Configure Microsoft Intune MDM

Create an Always On-VPN Profile

You must first create an Always On-VPN Profile in Intune to configure an Always-On VPN connection for Android devices.

To create an Always On-VPN Profile:

1. Log in to the Intune MDM admin portal. 
2. In the Intune admin portal, go to Devices > Android > Configuration profiles.
3. Under Policies, click Create and select New Policy. 
   
4. On the Create a profile panel, configure the following:
   • Platform. Select Android Enterprise as the platform for the profile. 
   • Profile type. Select Device restrictions as the profile type.
5. Click Create.
   

Configure VPN Profile Settings

You can now configure the settings of the newly created Always On-VPN profile.

To configure the VPN profile settings:

1. In Basics, configure the following setting:
   1. Name. Enter a descriptive name for the VPN profile.
2. Click Next.
   
3. In Configuration settings > Connectivity, configure the following VPN settings:
   1. For Fully managed, dedicated, and corporate-owned work profile devices:
      1. Always-on VPN (work profile-level). Select Enable to activate the Always-on VPN connection for your SMCS app.
      2. VPN client. Select Custom as the VPN client. 
      3. Package ID. Enter com.skyhigh.mcs as the package ID of your SMCS app.
4. Click Next.
   

Assign the VPN Profile

After configuring the settings of the newly created Always On-VPN profile, you can assign the VPN profile to users in your organization. 

To assign the VPN profile:

1. In Assignments, configure the following setting:
   1. Add groups. Click Add groups to assign the device restriction profile to Azure AD groups.
      
      1.  Select groups to include. Select the Azure AD groups from the list. These groups must include the Android devices where you want to enable the Always-On VPN connection.
2. Click Select.
   
3. In Review + create, review the configured settings of the VPN profile.

4. Click Create.
   

Once the VPN profile is created and assigned, the Always-On VPN connection is deployed and enabled on Android devices for users in the assigned groups.