Historically, enterprise Virtual Private Network (VPN) clients on macOS (such as Cisco AnyConnect, GlobalProtect, or OpenVPN) relied heavily on Kernel Extensions (kexts) to intercept and route network traffic. As Apple aggressively transitions macOS toward a more stable and secure user-space architecture, third-party kernel extensions are being systematically deprecated. To replace this legacy capability, Apple introduced the Network Extension (NE) Framework. This modern architecture allows developers to create highly performant VPN clients, content filters, and DNS proxies that execute entirely in user space. For Mac administrators managing massive fleets, configuring and deploying these Custom VPN Providers via Mobile Device Management (MDM) requires specific payload structures to ensure a seamless, user-transparent deployment.
The Architecture of macOS Network Extensions
When a developer utilizes the Network Extension framework to build a VPN client, they create an app bundle (the UI) that contains an embedded System Extension. When the user installs the app, macOS extracts the System Extension and registers it with the operating system.
Because the extension operates in user space, a crash within the VPN client will simply terminate the app, rather than triggering a catastrophic kernel panic (the dreaded “black screen”) that legacy kexts often caused. However, for security reasons, macOS fundamentally distrusts System Extensions by default. If a user manually installs a new VPN client, macOS will block the extension from loading and force the user to navigate to System Settings > Privacy & Security to explicitly approve it.
In a managed enterprise environment, forcing users to manually approve security prompts is unacceptable. You must utilize MDM to mathematically authorize the extension and configure the VPN tunnel parameters simultaneously.
Approving the System Extension via MDM
Before you can configure the VPN, you must pre-approve the developer’s cryptographic signature. This ensures macOS trusts the System Extension the moment the application is deployed.
Within your MDM (e.g., Jamf Pro or Microsoft Intune), create a System Extensions configuration profile payload.
- Payload Type:
com.apple.system-extension-policy - Allowed Team Identifiers: Enter the unique 10-character Apple Developer Team ID of your VPN vendor (e.g.,
UBF8T346G9for Microsoft, or the specific ID for Palo Alto/Cisco). - Allowed System Extensions: Enter the specific Bundle Identifier of the VPN extension (e.g.,
com.vendor.vpn.networkextension).
Deploying this profile silently authorizes the extension in the background, bypassing the user prompt.
Deploying the Custom VPN Configuration
Once the extension is trusted, you must configure macOS to actually utilize it for a VPN connection. You do this by deploying a VPN configuration profile, but rather than selecting a legacy protocol like IPsec or L2TP, you must select Custom SSL or Custom VPN.
Configure the following critical parameters in the VPN payload (com.apple.vpn.managed):
- VPN Type:
VPN - Connection Type:
Custom SSL - Identifier: This must exactly match the Bundle Identifier of the developer’s Network Extension (e.g.,
com.vendor.vpn.networkextension). This is the mathematical link instructing macOS which extension handles the traffic. - Server: The FQDN or IP address of your corporate VPN gateway (e.g.,
vpn.digitash.com). - Provider Designated Requirement (PDR): This is a highly specific cryptographic string representing the code-signing requirement of the VPN application. Your VPN vendor will provide this string in their documentation. macOS uses the PDR to guarantee that a malicious app cannot spoof the Bundle Identifier and hijack your VPN traffic.
- Custom Data (Key/Value Pairs): Most modern VPN clients require specific configuration parameters (like a portal address, SSO configuration, or tenant ID) passed directly to the extension. You input these as custom Dictionary entries within the MDM payload.
The End-User Experience
By deploying both the System Extension approval profile and the Custom VPN configuration profile, the entire onboarding process becomes frictionless. When the MDM pushes the VPN application to the Mac, the System Extension is instantly trusted and activated. The VPN configuration automatically populates in macOS Network Settings. The user simply clicks “Connect,” authenticates via SSO, and their traffic is securely routed through the user-space Network Extension, completely eliminating the instability of legacy kernel drivers.