPN profile per-app VPN in Intune:
- Platform selection Windows/macOS/iOS/Android.
- VPN type: GlobalProtect or custom if the built-in VPN type doesn’t support per-app VPNs directly.
- Connection name: a clear, descriptive name.
- Server address/portal: the GlobalProtect portal URL.
- Authentication method: certificate-based or username/password with token, depending on your setup.
- Split tunneling: configure per your security and performance needs.
- Custom OData or OMA-DM settings for per-app VPN mappings, if your platform requires them.
- Per-app VPN associations:
- Map specific apps to use the VPN connection. On iOS and macOS, you’ll specify the app identifiers bundle IDs that should trigger the VPN when active.
- On Windows and Android, use the app-based VPN policy settings or traffic filters to enforce tunnel usage per app.
- Conditional access integration:
- Tie the VPN profile deployment to a Conditional Access policy that requires compliant devices and MFA for access to corporate resources.
- Deployment rings:
- Start with a pilot group to verify configurations, then roll out to broader user groups.
- Compliance and monitoring:
- Ensure device compliance data, VPN connection status, and audit logs feed into your SIEM or monitoring tools.
Part D: App policy creation and deployment
- Identify app list for per-app VPN:
- Email clients, collaboration tools, CRM apps, internal dashboards, and any app that handles sensitive data.
- App inventory:
- Create a detailed list with app name, platform, and identifier bundle ID or package name.
- Deploy app access rules:
- For each app, define whether VPN is mandatory, optional, or blocked if not connected to VPN.
- Profile packaging:
- Bundle VPN settings with per-app policies and ensure they are included in the deployment package for each platform.
- Update cadence:
- Regularly review app list and adjust VPN associations as apps are added or removed from the environment.
- User experience considerations:
- Provide a brief onboarding document for users explaining how VPN auto-launch works for specific apps and how to troubleshoot if the VPN doesn’t start.
Part E: User onboarding and experience
- Transparent onboarding:
- Send a guide that explains what apps use the VPN, what to expect during sign-in, and how to troubleshoot common issues.
- SSO and MFA:
- If possible, configure SSO so users only enter credentials once for both VPN and app access. Enable MFA to strengthen security.
- Troubleshooting steps:
- Common issues: VPN not starting, app unable to reach corporate resources, device compliance blocked.
- Quick checks: VPN status in the system tray, network connectivity, certificate validity, and device compliance status.
- End-user support:
- Create an internal knowledge base with step-by-step guides and quick-start videos.
Part F: Testing, monitoring, and troubleshooting Troubleshooting Sophos VPN Why It Won’t Connect and How to Fix It
- Test plan:
- Pilot group testing with a mix of devices and OS versions.
- Test scenarios: first-time VPN connect, app switch, roaming between networks, and MFA prompts.
- Monitoring:
- Use GlobalProtect admin portal analytics and Intune logs to monitor connection status, policy hits, and failure reasons.
- Implement alerting for failed connections, non-compliant devices, and unusual access patterns.
- Troubleshooting steps:
- If a user’s app isn’t tunnelled: verify app-to-VPN mapping, ensure the VPN is connected, check tunnel routing policy, and confirm the app’s traffic is intended for VPN.
- If authentication fails: verify certificates, check user group assignments, ensure MFA is functioning, and review conditional access policies.
- If performance is slow: check split tunneling rules, gateway load, and MTU settings.
Part G: Security considerations and maintenance
- Principle of least privilege:
- Only give VPN access to apps that require it. Avoid broad, blanket access.
- Certificate lifecycle:
- Plan for certificate renewal and revocation procedures. Automate where possible.
- Patching and updates:
- Keep GlobalProtect clients and Intune configurations up to date with vendor recommendations.
- Incident response:
- Prepare a runbook for VPN-related incidents, including suspected credential compromise or device loss.
- Compliance alignment:
- Align with data privacy laws and internal policies for remote access and data handling.
Part H: Advanced tips and best practices
- Use per-app VPN with zero trust principles:
- Treat each app as a separate trust boundary; require device health, app integrity, and user authentication before granting VPN access.
- Optimize for performance:
- Prefer split tunneling where safe to do so, minimize routing over VPN, and configure quality of service QoS if the network supports it.
- Automate onboarding:
- Create an end-to-end automation script for device enrollment, profile assignment, and app policy configuration to reduce manual work.
- Audit readiness:
- Enable detailed audit logs for both Intune and GlobalProtect to simplify audits and investigations.
Section: Quick reference tables
- App-to-VPN mapping examples:
- Salesforce Mobile -> VPN required
- Slack -> VPN not required for public internet access
- Outlook Mobile -> VPN required when accessing internal mail servers
- Common policy naming patterns:
- per-app-vpn-globalprotect-prod-windows
- per-app-vpn-globalprotect-ios-salesforce
- per-app-vpn-globalprotect-macos-sharepoint
Section: Testing checklist
- Validate portal and gateway reachability from managed devices
- Ensure per-app VPN maps correctly to each app
- Confirm split-tunnel behavior for non-corporate traffic
- Verify MFA prompts appear during VPN connection
- Check app data flows reach internal resources as expected
Frequently Asked Questions Thunder vpn setup for pc step by step guide and what you really need to know
What is per-app VPN and why use GlobalProtect with Intune?
Per-app VPN creates a dedicated tunnel for specific apps only, reducing exposure and improving performance. GlobalProtect with Intune lets you manage VPN profiles centrally and apply app-based rules for secure remote access.
How do I identify which apps need VPN?
Review data sensitivity and access needs. Apps that handle internal documents, CRM data, or internal dashboards typically require VPN protection.
Can I use per-app VPN on Windows and macOS?
Yes. Intune supports per-app VPN configurations across Windows and macOS with GlobalProtect, though exact steps vary by platform.
Do I need certificates for authentication?
Certificates offer strong, password-free authentication, but you can also use MFA with username/password if certificate-based auth isn’t feasible.
How do I deploy to a pilot group?
Create a single pilot group in Intune, assign the per-app VPN profile to that group, and monitor results before broad rollout. How to Create a VPN Profile in Microsoft Intune Step by Step Guide 2026: Quick Setup, Best Practices, and Troubleshooting
What about split tunneling, should I enable it?
Split tunneling is often recommended to improve performance, but you must balance it against security requirements. Enable only traffic that must go through the VPN.
How do I test per-app VPN with GlobalProtect?
Test by launching a pilot app, verify its traffic routes through the VPN, confirm internal resource access, and ensure non-VPN apps don’t route corporate traffic.
How can I monitor VPN health and usage?
Use GlobalProtect Analytics, Intune reporting, and your SIEM to monitor connection status, user activity, and policy compliance.
What if a user is on a non-compliant device?
Use Conditional Access to block access until device compliance is restored, then re-enroll and re-test VPN access.
How do I handle certificate renewal?
Automate certificate issuance and renewal where possible, and set up notification and revocation workflows for expiring certs. Лучшие vpn для microsoft edge в 2026 году полное руководство с purevpn и другими опциями для безопасности
End of FAQ
Note: For added security and performance, consider pairing this setup with a Zero Trust policy that continuously validates user, device, and app health before granting access.
Affiliate note: For enhanced security during remote work, consider NordVPN for secure personal use and add-on features, which you can explore through this option:
Sources:
国内 用什么vpn：全面教程、评测与选择指南（含最新数据与使用场景）
Surfshark vpn review reddit what users really think in 2026: Honest Take, Latest Stats, Pros, Cons, and Real-World Use Cant uninstall nordvpn heres exactly how to get rid of it for good: A complete guide to removing NordVPN from your devices
Nordvpnの値段、一番安く買う方法と注意点を全部話し: NordVPNの価格戦略と節約ガイド