Always-On VPN.

Always-On VPN is a managed-device feature that the operating system enforces before any application can use the network. On Windows it is delivered as a VPN profile pushed by Intune or PowerShell (the MDM VPNv2 CSP), and it distinguishes two tunnels: the device tunnel authenticates with a machine certificate over IKEv2 and connects at the login screen — so Group Policy, patching, and remote help work before anyone signs in — while the user tunnel carries the logged-in user's traffic. The device tunnel is restricted to IKEv2 with certificate authentication and to Enterprise/Education editions, which is why deployments almost always pair it with an internal PKI.

Apple iOS, iPadOS, and macOS expose VPN On Demand and Per-App VPN with the AlwaysOn flag in mobileconfig payloads, typically using IKEv2 or vendor IKEv2/WireGuard tunnels; the stricter Supervised-device "Always On VPN" payload forces even system traffic through the tunnel. Android offers a system-level Always-on VPN setting combined with "Block connections without VPN" (the kill switch); enterprise MDMs such as Workspace ONE and Intune push it fleet-wide via the Android Enterprise alwaysOnVpnPackage policy. The control stops users bypassing the corporate gateway, hardens roaming laptops against rogue "evil-twin" Wi-Fi, and underpins zero-trust designs where every session must traverse an inspected, policy-enforcing path — but it fails closed, so a misissued or expired certificate can strand a remote device offline.

flowchart TD
  A[Device powers on] --> B{Network available?}
  B -->|no| A
  B -->|yes| C[OS auto-starts VPN tunnel]
  C --> D{Machine cert valid?}
  D -->|no| E[Fail closed: block traffic]
  D -->|yes| F[Device tunnel up at login screen]
  F --> G[User signs in -> user tunnel]
  G --> H[All app traffic -> corporate gateway]
  H --> I[Inspected / policy-enforced egress]