---
title: VPNv2 CSP
description: Learn more about the VPNv2 CSP.
ms.date: 01/18/2024
---
# VPNv2 CSP
The VPNv2 configuration service provider allows the Mobile Device Management (MDM) server to configure the VPN profile of the device.
Here are the requirements for this CSP:
- VPN configuration commands must be wrapped in an Atomic block in SyncML.
- For best results, configure your VPN certificates first before pushing down VPN profiles to devices. If you're using Windows Information Protection (WIP) (formerly known as Enterprise Data Protection), then you should configure VPN first before you configure Windows Information Protection policies.
- In certain conditions you can change some properties directly, but we don't recommend it. Instead, follow these steps to make any changes:
- Send a Delete command for the ProfileName to delete the entire profile.
- Send the entire profile again with new values wrapped in an Atomic block.
The XSDs for all EAP methods are shipped in the box and can be found at the following locations:
- `C:\Windows\schemas\EAPHost`
- `C:\Windows\schemas\EAPMethods`
The following list shows the VPNv2 configuration service provider nodes:
- ./Device/Vendor/MSFT/VPNv2
- [{ProfileName}](#deviceprofilename)
- [AlwaysOn](#deviceprofilenamealwayson)
- [AlwaysOnActive](#deviceprofilenamealwaysonactive)
- [APNBinding](#deviceprofilenameapnbinding)
- [AccessPointName](#deviceprofilenameapnbindingaccesspointname)
- [AuthenticationType](#deviceprofilenameapnbindingauthenticationtype)
- [IsCompressionEnabled](#deviceprofilenameapnbindingiscompressionenabled)
- [Password](#deviceprofilenameapnbindingpassword)
- [ProviderId](#deviceprofilenameapnbindingproviderid)
- [UserName](#deviceprofilenameapnbindingusername)
- [AppTriggerList](#deviceprofilenameapptriggerlist)
- [{appTriggerRowId}](#deviceprofilenameapptriggerlistapptriggerrowid)
- [App](#deviceprofilenameapptriggerlistapptriggerrowidapp)
- [Id](#deviceprofilenameapptriggerlistapptriggerrowidappid)
- [Type](#deviceprofilenameapptriggerlistapptriggerrowidapptype)
- [ByPassForLocal](#deviceprofilenamebypassforlocal)
- [DataEncryption](#deviceprofilenamedataencryption)
- [DeviceCompliance](#deviceprofilenamedevicecompliance)
- [Enabled](#deviceprofilenamedevicecomplianceenabled)
- [Sso](#deviceprofilenamedevicecompliancesso)
- [Eku](#deviceprofilenamedevicecompliancessoeku)
- [Enabled](#deviceprofilenamedevicecompliancessoenabled)
- [IssuerHash](#deviceprofilenamedevicecompliancessoissuerhash)
- [DeviceTunnel](#deviceprofilenamedevicetunnel)
- [DisableAdvancedOptionsEditButton](#deviceprofilenamedisableadvancedoptionseditbutton)
- [DisableDisconnectButton](#deviceprofilenamedisabledisconnectbutton)
- [DisableIKEv2Fragmentation](#deviceprofilenamedisableikev2fragmentation)
- [DnsSuffix](#deviceprofilenamednssuffix)
- [DomainNameInformationList](#deviceprofilenamedomainnameinformationlist)
- [{dniRowId}](#deviceprofilenamedomainnameinformationlistdnirowid)
- [AutoTrigger](#deviceprofilenamedomainnameinformationlistdnirowidautotrigger)
- [DnsServers](#deviceprofilenamedomainnameinformationlistdnirowiddnsservers)
- [DomainName](#deviceprofilenamedomainnameinformationlistdnirowiddomainname)
- [DomainNameType](#deviceprofilenamedomainnameinformationlistdnirowiddomainnametype)
- [Persistent](#deviceprofilenamedomainnameinformationlistdnirowidpersistent)
- [WebProxyServers](#deviceprofilenamedomainnameinformationlistdnirowidwebproxyservers)
- [EdpModeId](#deviceprofilenameedpmodeid)
- [IPv4InterfaceMetric](#deviceprofilenameipv4interfacemetric)
- [IPv6InterfaceMetric](#deviceprofilenameipv6interfacemetric)
- [NativeProfile](#deviceprofilenamenativeprofile)
- [Authentication](#deviceprofilenamenativeprofileauthentication)
- [Certificate](#deviceprofilenamenativeprofileauthenticationcertificate)
- [Eku](#deviceprofilenamenativeprofileauthenticationcertificateeku)
- [Issuer](#deviceprofilenamenativeprofileauthenticationcertificateissuer)
- [Eap](#deviceprofilenamenativeprofileauthenticationeap)
- [Configuration](#deviceprofilenamenativeprofileauthenticationeapconfiguration)
- [Type](#deviceprofilenamenativeprofileauthenticationeaptype)
- [MachineMethod](#deviceprofilenamenativeprofileauthenticationmachinemethod)
- [UserMethod](#deviceprofilenamenativeprofileauthenticationusermethod)
- [CryptographySuite](#deviceprofilenamenativeprofilecryptographysuite)
- [AuthenticationTransformConstants](#deviceprofilenamenativeprofilecryptographysuiteauthenticationtransformconstants)
- [CipherTransformConstants](#deviceprofilenamenativeprofilecryptographysuiteciphertransformconstants)
- [DHGroup](#deviceprofilenamenativeprofilecryptographysuitedhgroup)
- [EncryptionMethod](#deviceprofilenamenativeprofilecryptographysuiteencryptionmethod)
- [IntegrityCheckMethod](#deviceprofilenamenativeprofilecryptographysuiteintegritycheckmethod)
- [PfsGroup](#deviceprofilenamenativeprofilecryptographysuitepfsgroup)
- [DisableClassBasedDefaultRoute](#deviceprofilenamenativeprofiledisableclassbaseddefaultroute)
- [L2tpPsk](#deviceprofilenamenativeprofilel2tppsk)
- [NativeProtocolType](#deviceprofilenamenativeprofilenativeprotocoltype)
- [PlumbIKEv2TSAsRoutes](#deviceprofilenamenativeprofileplumbikev2tsasroutes)
- [ProtocolList](#deviceprofilenamenativeprofileprotocollist)
- [NativeProtocolList](#deviceprofilenamenativeprofileprotocollistnativeprotocollist)
- [{NativeProtocolRowId}](#deviceprofilenamenativeprofileprotocollistnativeprotocollistnativeprotocolrowid)
- [Type](#deviceprofilenamenativeprofileprotocollistnativeprotocollistnativeprotocolrowidtype)
- [RetryTimeInHours](#deviceprofilenamenativeprofileprotocollistretrytimeinhours)
- [RoutingPolicyType](#deviceprofilenamenativeprofileroutingpolicytype)
- [Servers](#deviceprofilenamenativeprofileservers)
- [NetworkOutageTime](#deviceprofilenamenetworkoutagetime)
- [PluginProfile](#deviceprofilenamepluginprofile)
- [CustomConfiguration](#deviceprofilenamepluginprofilecustomconfiguration)
- [PluginPackageFamilyName](#deviceprofilenamepluginprofilepluginpackagefamilyname)
- [ServerUrlList](#deviceprofilenamepluginprofileserverurllist)
- [PrivateNetwork](#deviceprofilenameprivatenetwork)
- [ProfileXML](#deviceprofilenameprofilexml)
- [Proxy](#deviceprofilenameproxy)
- [AutoConfigUrl](#deviceprofilenameproxyautoconfigurl)
- [Manual](#deviceprofilenameproxymanual)
- [Server](#deviceprofilenameproxymanualserver)
- [RegisterDNS](#deviceprofilenameregisterdns)
- [RememberCredentials](#deviceprofilenameremembercredentials)
- [RouteList](#deviceprofilenameroutelist)
- [{routeRowId}](#deviceprofilenameroutelistrouterowid)
- [Address](#deviceprofilenameroutelistrouterowidaddress)
- [ExclusionRoute](#deviceprofilenameroutelistrouterowidexclusionroute)
- [Metric](#deviceprofilenameroutelistrouterowidmetric)
- [PrefixSize](#deviceprofilenameroutelistrouterowidprefixsize)
- [TrafficFilterList](#deviceprofilenametrafficfilterlist)
- [{trafficFilterId}](#deviceprofilenametrafficfilterlisttrafficfilterid)
- [App](#deviceprofilenametrafficfilterlisttrafficfilteridapp)
- [Id](#deviceprofilenametrafficfilterlisttrafficfilteridappid)
- [Type](#deviceprofilenametrafficfilterlisttrafficfilteridapptype)
- [Claims](#deviceprofilenametrafficfilterlisttrafficfilteridclaims)
- [Direction](#deviceprofilenametrafficfilterlisttrafficfilteriddirection)
- [LocalAddressRanges](#deviceprofilenametrafficfilterlisttrafficfilteridlocaladdressranges)
- [LocalPortRanges](#deviceprofilenametrafficfilterlisttrafficfilteridlocalportranges)
- [Protocol](#deviceprofilenametrafficfilterlisttrafficfilteridprotocol)
- [RemoteAddressRanges](#deviceprofilenametrafficfilterlisttrafficfilteridremoteaddressranges)
- [RemotePortRanges](#deviceprofilenametrafficfilterlisttrafficfilteridremoteportranges)
- [RoutingPolicyType](#deviceprofilenametrafficfilterlisttrafficfilteridroutingpolicytype)
- [TrustedNetworkDetection](#deviceprofilenametrustednetworkdetection)
- [UseRasCredentials](#deviceprofilenameuserascredentials)
- ./User/Vendor/MSFT/VPNv2
- [{ProfileName}](#userprofilename)
- [AlwaysOn](#userprofilenamealwayson)
- [AlwaysOnActive](#userprofilenamealwaysonactive)
- [APNBinding](#userprofilenameapnbinding)
- [AccessPointName](#userprofilenameapnbindingaccesspointname)
- [AuthenticationType](#userprofilenameapnbindingauthenticationtype)
- [IsCompressionEnabled](#userprofilenameapnbindingiscompressionenabled)
- [Password](#userprofilenameapnbindingpassword)
- [ProviderId](#userprofilenameapnbindingproviderid)
- [UserName](#userprofilenameapnbindingusername)
- [AppTriggerList](#userprofilenameapptriggerlist)
- [{appTriggerRowId}](#userprofilenameapptriggerlistapptriggerrowid)
- [App](#userprofilenameapptriggerlistapptriggerrowidapp)
- [Id](#userprofilenameapptriggerlistapptriggerrowidappid)
- [Type](#userprofilenameapptriggerlistapptriggerrowidapptype)
- [ByPassForLocal](#userprofilenamebypassforlocal)
- [DataEncryption](#userprofilenamedataencryption)
- [DeviceCompliance](#userprofilenamedevicecompliance)
- [Enabled](#userprofilenamedevicecomplianceenabled)
- [Sso](#userprofilenamedevicecompliancesso)
- [Eku](#userprofilenamedevicecompliancessoeku)
- [Enabled](#userprofilenamedevicecompliancessoenabled)
- [IssuerHash](#userprofilenamedevicecompliancessoissuerhash)
- [DisableAdvancedOptionsEditButton](#userprofilenamedisableadvancedoptionseditbutton)
- [DisableDisconnectButton](#userprofilenamedisabledisconnectbutton)
- [DisableIKEv2Fragmentation](#userprofilenamedisableikev2fragmentation)
- [DnsSuffix](#userprofilenamednssuffix)
- [DomainNameInformationList](#userprofilenamedomainnameinformationlist)
- [{dniRowId}](#userprofilenamedomainnameinformationlistdnirowid)
- [AutoTrigger](#userprofilenamedomainnameinformationlistdnirowidautotrigger)
- [DnsServers](#userprofilenamedomainnameinformationlistdnirowiddnsservers)
- [DomainName](#userprofilenamedomainnameinformationlistdnirowiddomainname)
- [DomainNameType](#userprofilenamedomainnameinformationlistdnirowiddomainnametype)
- [Persistent](#userprofilenamedomainnameinformationlistdnirowidpersistent)
- [WebProxyServers](#userprofilenamedomainnameinformationlistdnirowidwebproxyservers)
- [EdpModeId](#userprofilenameedpmodeid)
- [IPv4InterfaceMetric](#userprofilenameipv4interfacemetric)
- [IPv6InterfaceMetric](#userprofilenameipv6interfacemetric)
- [NativeProfile](#userprofilenamenativeprofile)
- [Authentication](#userprofilenamenativeprofileauthentication)
- [Certificate](#userprofilenamenativeprofileauthenticationcertificate)
- [Eku](#userprofilenamenativeprofileauthenticationcertificateeku)
- [Issuer](#userprofilenamenativeprofileauthenticationcertificateissuer)
- [Eap](#userprofilenamenativeprofileauthenticationeap)
- [Configuration](#userprofilenamenativeprofileauthenticationeapconfiguration)
- [Type](#userprofilenamenativeprofileauthenticationeaptype)
- [MachineMethod](#userprofilenamenativeprofileauthenticationmachinemethod)
- [UserMethod](#userprofilenamenativeprofileauthenticationusermethod)
- [CryptographySuite](#userprofilenamenativeprofilecryptographysuite)
- [AuthenticationTransformConstants](#userprofilenamenativeprofilecryptographysuiteauthenticationtransformconstants)
- [CipherTransformConstants](#userprofilenamenativeprofilecryptographysuiteciphertransformconstants)
- [DHGroup](#userprofilenamenativeprofilecryptographysuitedhgroup)
- [EncryptionMethod](#userprofilenamenativeprofilecryptographysuiteencryptionmethod)
- [IntegrityCheckMethod](#userprofilenamenativeprofilecryptographysuiteintegritycheckmethod)
- [PfsGroup](#userprofilenamenativeprofilecryptographysuitepfsgroup)
- [DisableClassBasedDefaultRoute](#userprofilenamenativeprofiledisableclassbaseddefaultroute)
- [L2tpPsk](#userprofilenamenativeprofilel2tppsk)
- [NativeProtocolType](#userprofilenamenativeprofilenativeprotocoltype)
- [PlumbIKEv2TSAsRoutes](#userprofilenamenativeprofileplumbikev2tsasroutes)
- [ProtocolList](#userprofilenamenativeprofileprotocollist)
- [NativeProtocolList](#userprofilenamenativeprofileprotocollistnativeprotocollist)
- [{NativeProtocolRowId}](#userprofilenamenativeprofileprotocollistnativeprotocollistnativeprotocolrowid)
- [Type](#userprofilenamenativeprofileprotocollistnativeprotocollistnativeprotocolrowidtype)
- [RetryTimeInHours](#userprofilenamenativeprofileprotocollistretrytimeinhours)
- [RoutingPolicyType](#userprofilenamenativeprofileroutingpolicytype)
- [Servers](#userprofilenamenativeprofileservers)
- [NetworkOutageTime](#userprofilenamenetworkoutagetime)
- [PluginProfile](#userprofilenamepluginprofile)
- [CustomConfiguration](#userprofilenamepluginprofilecustomconfiguration)
- [PluginPackageFamilyName](#userprofilenamepluginprofilepluginpackagefamilyname)
- [ServerUrlList](#userprofilenamepluginprofileserverurllist)
- [PrivateNetwork](#userprofilenameprivatenetwork)
- [ProfileXML](#userprofilenameprofilexml)
- [Proxy](#userprofilenameproxy)
- [AutoConfigUrl](#userprofilenameproxyautoconfigurl)
- [Manual](#userprofilenameproxymanual)
- [Server](#userprofilenameproxymanualserver)
- [RegisterDNS](#userprofilenameregisterdns)
- [RememberCredentials](#userprofilenameremembercredentials)
- [RequireVpnClientAppUI](#userprofilenamerequirevpnclientappui)
- [RouteList](#userprofilenameroutelist)
- [{routeRowId}](#userprofilenameroutelistrouterowid)
- [Address](#userprofilenameroutelistrouterowidaddress)
- [ExclusionRoute](#userprofilenameroutelistrouterowidexclusionroute)
- [Metric](#userprofilenameroutelistrouterowidmetric)
- [PrefixSize](#userprofilenameroutelistrouterowidprefixsize)
- [TrafficFilterList](#userprofilenametrafficfilterlist)
- [{trafficFilterId}](#userprofilenametrafficfilterlisttrafficfilterid)
- [App](#userprofilenametrafficfilterlisttrafficfilteridapp)
- [Id](#userprofilenametrafficfilterlisttrafficfilteridappid)
- [Type](#userprofilenametrafficfilterlisttrafficfilteridapptype)
- [Claims](#userprofilenametrafficfilterlisttrafficfilteridclaims)
- [Direction](#userprofilenametrafficfilterlisttrafficfilteriddirection)
- [LocalAddressRanges](#userprofilenametrafficfilterlisttrafficfilteridlocaladdressranges)
- [LocalPortRanges](#userprofilenametrafficfilterlisttrafficfilteridlocalportranges)
- [Protocol](#userprofilenametrafficfilterlisttrafficfilteridprotocol)
- [RemoteAddressRanges](#userprofilenametrafficfilterlisttrafficfilteridremoteaddressranges)
- [RemotePortRanges](#userprofilenametrafficfilterlisttrafficfilteridremoteportranges)
- [RoutingPolicyType](#userprofilenametrafficfilterlisttrafficfilteridroutingpolicytype)
- [TrustedNetworkDetection](#userprofilenametrustednetworkdetection)
- [UseRasCredentials](#userprofilenameuserascredentials)
## Device/{ProfileName}
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}
```
Unique alpha numeric identifier for the profile. The profile name mustn't include a forward slash (/). If the profile name has a space or other non-alphanumeric character, it must be properly escaped according to the URL encoding standard.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Delete, Get, Replace |
| Atomic Required | True |
| Dynamic Node Naming | ServerGeneratedUniqueIdentifier |
| Allowed Values | Regular Expression: `^[^/]*$` |
### Device/{ProfileName}/AlwaysOn
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/AlwaysOn
```
An optional flag to enable Always On mode. This will automatically connect the VPN at sign-in and will stay connected until the user manually disconnects.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | false |
**Allowed values**:
| Value | Description |
|:--|:--|
| false (Default) | Always On is turned off. |
| true | Always On is turned on. |
### Device/{ProfileName}/AlwaysOnActive
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/AlwaysOnActive
```
An optional flag to activate Always On mode. This is true by default if AlwaysOn is true. Setting controls whether "Connect Automatically" is toggled on profile creation.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 1 |
**Allowed values**:
| Value | Description |
|:--|:--|
| 0 | Always On is inactive. |
| 1 (Default) | Always On is activated on provisioning. |
### Device/{ProfileName}/APNBinding
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/APNBinding
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
#### Device/{ProfileName}/APNBinding/AccessPointName
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/APNBinding/AccessPointName
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### Device/{ProfileName}/APNBinding/AuthenticationType
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/APNBinding/AuthenticationType
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### Device/{ProfileName}/APNBinding/IsCompressionEnabled
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/APNBinding/IsCompressionEnabled
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
#### Device/{ProfileName}/APNBinding/Password
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/APNBinding/Password
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### Device/{ProfileName}/APNBinding/ProviderId
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/APNBinding/ProviderId
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### Device/{ProfileName}/APNBinding/UserName
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/APNBinding/UserName
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### Device/{ProfileName}/AppTriggerList
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/AppTriggerList
```
List of applications set to trigger the VPN. If any of these apps are launched and the VPN Profile is currently the active Profile, this VPN Profile will be triggered to connect.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
#### Device/{ProfileName}/AppTriggerList/{appTriggerRowId}
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/AppTriggerList/{appTriggerRowId}
```
A sequential integer identifier which allows the ability to specify multiple apps for App Trigger. Sequencing must start at 0 and you shouldn't skip numbers.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Delete, Get |
| Dynamic Node Naming | UniqueName: A sequential integer identifier which allows the ability to specify multiple apps for App Trigger. Sequencing must start at 0 and you should not skip numbers. |
##### Device/{ProfileName}/AppTriggerList/{appTriggerRowId}/App
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/AppTriggerList/{appTriggerRowId}/App
```
App Node under the Row Id.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
###### Device/{ProfileName}/AppTriggerList/{appTriggerRowId}/App/Id
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/AppTriggerList/{appTriggerRowId}/App/Id
```
App Identity. Specified, based on the Type Field.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
###### Device/{ProfileName}/AppTriggerList/{appTriggerRowId}/App/Type
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/AppTriggerList/{appTriggerRowId}/App/Type
```
Returns the type of App/Id. This value can be either of the following: PackageFamilyName - When this is returned, the App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of the Microsoft Store application. FilePath - When this is returned, the App/Id value represents the full file path of the app. For example, C:\Windows\System\Notepad.exe.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Get |
### Device/{ProfileName}/ByPassForLocal
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/ByPassForLocal
```
False: Don't Bypass for Local traffic.
True: ByPass VPN Interface for Local Traffic.
Optional. When this setting is True, requests to local resources that are available on the same Wi-Fi network as the VPN client can bypass the VPN. For example, if enterprise policy for VPN requires force tunnel for VPN, but enterprise intends to allow the remote user to connect locally to media center in their home, then this option should be set to True. The user can bypass VPN for local subnet traffic. When this is set to False, the setting is disabled and no subnet exceptions are allowed.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
### Device/{ProfileName}/DataEncryption
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DataEncryption
```
Determines the level of data encryption required for the connection.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
| Default Value | Require |
**Allowed values**:
| Value | Description |
|:--|:--|
| None | No Data Encryption required. |
| Require (Default) | Data Encryption required. |
| Max | Maximum-strength Data Encryption required. |
| Optional | Perform encryption if possible. |
### Device/{ProfileName}/DeviceCompliance
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DeviceCompliance
```
Nodes under DeviceCompliance can be used to enable Microsoft Entra ID based Conditional Access for VPN.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Get |
#### Device/{ProfileName}/DeviceCompliance/Enabled
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DeviceCompliance/Enabled
```
Enables the Device Compliance flow from the client. If marked as True, the VPN Client will attempt to communicate with Microsoft Entra ID to get a certificate to use for authentication. The VPN should be set up to use Certificate Auth and the VPN Server must trust the Server returned by Microsoft Entra ID.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | Disabled. |
| true | Enabled. |
#### Device/{ProfileName}/DeviceCompliance/Sso
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DeviceCompliance/Sso
```
Nodes under SSO can be used to choose a certificate different from the VPN Authentication cert for the Kerberos Authentication in the case of Device Compliance.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Get |
##### Device/{ProfileName}/DeviceCompliance/Sso/Eku
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DeviceCompliance/Sso/Eku
```
Comma Separated list of EKU's for the VPN Client to look for the correct certificate for Kerberos Authentication.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### Device/{ProfileName}/DeviceCompliance/Sso/Enabled
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DeviceCompliance/Sso/Enabled
```
If this field is set to True the VPN Client will look for a separate certificate for Kerberos Authentication.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | Disabled. |
| true | Enabled. |
##### Device/{ProfileName}/DeviceCompliance/Sso/IssuerHash
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DeviceCompliance/Sso/IssuerHash
```
Comma Separated list of Issuer Hashes for the VPN Client to look for the correct certificate for Kerberos Authentication.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### Device/{ProfileName}/DeviceTunnel
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1709 [10.0.16299] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DeviceTunnel
```
If turned on a device tunnel profile does four things.
First, it automatically becomes an always on profile.
Second, it doesn't require the presence or logging in of any user to the machine in order for it to connect.
Third, no other Device Tunnel profile maybe be present on the same machine.
A device tunnel profile must be deleted before another device tunnel profile can be added, removed, or connected.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | false |
**Allowed values**:
| Value | Description |
|:--|:--|
| false (Default) | This isn't a device tunnel profile. |
| true | This is a device tunnel profile. |
### Device/{ProfileName}/DisableAdvancedOptionsEditButton
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DisableAdvancedOptionsEditButton
```
Optional. When this setting is True, the Advanced Options page will have its edit functions disabled, only allowing viewing and Clear Sign-In Info.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | Advanced Options Edit Button is available. |
| true | Advanced Options Edit Button is unavailable. |
### Device/{ProfileName}/DisableDisconnectButton
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DisableDisconnectButton
```
Optional. When this setting is True, the Disconnect button won't be visible for connected profiles.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | Disconnect Button is visible. |
| true | Disconnect Button isn't visible. |
### Device/{ProfileName}/DisableIKEv2Fragmentation
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DisableIKEv2Fragmentation
```
Set to disable IKEv2 Fragmentation.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | false |
**Allowed values**:
| Value | Description |
|:--|:--|
| true | IKEv2 Fragmentation won't be used. |
| false (Default) | IKEv2 Fragmentation is used as normal. |
### Device/{ProfileName}/DnsSuffix
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DnsSuffix
```
Specifies one or more comma separated DNS suffixes. The first in the list is also used as the primary connection specific DNS suffix for the VPN Interface. The entire list will also be added into the SuffixSearchList.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### Device/{ProfileName}/DomainNameInformationList
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList
```
NRPT ([Name Resolution Policy Table](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn593632(v=ws.11))) Rules for the VPN Profile.
> [!NOTE]
> Only applications using the [Windows DNS API](/windows/win32/dns/dns-reference) can make use of the NRPT and therefore all settings configured within the DomainNameInformationList section. Applications using their own DNS implementation bypass the Windows DNS API. One example of applications not using the Windows DNS API is nslookup, so always use the PowerShell CmdLet [Resolve-DNSName](/powershell/module/dnsclient/resolve-dnsname) to check the functionality of the NRPT.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
#### Device/{ProfileName}/DomainNameInformationList/{dniRowId}
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList/{dniRowId}
```
A sequential integer identifier for the Domain Name information. Sequencing must start at 0.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Delete, Get |
| Dynamic Node Naming | UniqueName: A sequential integer identifier for the Domain Name information. Sequencing must start at 0. |
##### Device/{ProfileName}/DomainNameInformationList/{dniRowId}/AutoTrigger
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList/{dniRowId}/AutoTrigger
```
Boolean to determine whether this domain name rule will trigger the VPN.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | false |
**Allowed values**:
| Value | Description |
|:--|:--|
| false (Default) | This DomainName rule won't trigger the VPN. |
| true | This DomainName rule will trigger the VPN. |
##### Device/{ProfileName}/DomainNameInformationList/{dniRowId}/DnsServers
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList/{dniRowId}/DnsServers
```
Comma Seperated list of IP addresses for the DNS Servers to use for the domain name.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### Device/{ProfileName}/DomainNameInformationList/{dniRowId}/DomainName
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList/{dniRowId}/DomainName
```
Used to indicate the namespace to which the policy applies. When a Name query is issued, the DNS client compares the name in the query to all of the namespaces under DomainNameInformationList to find a match. This parameter can be one of the following types: FQDN - Fully qualified domain name. Suffix - A domain suffix that will be appended to the shortname query for DNS resolution. To specify a suffix, prepend a . to the DNS suffix.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### Device/{ProfileName}/DomainNameInformationList/{dniRowId}/DomainNameType
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList/{dniRowId}/DomainNameType
```
Returns the namespace type. This value can be one of the following: FQDN - If the DomainName wasn't prepended with a . and applies only to the fully qualified domain name (FQDN) of a specified host. Suffix - If the DomainName was prepended with a . and applies to the specified namespace, all records in that namespace, and all subdomains.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Get |
##### Device/{ProfileName}/DomainNameInformationList/{dniRowId}/Persistent
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList/{dniRowId}/Persistent
```
A boolean value that specifies if the rule being added should persist even when the VPN isn't connected.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | false |
**Allowed values**:
| Value | Description |
|:--|:--|
| false (Default) | This DomainName rule will only be applied when VPN is connected. |
| true | This DomainName rule will always be present and applied. |
##### Device/{ProfileName}/DomainNameInformationList/{dniRowId}/WebProxyServers
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList/{dniRowId}/WebProxyServers
```
Web Proxy Server IP address if you are redirecting traffic through your intranet.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### Device/{ProfileName}/EdpModeId
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/EdpModeId
```
Enterprise ID, which is required for connecting this VPN profile with a WIP policy. When this is set, the networking stack looks for this Enterprise ID in the app token to determine if the traffic is allowed to go over the VPN. If the profile is active, it also automatically triggers the VPN to connect. We recommend having only one such profile per device.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### Device/{ProfileName}/IPv4InterfaceMetric
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/IPv4InterfaceMetric
```
The metric for the IPv4 interface.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | Range: `[1-9999]` |
### Device/{ProfileName}/IPv6InterfaceMetric
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/IPv6InterfaceMetric
```
The metric for the IPv6 interface.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | Range: `[1-9999]` |
### Device/{ProfileName}/NativeProfile
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile
```
Nodes under NativeProfile are required when using a Windows Inbox VPN Protocol (IKEv2, PPTP, L2TP, SSTP).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Get |
#### Device/{ProfileName}/NativeProfile/Authentication
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication
```
Required node for native profile. It contains authentication information for the native VPN profile.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
##### Device/{ProfileName}/NativeProfile/Authentication/Certificate
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/Certificate
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
###### Device/{ProfileName}/NativeProfile/Authentication/Certificate/Eku
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/Certificate/Eku
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
###### Device/{ProfileName}/NativeProfile/Authentication/Certificate/Issuer
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/Certificate/Issuer
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### Device/{ProfileName}/NativeProfile/Authentication/Eap
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/Eap
```
Required when the native profile specifies EAP authentication. EAP configuration XML.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
###### Device/{ProfileName}/NativeProfile/Authentication/Eap/Configuration
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/Eap/Configuration
```
HTML encoded XML of the EAP configuration. For more information,see [EAP configuration](eap-configuration.md).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
###### Device/{ProfileName}/NativeProfile/Authentication/Eap/Type
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/Eap/Type
```
Required node for EAP profiles. This specifies the EAP Type ID
13 = EAP-TLS
26 = Ms-Chapv2
27 = Peap.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
##### Device/{ProfileName}/NativeProfile/Authentication/MachineMethod
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/MachineMethod
```
This is only supported in IKEv2.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| Certificate | Certificate. |
##### Device/{ProfileName}/NativeProfile/Authentication/UserMethod
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/UserMethod
```
Type of user authentication.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| EAP | EAP. |
| MSChapv2 | MSChapv2: This isn't supported for IKEv2. |
#### Device/{ProfileName}/NativeProfile/CryptographySuite
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/CryptographySuite
```
Properties of IPSec tunnels.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
##### Device/{ProfileName}/NativeProfile/CryptographySuite/AuthenticationTransformConstants
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/CryptographySuite/AuthenticationTransformConstants
```
Type of authentication transform constant.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| MD596 | MD596. |
| SHA196 | SHA196. |
| SHA256128 | SHA256128. |
| GCMAES128 | GCMAES128. |
| GCMAES192 | GCMAES192. |
| GCMAES256 | GCMAES256. |
##### Device/{ProfileName}/NativeProfile/CryptographySuite/CipherTransformConstants
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/CryptographySuite/CipherTransformConstants
```
Type of Cipher transform constant.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| DES | DES. |
| DES3 | DES3. |
| AES128 | AES128. |
| AES192 | AES192. |
| AES256 | AES256. |
| GCMAES128 | GCMAES128. |
| GCMAES192 | GCMAES192. |
| GCMAES256 | GCMAES256. |
##### Device/{ProfileName}/NativeProfile/CryptographySuite/DHGroup
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/CryptographySuite/DHGroup
```
Group used for DH (Diffie-Hellman).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| None | None. |
| Group1 | Group1. |
| Group2 | Group2. |
| Group14 | Group14. |
| ECP256 | ECP256. |
| ECP384 | ECP384. |
| Group24 | Group24. |
##### Device/{ProfileName}/NativeProfile/CryptographySuite/EncryptionMethod
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/CryptographySuite/EncryptionMethod
```
Type of encryption method.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| DES | DES. |
| DES3 | DES3. |
| AES128 | AES128. |
| AES192 | AES192. |
| AES256 | AES256. |
| AES_GCM_128 | AES_GCM_128. |
| AES_GCM_256 | AES_GCM_256. |
##### Device/{ProfileName}/NativeProfile/CryptographySuite/IntegrityCheckMethod
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/CryptographySuite/IntegrityCheckMethod
```
Type of integrity check.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| MD5 | MD5. |
| SHA196 | SHA196. |
| SHA256 | SHA256. |
| SHA384 | SHA384. |
##### Device/{ProfileName}/NativeProfile/CryptographySuite/PfsGroup
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/CryptographySuite/PfsGroup
```
Group used for PFS (Perfect Forward Secrecy).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| None | None. |
| PFS1 | PFS1. |
| PFS2 | PFS2. |
| PFS2048 | PFS2048. |
| ECP256 | ECP256. |
| ECP384 | ECP384. |
| PFSMM | PFSMM. |
| PFS24 | PFS24. |
#### Device/{ProfileName}/NativeProfile/DisableClassBasedDefaultRoute
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/DisableClassBasedDefaultRoute
```
Specifies the class based default routes. For example, if the interface IP begins with 10, it assumes a class a IP and pushes the route to 10.0.0.0/8.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | Enabled. |
| true | Disabled. |
#### Device/{ProfileName}/NativeProfile/L2tpPsk
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/L2tpPsk
```
The preshared key used for an L2TP connection.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### Device/{ProfileName}/NativeProfile/NativeProtocolType
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/NativeProtocolType
```
Required for native profiles. Type of tunneling protocol used.
> [!NOTE]
> For a Device Tunnel, use IKEv2 only.
> For a User Tunnel, any value is allowed.
> Using ProtocolList as value in NativeProtocolType requires additional configuration of the NativeProfile/ProtocolList parameter.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| PPTP | PPTP. |
| L2TP | L2TP. |
| IKEv2 | IKEv2. |
| Automatic | Automatic. |
| SSTP | SSTP. |
| ProtocolList | ProtocolList. |
#### Device/{ProfileName}/NativeProfile/PlumbIKEv2TSAsRoutes
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/PlumbIKEv2TSAsRoutes
```
True: Plumb traffic selectors as routes onto VPN interface, False: Don't plumb traffic selectors as routes.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
#### Device/{ProfileName}/NativeProfile/ProtocolList
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20207] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/ProtocolList
```
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
##### Device/{ProfileName}/NativeProfile/ProtocolList/NativeProtocolList
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20207] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/ProtocolList/NativeProtocolList
```
List of inbox VPN protocols in priority order.
> [!NOTE]
> For a User Tunnel up to 4 VPN protocols are supported.
> A separate entry is needed for every VPN protocol. For a sample format, see [Examples](#examples).
> For a Device tunnel, we recommend using IKEv2 in NativeProtocolType instead of ProtocolList.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
###### Device/{ProfileName}/NativeProfile/ProtocolList/NativeProtocolList/{NativeProtocolRowId}
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20207] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/ProtocolList/NativeProtocolList/{NativeProtocolRowId}
```
> [!NOTE]
> A separate entry is needed for every VPN protocol. For a sample format, see [Examples](#examples).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Delete, Get |
###### Device/{ProfileName}/NativeProfile/ProtocolList/NativeProtocolList/{NativeProtocolRowId}/Type
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20207] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/ProtocolList/NativeProtocolList/{NativeProtocolRowId}/Type
```
Inbox VPN protocols type.
> [!NOTE]
> A separate entry is needed for every VPN protocol. For a sample format, see [Examples](#examples).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| Pptp | Pptp. |
| L2tp | L2tp. |
| Ikev2 | Ikev2. |
| Sstp | Sstp. |
##### Device/{ProfileName}/NativeProfile/ProtocolList/RetryTimeInHours
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20207] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/ProtocolList/RetryTimeInHours
```
Default 168, max 500000.
RetryTimeInHours specifies the length of time Windows tries to use the last successful protocol when making a new connection. Setting this value to 0 disables remembering the last successful protocol.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
#### Device/{ProfileName}/NativeProfile/RoutingPolicyType
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/RoutingPolicyType
```
Type of routing policy.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| SplitTunnel | Traffic can go over any interface as determined by the networking stack. |
| ForceTunnel | All IP traffic must go over the VPN interface. |
#### Device/{ProfileName}/NativeProfile/Servers
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Servers
```
Required for native profiles. Public or routable IP address or DNS name for the VPN gateway. It can point to the external IP of a gateway or a virtual IP for a server farm. Examples, 208.147.66.130 or vpn.contoso.com The name can be a server name plus a friendly name separated with a semi-colon. For example, server2.example.com;server2FriendlyName. When you get the value, the return will include both the server name and the friendly name; if no friendly name had been supplied it will default to the server name. You can make a list of server by making a list of server names (with optional friendly names) separated by commas. For example, server1.example.com,server2.example.com.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### Device/{ProfileName}/NetworkOutageTime
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/NetworkOutageTime
```
The amount of time in seconds the network is allowed to idle. 0 means no limit.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | Range: `[0-4294967295]` |
### Device/{ProfileName}/PluginProfile
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/PluginProfile
```
Nodes under the PluginProfile are required when using a Microsoft Store based VPN plugin.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Get |
#### Device/{ProfileName}/PluginProfile/CustomConfiguration
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/PluginProfile/CustomConfiguration
```
Optional. This is an HTML encoded XML blob for SSL-VPN plug-in specific configuration including authentication information that's deployed to the device to make it available for SSL-VPN plug-ins. Contact the plugin provider for format and other details. Most plugins can also configure values based on the server negotiations as well as defaults.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### Device/{ProfileName}/PluginProfile/PluginPackageFamilyName
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/PluginProfile/PluginPackageFamilyName
```
Required for Plugin Profiles. This node specifies the Package Family Name of the SSL-VPN plugin app.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### Device/{ProfileName}/PluginProfile/ServerUrlList
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/PluginProfile/ServerUrlList
```
Required for plug-in profiles. Semicolon-separated list of servers in URL, hostname, or IP format.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### Device/{ProfileName}/PrivateNetwork
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/PrivateNetwork
```
Determines whether the VPN connection is public or private.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | true |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | VPN connection is public. |
| true (Default) | VPN connection is private. |
### Device/{ProfileName}/ProfileXML
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/ProfileXML
```
The XML schema for provisioning all the fields of a VPN.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | See [ProfileXML XSD Schema](#profilexml-xsd-schema) |
### Device/{ProfileName}/Proxy
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/Proxy
```
A collection of configuration objects to enable a post-connect proxy support for VPN. The proxy defined for this profile is applied when this profile is active and connected.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
#### Device/{ProfileName}/Proxy/AutoConfigUrl
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/Proxy/AutoConfigUrl
```
Optional. Set a URL to automatically retrieve the proxy settings.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### Device/{ProfileName}/Proxy/Manual
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/Proxy/Manual
```
Optional node containing the manual server settings.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
##### Device/{ProfileName}/Proxy/Manual/Server
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/Proxy/Manual/Server
```
Optional. The value is the proxy server address as a fully qualified hostname or an IP address, with port appended after a colon for example, proxy.constoso.com:80.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### Device/{ProfileName}/RegisterDNS
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1709 [10.0.16299] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/RegisterDNS
```
Allows registration of the connection's address in DNS.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | false |
**Allowed values**:
| Value | Description |
|:--|:--|
| false (Default) | Don't register the connection's address in DNS. |
| true | Register the connection's addresses in DNS. |
### Device/{ProfileName}/RememberCredentials
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/RememberCredentials
```
Boolean value (true or false) for caching credentials.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | false |
**Allowed values**:
| Value | Description |
|:--|:--|
| false (Default) | Don't cache credentials. |
| true | Credentials are cached whenever possible. |
### Device/{ProfileName}/RouteList
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/RouteList
```
List of routes to be added to the Routing table for the VPN Interface. Required in the Split Tunneling case where the VPN Server site has more subnets than the default subnet based on the IP assigned to Interface.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
#### Device/{ProfileName}/RouteList/{routeRowId}
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/RouteList/{routeRowId}
```
A sequential integer identifier for the RouteList. This is required if you are adding routes. Sequencing must start at 0.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Delete, Get |
| Dynamic Node Naming | UniqueName: A sequential integer identifier for the RouteList. This is required if you are adding routes. Sequencing must start at 0. |
##### Device/{ProfileName}/RouteList/{routeRowId}/Address
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/RouteList/{routeRowId}/Address
```
Subnet address in IPv4/v6 address format which, along with the prefix will be used to determine the destination prefix to send via the VPN Interface. This is the IP address part of the destination prefix.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### Device/{ProfileName}/RouteList/{routeRowId}/ExclusionRoute
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/RouteList/{routeRowId}/ExclusionRoute
```
A boolean value that specifies if the route being added should point to the VPN Interface or the Physical Interface as the Gateway.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | false |
**Allowed values**:
| Value | Description |
|:--|:--|
| false (Default) | This route will direct traffic over the VPN. |
| true | This route will direct traffic over the physical interface. |
##### Device/{ProfileName}/RouteList/{routeRowId}/Metric
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/RouteList/{routeRowId}/Metric
```
The route's metric.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
##### Device/{ProfileName}/RouteList/{routeRowId}/PrefixSize
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/RouteList/{routeRowId}/PrefixSize
```
The subnet prefix size part of the destination prefix for the route entry. This, along with the address will be used to determine the destination prefix to route through the VPN Interface.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | Range: `[0-4294967295]` |
### Device/{ProfileName}/TrafficFilterList
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList
```
A list of rules allowing traffic over the VPN Interface. Each Rule ID is OR'ed. Within each rule ID each Filter type is AND'ed.
> [!NOTE]
> Once a TrafficFilterList is added, all traffic is blocked other than the ones matching the rules.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
#### Device/{ProfileName}/TrafficFilterList/{trafficFilterId}
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}
```
A sequential integer identifier for the Traffic Filter rules. Sequencing must start at 0.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Delete, Get |
| Dynamic Node Naming | UniqueName: A sequential integer identifier for the Traffic Filter rules. Sequencing must start at 0. |
##### Device/{ProfileName}/TrafficFilterList/{trafficFilterId}/App
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/App
```
Per App VPN Rule. This will Allow only the Apps specified to be allowed over VPN Interface.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
###### Device/{ProfileName}/TrafficFilterList/{trafficFilterId}/App/Id
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/App/Id
```
App identity for the app-based traffic filter. The value for this node can be one of the following: PackageFamilyName - This App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of a Microsoft Store application. FilePath - This App/Id value represents the full file path of the app. For example, C:\Windows\System\Notepad.exe. SYSTEM - This value enables Kernel Drivers to send traffic through VPN (for example, PING or SMB).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
###### Device/{ProfileName}/TrafficFilterList/{trafficFilterId}/App/Type
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/App/Type
```
Returns the type of ID of the App/Id. Either PackageFamilyName, FilePath, or System.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Get |
##### Device/{ProfileName}/TrafficFilterList/{trafficFilterId}/Claims
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/Claims
```
Specifies a rule in Security Descriptor Definition Language (SDDL) format to check against local user token.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### Device/{ProfileName}/TrafficFilterList/{trafficFilterId}/Direction
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/Direction
```
Outbound - The traffic filter allows traffic to reach destinations matching this rule. This is the default.
Inbound - The traffic filter allows traffic coming from external locations matching this rule.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### Device/{ProfileName}/TrafficFilterList/{trafficFilterId}/LocalAddressRanges
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/LocalAddressRanges
```
A list of comma separated values specifying local IP address ranges to allow.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### Device/{ProfileName}/TrafficFilterList/{trafficFilterId}/LocalPortRanges
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/LocalPortRanges
```
Comma Separated list of ranges for eg. 100-120,200,300-320.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | Regular Expression: `^[\d]*$` |
| Dependency [ProtocolDependency] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/VPNv2/[ProfileName]/TrafficFilterList/[trafficFilterId]/Protocol`
Dependency Allowed Value: `[6,17]`
Dependency Allowed Value Type: `Range`
|
##### Device/{ProfileName}/TrafficFilterList/{trafficFilterId}/Protocol
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/Protocol
```
0-255 number representing the ip protocol (TCP = 6, UDP = 17).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | Range: `[0-255]` |
##### Device/{ProfileName}/TrafficFilterList/{trafficFilterId}/RemoteAddressRanges
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/RemoteAddressRanges
```
A list of comma separated values specifying remote IP address ranges to allow.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### Device/{ProfileName}/TrafficFilterList/{trafficFilterId}/RemotePortRanges
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/RemotePortRanges
```
A list of comma separated values specifying remote port ranges to allow. For example, 100-120, 200, 300-320.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | Regular Expression: `^[\d]*$` |
| Dependency [ProtocolDependency] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/VPNv2/[ProfileName]/TrafficFilterList/[trafficFilterId]/Protocol`
Dependency Allowed Value: `[6,17]`
Dependency Allowed Value Type: `Range`
|
##### Device/{ProfileName}/TrafficFilterList/{trafficFilterId}/RoutingPolicyType
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/RoutingPolicyType
```
Specifies the routing policy if an App or Claims type is used in the traffic filter. The scope of this property is for this traffic filter rule alone.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| SplitTunnel | For this traffic filter rule, only the traffic meant for the VPN interface (as determined by the networking stack) goes over the interface. Internet traffic can continue to go over the other interfaces. |
| ForceTunnel | For this traffic rule all IP traffic must go through the VPN Interface only. |
### Device/{ProfileName}/TrustedNetworkDetection
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/TrustedNetworkDetection
```
Comma separated string to identify the trusted network. VPN won't connect automatically when the user is on their corporate wireless network where protected resources are directly accessible to the device.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | `,` |
### Device/{ProfileName}/UseRasCredentials
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```Device
./Device/Vendor/MSFT/VPNv2/{ProfileName}/UseRasCredentials
```
Determines whether the credential manager will save ras credentials after a connection.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | true |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | Ras Credentials aren't saved. |
| true (Default) | Ras Credentials are saved. |
## User/{ProfileName}
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}
```
Unique alpha numeric identifier for the profile. The profile name mustn't include a forward slash (/). If the profile name has a space or other non-alphanumeric character, it must be properly escaped according to the URL encoding standard.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Delete, Get, Replace |
| Atomic Required | True |
| Dynamic Node Naming | ServerGeneratedUniqueIdentifier |
| Allowed Values | Regular Expression: `^[^/]*$` |
### User/{ProfileName}/AlwaysOn
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/AlwaysOn
```
An optional flag to enable Always On mode. This will automatically connect the VPN at sign-in and will stay connected until the user manually disconnects.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | false |
**Allowed values**:
| Value | Description |
|:--|:--|
| false (Default) | Always On is turned off. |
| true | Always On is turned on. |
### User/{ProfileName}/AlwaysOnActive
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/AlwaysOnActive
```
An optional flag to activate Always On mode. This is true by default if AlwaysOn is true. Setting controls whether "Connect Automatically" is toggled on profile creation.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 1 |
**Allowed values**:
| Value | Description |
|:--|:--|
| 0 | Always On is inactive. |
| 1 (Default) | Always On is activated on provisioning. |
### User/{ProfileName}/APNBinding
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/APNBinding
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
#### User/{ProfileName}/APNBinding/AccessPointName
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/APNBinding/AccessPointName
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### User/{ProfileName}/APNBinding/AuthenticationType
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/APNBinding/AuthenticationType
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### User/{ProfileName}/APNBinding/IsCompressionEnabled
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/APNBinding/IsCompressionEnabled
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
#### User/{ProfileName}/APNBinding/Password
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/APNBinding/Password
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### User/{ProfileName}/APNBinding/ProviderId
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/APNBinding/ProviderId
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### User/{ProfileName}/APNBinding/UserName
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/APNBinding/UserName
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### User/{ProfileName}/AppTriggerList
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/AppTriggerList
```
List of applications set to trigger the VPN. If any of these apps are launched and the VPN Profile is currently the active Profile, this VPN Profile will be triggered to connect.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
#### User/{ProfileName}/AppTriggerList/{appTriggerRowId}
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/AppTriggerList/{appTriggerRowId}
```
A sequential integer identifier which allows the ability to specify multiple apps for App Trigger. Sequencing must start at 0 and you shouldn't skip numbers.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Delete, Get |
| Dynamic Node Naming | UniqueName: A sequential integer identifier which allows the ability to specify multiple apps for App Trigger. Sequencing must start at 0 and you should not skip numbers. |
##### User/{ProfileName}/AppTriggerList/{appTriggerRowId}/App
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/AppTriggerList/{appTriggerRowId}/App
```
App Node under the Row Id.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
###### User/{ProfileName}/AppTriggerList/{appTriggerRowId}/App/Id
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/AppTriggerList/{appTriggerRowId}/App/Id
```
App Identity. Specified, based on the Type Field.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
###### User/{ProfileName}/AppTriggerList/{appTriggerRowId}/App/Type
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/AppTriggerList/{appTriggerRowId}/App/Type
```
Returns the type of App/Id. This value can be either of the following: PackageFamilyName - When this is returned, the App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of the Microsoft Store application. FilePath - When this is returned, the App/Id value represents the full file path of the app. For example, C:\Windows\System\Notepad.exe.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Get |
### User/{ProfileName}/ByPassForLocal
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/ByPassForLocal
```
False: Don't Bypass for Local traffic.
True: ByPass VPN Interface for Local Traffic.
Optional. When this setting is True, requests to local resources that are available on the same Wi-Fi network as the VPN client can bypass the VPN. For example, if enterprise policy for VPN requires force tunnel for VPN, but enterprise intends to allow the remote user to connect locally to media center in their home, then this option should be set to True. The user can bypass VPN for local subnet traffic. When this is set to False, the setting is disabled and no subnet exceptions are allowed.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
### User/{ProfileName}/DataEncryption
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DataEncryption
```
Determines the level of data encryption required for the connection.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
| Default Value | Require |
**Allowed values**:
| Value | Description |
|:--|:--|
| None | No Data Encryption required. |
| Require (Default) | Data Encryption required. |
| Max | Maximum-strength Data Encryption required. |
| Optional | Perform encryption if possible. |
### User/{ProfileName}/DeviceCompliance
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DeviceCompliance
```
Nodes under DeviceCompliance can be used to enable Microsoft Entra ID based Conditional Access for VPN.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Get |
#### User/{ProfileName}/DeviceCompliance/Enabled
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DeviceCompliance/Enabled
```
Enables the Device Compliance flow from the client. If marked as True, the VPN Client will attempt to communicate with Microsoft Entra ID to get a certificate to use for authentication. The VPN should be set up to use Certificate Auth and the VPN Server must trust the Server returned by Microsoft Entra ID.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | Disabled. |
| true | Enabled. |
#### User/{ProfileName}/DeviceCompliance/Sso
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DeviceCompliance/Sso
```
Nodes under SSO can be used to choose a certificate different from the VPN Authentication cert for the Kerberos Authentication in the case of Device Compliance.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Get |
##### User/{ProfileName}/DeviceCompliance/Sso/Eku
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DeviceCompliance/Sso/Eku
```
Comma Separated list of EKU's for the VPN Client to look for the correct certificate for Kerberos Authentication.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### User/{ProfileName}/DeviceCompliance/Sso/Enabled
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DeviceCompliance/Sso/Enabled
```
If this field is set to True the VPN Client will look for a separate certificate for Kerberos Authentication.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | Disabled. |
| true | Enabled. |
##### User/{ProfileName}/DeviceCompliance/Sso/IssuerHash
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DeviceCompliance/Sso/IssuerHash
```
Comma Separated list of Issuer Hashes for the VPN Client to look for the correct certificate for Kerberos Authentication.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### User/{ProfileName}/DisableAdvancedOptionsEditButton
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DisableAdvancedOptionsEditButton
```
Optional. When this setting is True, the Advanced Options page will have its edit functions disabled, only allowing viewing and Clear Sign-In Info.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | Advanced Options Edit Button is available. |
| true | Advanced Options Edit Button is unavailable. |
### User/{ProfileName}/DisableDisconnectButton
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DisableDisconnectButton
```
Optional. When this setting is True, the Disconnect button won't be visible for connected profiles.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | Disconnect Button is visible. |
| true | Disconnect Button isn't visible. |
### User/{ProfileName}/DisableIKEv2Fragmentation
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DisableIKEv2Fragmentation
```
Set to disable IKEv2 Fragmentation.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | false |
**Allowed values**:
| Value | Description |
|:--|:--|
| true | IKEv2 Fragmentation won't be used. |
| false (Default) | IKEv2 Fragmentation is used as normal. |
### User/{ProfileName}/DnsSuffix
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DnsSuffix
```
Specifies one or more comma separated DNS suffixes. The first in the list is also used as the primary connection specific DNS suffix for the VPN Interface. The entire list will also be added into the SuffixSearchList.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### User/{ProfileName}/DomainNameInformationList
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList
```
NRPT ([Name Resolution Policy Table](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn593632(v=ws.11))) Rules for the VPN Profile.
> [!NOTE]
> Only applications using the [Windows DNS API](/windows/win32/dns/dns-reference) can make use of the NRPT and therefore all settings configured within the DomainNameInformationList section. Applications using their own DNS implementation bypass the Windows DNS API. One example of applications not using the Windows DNS API is nslookup, so always use the PowerShell CmdLet [Resolve-DNSName](/powershell/module/dnsclient/resolve-dnsname) to check the functionality of the NRPT.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
#### User/{ProfileName}/DomainNameInformationList/{dniRowId}
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList/{dniRowId}
```
A sequential integer identifier for the Domain Name information. Sequencing must start at 0.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Delete, Get |
| Dynamic Node Naming | UniqueName: A sequential integer identifier for the Domain Name information. Sequencing must start at 0. |
##### User/{ProfileName}/DomainNameInformationList/{dniRowId}/AutoTrigger
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList/{dniRowId}/AutoTrigger
```
Boolean to determine whether this domain name rule will trigger the VPN.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | false |
**Allowed values**:
| Value | Description |
|:--|:--|
| false (Default) | This DomainName rule won't trigger the VPN. |
| true | This DomainName rule will trigger the VPN. |
##### User/{ProfileName}/DomainNameInformationList/{dniRowId}/DnsServers
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList/{dniRowId}/DnsServers
```
Comma Seperated list of IP addresses for the DNS Servers to use for the domain name.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### User/{ProfileName}/DomainNameInformationList/{dniRowId}/DomainName
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList/{dniRowId}/DomainName
```
Used to indicate the namespace to which the policy applies. When a Name query is issued, the DNS client compares the name in the query to all of the namespaces under DomainNameInformationList to find a match. This parameter can be one of the following types: FQDN - Fully qualified domain name. Suffix - A domain suffix that will be appended to the shortname query for DNS resolution. To specify a suffix, prepend a . to the DNS suffix.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### User/{ProfileName}/DomainNameInformationList/{dniRowId}/DomainNameType
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList/{dniRowId}/DomainNameType
```
Returns the namespace type. This value can be one of the following: FQDN - If the DomainName wasn't prepended with a . and applies only to the fully qualified domain name (FQDN) of a specified host. Suffix - If the DomainName was prepended with a . and applies to the specified namespace, all records in that namespace, and all subdomains.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Get |
##### User/{ProfileName}/DomainNameInformationList/{dniRowId}/Persistent
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList/{dniRowId}/Persistent
```
A boolean value that specifies if the rule being added should persist even when the VPN isn't connected.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | false |
**Allowed values**:
| Value | Description |
|:--|:--|
| false (Default) | This DomainName rule will only be applied when VPN is connected. |
| true | This DomainName rule will always be present and applied. |
##### User/{ProfileName}/DomainNameInformationList/{dniRowId}/WebProxyServers
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/DomainNameInformationList/{dniRowId}/WebProxyServers
```
Web Proxy Server IP address if you are redirecting traffic through your intranet.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### User/{ProfileName}/EdpModeId
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/EdpModeId
```
Enterprise ID, which is required for connecting this VPN profile with a WIP policy. When this is set, the networking stack looks for this Enterprise ID in the app token to determine if the traffic is allowed to go over the VPN. If the profile is active, it also automatically triggers the VPN to connect. We recommend having only one such profile per device.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### User/{ProfileName}/IPv4InterfaceMetric
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/IPv4InterfaceMetric
```
The metric for the IPv4 interface.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | Range: `[1-9999]` |
### User/{ProfileName}/IPv6InterfaceMetric
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/IPv6InterfaceMetric
```
The metric for the IPv6 interface.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | Range: `[1-9999]` |
### User/{ProfileName}/NativeProfile
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile
```
InboxNodes under NativeProfile are required when using a Windows Inbox VPN Protocol (IKEv2, PPTP, L2TP, SSTP).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Get |
#### User/{ProfileName}/NativeProfile/Authentication
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication
```
Required node for native profile. It contains authentication information for the native VPN profile.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
##### User/{ProfileName}/NativeProfile/Authentication/Certificate
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/Certificate
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
###### User/{ProfileName}/NativeProfile/Authentication/Certificate/Eku
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/Certificate/Eku
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
###### User/{ProfileName}/NativeProfile/Authentication/Certificate/Issuer
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/Certificate/Issuer
```
Reserved for future use.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### User/{ProfileName}/NativeProfile/Authentication/Eap
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/Eap
```
Required when the native profile specifies EAP authentication. EAP configuration XML.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
###### User/{ProfileName}/NativeProfile/Authentication/Eap/Configuration
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/Eap/Configuration
```
HTML encoded XML of the EAP configuration. For more information,see [EAP configuration](eap-configuration.md).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
###### User/{ProfileName}/NativeProfile/Authentication/Eap/Type
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/Eap/Type
```
Required node for EAP profiles. This specifies the EAP Type ID
13 = EAP-TLS
26 = Ms-Chapv2
27 = Peap.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
##### User/{ProfileName}/NativeProfile/Authentication/MachineMethod
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/MachineMethod
```
This is only supported in IKEv2.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| Certificate | Certificate. |
##### User/{ProfileName}/NativeProfile/Authentication/UserMethod
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Authentication/UserMethod
```
This value can be one of the following: EAP or MSChapv2 (This isn't supported for IKEv2).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| EAP | EAP. |
| MSChapv2 | MSChapv2: This isn't supported for IKEv2. |
#### User/{ProfileName}/NativeProfile/CryptographySuite
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/CryptographySuite
```
Properties of IPSec tunnels.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
##### User/{ProfileName}/NativeProfile/CryptographySuite/AuthenticationTransformConstants
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/CryptographySuite/AuthenticationTransformConstants
```
Type of authentication transform constant.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| MD596 | MD596. |
| SHA196 | SHA196. |
| SHA256128 | SHA256128. |
| GCMAES128 | GCMAES128. |
| GCMAES192 | GCMAES192. |
| GCMAES256 | GCMAES256. |
##### User/{ProfileName}/NativeProfile/CryptographySuite/CipherTransformConstants
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/CryptographySuite/CipherTransformConstants
```
Type of Cipher transform constant.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| DES | DES. |
| DES3 | DES3. |
| AES128 | AES128. |
| AES192 | AES192. |
| AES256 | AES256. |
| GCMAES128 | GCMAES128. |
| GCMAES192 | GCMAES192. |
| GCMAES256 | GCMAES256. |
##### User/{ProfileName}/NativeProfile/CryptographySuite/DHGroup
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/CryptographySuite/DHGroup
```
Group used for DH (Diffie-Hellman).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| None | None. |
| Group1 | Group1. |
| Group2 | Group2. |
| Group14 | Group14. |
| ECP256 | ECP256. |
| ECP384 | ECP384. |
| Group24 | Group24. |
##### User/{ProfileName}/NativeProfile/CryptographySuite/EncryptionMethod
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/CryptographySuite/EncryptionMethod
```
Type of encryption method.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| DES | DES. |
| DES3 | DES3. |
| AES128 | AES128. |
| AES192 | AES192. |
| AES256 | AES256. |
| AES_GCM_128 | AES_GCM_128. |
| AES_GCM_256 | AES_GCM_256. |
##### User/{ProfileName}/NativeProfile/CryptographySuite/IntegrityCheckMethod
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/CryptographySuite/IntegrityCheckMethod
```
Type of integrity check.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| MD5 | MD5. |
| SHA196 | SHA196. |
| SHA256 | SHA256. |
| SHA384 | SHA384. |
##### User/{ProfileName}/NativeProfile/CryptographySuite/PfsGroup
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/CryptographySuite/PfsGroup
```
Group used for PFS (Perfect Forward Secrecy).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| None | None. |
| PFS1 | PFS1. |
| PFS2 | PFS2. |
| PFS2048 | PFS2048. |
| ECP256 | ECP256. |
| ECP384 | ECP384. |
| PFSMM | PFSMM. |
| PFS24 | PFS24. |
#### User/{ProfileName}/NativeProfile/DisableClassBasedDefaultRoute
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/DisableClassBasedDefaultRoute
```
Specifies the class based default routes. For example, if the interface IP begins with 10, it assumes a class a IP and pushes the route to 10.0.0.0/8.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | Enabled. |
| true | Disabled. |
#### User/{ProfileName}/NativeProfile/L2tpPsk
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/L2tpPsk
```
The preshared key used for an L2TP connection.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### User/{ProfileName}/NativeProfile/NativeProtocolType
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/NativeProtocolType
```
Required for native profiles. Type of tunneling protocol used.
> [!NOTE]
> For a Device Tunnel, use IKEv2 only.
> For a User Tunnel, any value is allowed.
> Using ProtocolList as value in NativeProtocolType requires additional configuration of the NativeProfile/ProtocolList parameter.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| PPTP | PPTP. |
| L2TP | L2TP. |
| IKEv2 | IKEv2. |
| Automatic | Automatic. |
| SSTP | SSTP. |
| ProtocolList | ProtocolList. |
#### User/{ProfileName}/NativeProfile/PlumbIKEv2TSAsRoutes
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/PlumbIKEv2TSAsRoutes
```
True: Plumb traffic selectors as routes onto VPN interface, False: Don't plumb traffic selectors as routes.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
#### User/{ProfileName}/NativeProfile/ProtocolList
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20207] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/ProtocolList
```
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
##### User/{ProfileName}/NativeProfile/ProtocolList/NativeProtocolList
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20207] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/ProtocolList/NativeProtocolList
```
List of inbox VPN protocols in priority order.
> [!NOTE]
> For a User Tunnel up to 4 VPN protocols are supported.
> A separate entry is needed for every VPN protocol. For a sample format, see [Examples](#examples).
> For a Device tunnel, we recommend using IKEv2 in NativeProtocolType instead of ProtocolList.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
###### User/{ProfileName}/NativeProfile/ProtocolList/NativeProtocolList/{NativeProtocolRowId}
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20207] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/ProtocolList/NativeProtocolList/{NativeProtocolRowId}
```
> [!NOTE]
> A separate entry is needed for every VPN protocol. For a sample format, see [Examples](#examples).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Delete, Get |
###### User/{ProfileName}/NativeProfile/ProtocolList/NativeProtocolList/{NativeProtocolRowId}/Type
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20207] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/ProtocolList/NativeProtocolList/{NativeProtocolRowId}/Type
```
Inbox VPN protocols type.
> [!NOTE]
> A separate entry is needed for every VPN protocol. For a sample format, see [Examples](#examples).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| Pptp | Pptp. |
| L2tp | L2tp. |
| Ikev2 | Ikev2. |
| Sstp | Sstp. |
##### User/{ProfileName}/NativeProfile/ProtocolList/RetryTimeInHours
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20207] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/ProtocolList/RetryTimeInHours
```
Default 168, max 500000.
RetryTimeInHours specifies the length of time Windows tries to use the last successful protocol when making a new connection. Setting this value to 0 disables remembering the last successful protocol.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
#### User/{ProfileName}/NativeProfile/RoutingPolicyType
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/RoutingPolicyType
```
Type of routing policy.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| SplitTunnel | Traffic can go over any interface as determined by the networking stack. |
| ForceTunnel | All IP traffic must go over the VPN interface. |
#### User/{ProfileName}/NativeProfile/Servers
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NativeProfile/Servers
```
Required for native profiles. Public or routable IP address or DNS name for the VPN gateway. It can point to the external IP of a gateway or a virtual IP for a server farm. Examples, 208.147.66.130 or vpn.contoso.com The name can be a server name plus a friendly name separated with a semi-colon. For example, server2.example.com;server2FriendlyName. When you get the value, the return will include both the server name and the friendly name; if no friendly name had been supplied it will default to the server name. You can make a list of server by making a list of server names (with optional friendly names) separated by commas. For example, server1.example.com,server2.example.com.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### User/{ProfileName}/NetworkOutageTime
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/NetworkOutageTime
```
The amount of time in seconds the network is allowed to idle. 0 means no limit.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | Range: `[0-4294967295]` |
### User/{ProfileName}/PluginProfile
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/PluginProfile
```
Nodes under the PluginProfile are required when using a Microsoft Store based VPN plugin.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Get |
#### User/{ProfileName}/PluginProfile/CustomConfiguration
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/PluginProfile/CustomConfiguration
```
Optional. This is an HTML encoded XML blob for SSL-VPN plug-in specific configuration including authentication information that's deployed to the device to make it available for SSL-VPN plug-ins. Contact the plugin provider for format and other details. Most plugins can also configure values based on the server negotiations as well as defaults.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### User/{ProfileName}/PluginProfile/PluginPackageFamilyName
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/PluginProfile/PluginPackageFamilyName
```
Required for Plugin Profiles. This node specifies the Package Family Name of the SSL-VPN plugin app.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### User/{ProfileName}/PluginProfile/ServerUrlList
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/PluginProfile/ServerUrlList
```
Required for plug-in profiles. Semicolon-separated list of servers in URL, hostname, or IP format.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### User/{ProfileName}/PrivateNetwork
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/PrivateNetwork
```
Determines whether the VPN connection is public or private.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | true |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | VPN connection is public. |
| true (Default) | VPN connection is private. |
### User/{ProfileName}/ProfileXML
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/ProfileXML
```
The XML schema for provisioning all the fields of a VPN.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | See [ProfileXML XSD Schema](#profilexml-xsd-schema) |
### User/{ProfileName}/Proxy
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/Proxy
```
A collection of configuration objects to enable a post-connect proxy support for VPN. The proxy defined for this profile is applied when this profile is active and connected.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
#### User/{ProfileName}/Proxy/AutoConfigUrl
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/Proxy/AutoConfigUrl
```
Optional. Set a URL to automatically retrieve the proxy settings.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
#### User/{ProfileName}/Proxy/Manual
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/Proxy/Manual
```
Optional node containing the manual server settings.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
##### User/{ProfileName}/Proxy/Manual/Server
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/Proxy/Manual/Server
```
Optional. The value is the proxy server address as a fully qualified hostname or an IP address, with port appended after a colon for example, proxy.constoso.com:80.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
### User/{ProfileName}/RegisterDNS
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1709 [10.0.16299] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/RegisterDNS
```
Allows registration of the connection's address in DNS.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | false |
**Allowed values**:
| Value | Description |
|:--|:--|
| false (Default) | Don't register the connection's address in DNS. |
| true | Register the connection's addresses in DNS. |
### User/{ProfileName}/RememberCredentials
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/RememberCredentials
```
Boolean value (true or false) for caching credentials.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | false |
**Allowed values**:
| Value | Description |
|:--|:--|
| false (Default) | Don't cache credentials. |
| true | Credentials are cached whenever possible. |
### User/{ProfileName}/RequireVpnClientAppUI
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ❌ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.19628] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/RequireVpnClientAppUI
```
Applicable only to AppContainer profiles.
False: Don't show profile in Settings UI.
True: Show profile in Settings UI.
Optional. This node is only relevant for AppContainer profiles (i.e. using the VpnManagementAgent::AddProfileFromXmlAsync method).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
### User/{ProfileName}/RouteList
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/RouteList
```
List of routes to be added to the Routing table for the VPN Interface. Required in the Split Tunneling case where the VPN Server site has more subnets than the default subnet based on the IP assigned to Interface.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
#### User/{ProfileName}/RouteList/{routeRowId}
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/RouteList/{routeRowId}
```
A sequential integer identifier for the RouteList. This is required if you are adding routes. Sequencing must start at 0.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Delete, Get |
| Dynamic Node Naming | UniqueName: A sequential integer identifier for the RouteList. This is required if you are adding routes. Sequencing must start at 0. |
##### User/{ProfileName}/RouteList/{routeRowId}/Address
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/RouteList/{routeRowId}/Address
```
Subnet address in IPv4/v6 address format which, along with the prefix will be used to determine the destination prefix to send via the VPN Interface. This is the IP address part of the destination prefix.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### User/{ProfileName}/RouteList/{routeRowId}/ExclusionRoute
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/RouteList/{routeRowId}/ExclusionRoute
```
A boolean value that specifies if the route being added should point to the VPN Interface or the Physical Interface as the Gateway.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | false |
**Allowed values**:
| Value | Description |
|:--|:--|
| false (Default) | This route will direct traffic over the VPN. |
| true | This route will direct traffic over the physical interface. |
##### User/{ProfileName}/RouteList/{routeRowId}/Metric
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/RouteList/{routeRowId}/Metric
```
The route's metric.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
##### User/{ProfileName}/RouteList/{routeRowId}/PrefixSize
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/RouteList/{routeRowId}/PrefixSize
```
The subnet prefix size part of the destination prefix for the route entry. This, along with the address will be used to determine the destination prefix to route through the VPN Interface.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | Range: `[0-4294967295]` |
### User/{ProfileName}/TrafficFilterList
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList
```
A list of rules allowing traffic over the VPN Interface. Each Rule ID is OR'ed. Within each rule ID each Filter type is AND'ed.
> [!NOTE]
> Once a TrafficFilterList is added, all traffic is blocked other than the ones matching the rules.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
#### User/{ProfileName}/TrafficFilterList/{trafficFilterId}
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}
```
A sequential integer identifier for the Traffic Filter rules. Sequencing must start at 0.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Add, Delete, Get |
| Dynamic Node Naming | UniqueName: A sequential integer identifier for the Traffic Filter rules. Sequencing must start at 0. |
##### User/{ProfileName}/TrafficFilterList/{trafficFilterId}/App
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/App
```
Per App VPN Rule. This will Allow only the Apps specified to be allowed over VPN Interface.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `node` |
| Access Type | Get |
###### User/{ProfileName}/TrafficFilterList/{trafficFilterId}/App/Id
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/App/Id
```
App identity for the app-based traffic filter. The value for this node can be one of the following: PackageFamilyName - This App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of a Microsoft Store application. FilePath - This App/Id value represents the full file path of the app. For example, C:\Windows\System\Notepad.exe. SYSTEM - This value enables Kernel Drivers to send traffic through VPN (for example, PING or SMB).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
###### User/{ProfileName}/TrafficFilterList/{trafficFilterId}/App/Type
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/App/Type
```
Returns the type of ID of the App/Id. Either PackageFamilyName, FilePath, or System.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Get |
##### User/{ProfileName}/TrafficFilterList/{trafficFilterId}/Claims
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/Claims
```
Specifies a rule in Security Descriptor Definition Language (SDDL) format to check against local user token.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### User/{ProfileName}/TrafficFilterList/{trafficFilterId}/Direction
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 2004 [10.0.19041] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/Direction
```
Outbound - The traffic filter allows traffic to reach destinations matching this rule. This is the default.
Inbound - The traffic filter allows traffic coming from external locations matching this rule.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### User/{ProfileName}/TrafficFilterList/{trafficFilterId}/LocalAddressRanges
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/LocalAddressRanges
```
A list of comma separated values specifying local IP address ranges to allow.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### User/{ProfileName}/TrafficFilterList/{trafficFilterId}/LocalPortRanges
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/LocalPortRanges
```
Comma Separated list of ranges for eg. 100-120,200,300-320.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | Regular Expression: `^[\d]*$` |
| Dependency [ProtocolDependency] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/VPNv2/[ProfileName]/TrafficFilterList/[trafficFilterId]/Protocol`
Dependency Allowed Value: `[6,17]`
Dependency Allowed Value Type: `Range`
|
##### User/{ProfileName}/TrafficFilterList/{trafficFilterId}/Protocol
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/Protocol
```
0-255 number representing the ip protocol (TCP = 6, UDP = 17).
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `int` |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | Range: `[0-255]` |
##### User/{ProfileName}/TrafficFilterList/{trafficFilterId}/RemoteAddressRanges
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/RemoteAddressRanges
```
A list of comma separated values specifying remote IP address ranges to allow.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
##### User/{ProfileName}/TrafficFilterList/{trafficFilterId}/RemotePortRanges
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/RemotePortRanges
```
A list of comma separated values specifying remote port ranges to allow. For example, 100-120, 200, 300-320.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | Regular Expression: `^[\d]*$` |
| Dependency [ProtocolDependency] | Dependency Type: `DependsOn`
Dependency URI: `Vendor/MSFT/VPNv2/[ProfileName]/TrafficFilterList/[trafficFilterId]/Protocol`
Dependency Allowed Value: `[6,17]`
Dependency Allowed Value Type: `Range`
|
##### User/{ProfileName}/TrafficFilterList/{trafficFilterId}/RoutingPolicyType
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/TrafficFilterList/{trafficFilterId}/RoutingPolicyType
```
Specifies the routing policy if an App or Claims type is used in the traffic filter. The scope of this property is for this traffic filter rule alone.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
**Allowed values**:
| Value | Description |
|:--|:--|
| SplitTunnel | For this traffic filter rule, only the traffic meant for the VPN interface (as determined by the networking stack) goes over the interface. Internet traffic can continue to go over the other interfaces. |
| ForceTunnel | For this traffic rule all IP traffic must go through the VPN Interface only. |
### User/{ProfileName}/TrustedNetworkDetection
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/TrustedNetworkDetection
```
Comma separated string to identify the trusted network. VPN won't connect automatically when the user is on their corporate wireless network where protected resources are directly accessible to the device.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `chr` (string) |
| Access Type | Add, Delete, Get, Replace |
| Allowed Values | `,` |
### User/{ProfileName}/UseRasCredentials
| Scope | Editions | Applicable OS |
|:--|:--|:--|
| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later |
```User
./User/Vendor/MSFT/VPNv2/{ProfileName}/UseRasCredentials
```
Determines whether the credential manager will save ras credentials after a connection.
**Description framework properties**:
| Property name | Property value |
|:--|:--|
| Format | `bool` |
| Access Type | Add, Delete, Get, Replace |
| Default Value | true |
**Allowed values**:
| Value | Description |
|:--|:--|
| false | Ras Credentials aren't saved. |
| true (Default) | Ras Credentials are saved. |
## ProfileXML XSD Schema
```xml
```
## Examples
Profile example
```xml
10000
10001
-
./Vendor/MSFT/VPNv2/VPN_Demo/ProfileXML
VPN_Demo
VPNServer.contoso.com
ProtocolList
Ikev2
Sstp
168
Eap
25 0 0 0 25 false true false 13 false false false false false Unknown Key Usage 1.3.6.1.4.1.311.87 Unknown Key Usage false false false false
SplitTunnel
.contoso.com
10.5.5.5
%ProgramFiles%\Internet Explorer\iexplore.exe
Microsoft.MicrosoftEdge_8wekyb3d8bbwe
10.0.0.0
8
25.0.0.0
8
true
```
AppTriggerList
```xml
10013
-
./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/0/App/Id
%PROGRAMFILES%\Internet Explorer\iexplore.exe
10014
-
./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/1/App/Id
%PROGRAMFILES% (x86)\Internet Explorer\iexplore.exe
10015
-
./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/2/App/Id
Microsoft.MicrosoftEdge_8wekyb3d8bbwe
```
RouteList and ExclusionRoute
```xml
10008
-
./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/Address
192.168.0.0
10009
-
./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/PrefixSize
int
24
10010
-
./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/ExclusionRoute
bool
true
```
DomainNameInformationList
```xml
10013
-
./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/DomainName
.contoso.com
10014
-
./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/DnsServers
192.168.0.11,192.168.0.12
10013
-
./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/DomainName
.contoso.com
10015
-
./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/WebProxyServers
192.168.0.100:8888
10016
-
./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/2/DomainName
finance.contoso.com
10017
-
./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/2/DnsServers
192.168.0.11,192.168.0.12
10016
-
./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/3/DomainName
finance.contoso.com
10017
-
./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/3/WebProxyServers
192.168.0.11:8080
10016
-
./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/4/DomainName
.
10017
-
./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/4/DnsServers
192.168.0.11,192.168.0.12
10016
-
./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/5/DomainName
.
10017
-
./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/5/WebProxyServers
192.168.0.11
```
AutoTrigger
```xml
10010
-
./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/AutoTrigger
bool
true
```
Persistent
```xml
10010
-
./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/Persistent
bool
true
```
TrafficFilterLIst App
```xml
10013
-
./Vendor/MSFT/VPNv2/VPNProfileName/TrafficFilterList/0/App/Id
%ProgramFiles%\Internet Explorer\iexplore.exe
10014
-
./Vendor/MSFT/VPNv2/VPNProfileName/TrafficFilterList/1/App/Id
Microsoft.MicrosoftEdge_8wekyb3d8bbwe
10015
-
./Vendor/MSFT/VPNv2/VPNProfileName/TrafficFilterList/3/App/Id
SYSTEM
```
Protocol, LocalPortRanges, RemotePortRanges, LocalAddressRanges, RemoteAddressRanges, RoutingPolicyType, EDPModeId, RememberCredentials, AlwaysOn, Lockdown, DnsSuffix, TrustedNetworkDetection
```xml
$CmdID$
-
./Vendor/MSFT/VPNv2/VPNProfileName/TrafficFilterList/3/Protocol
int
6
$CmdID$
-
./Vendor/MSFT/VPNv2/VPNProfileName/TrafficFilterList/3/LocalPortRanges
10,20-50,100-200
$CmdID$
-
./Vendor/MSFT/VPNv2/VPNProfileName/TrafficFilterList/3/RemotePortRanges
20-50,100-200,300
$CmdID$
-
./Vendor/MSFT/VPNv2/VPNProfileName/TrafficFilterList/3/LocalAddressRanges/LocURI>
3.3.3.3/32,1.1.1.1-2.2.2.2
$CmdID$
-
./Vendor/MSFT/VPNv2/VPNProfileName/TrafficFilterList/3/RemoteAddressRanges
30.30.0.0/16,10.10.10.10-20.20.20.20
$CmdID$
-
./Vendor/MSFT/VPNv2/VPNProfileName/TrafficFilterList/0/RoutingPolicyType
ForceTunnel
$CmdID$
-
./Vendor/MSFT/VPNv2/VPNProfileName/EDPModeID
corp.contoso.com
$CmdID$
-
./Vendor/MSFT/VPNv2/VPNProfileName/RememberCredentials
bool
true
$CmdID$
-
./Vendor/MSFT/VPNv2/VPNProfileName/AlwaysOn
bool
true
$CmdID$
-
./Vendor/MSFT/VPNv2/VPNProfileName/Lockdown
bool
true
$CmdID$
-
./Vendor/MSFT/VPNv2/VPNProfileName/DnsSuffix
Adatum.com
$CmdID$
-
./Vendor/MSFT/VPNv2/VPNProfileName/TrustedNetworkDetection
Adatum.com
```
Proxy - Manual or AutoConfigUrl
```xml
$CmdID$
-
./Vendor/MSFT/VPNv2/VPNProfileName/Proxy/Manual/Server
192.168.0.100:8888
$CmdID$
-
./Vendor/MSFT/VPNv2/VPNProfileName/Proxy/AutoConfigUrl
HelloWorld.com
```
Device Compliance - Sso
```xml
10011
-
./Vendor/MSFT/VPNv2/VPNProfileName/DeviceCompliance/SSO/Enabled
bool
true
10011
-
./Vendor/MSFT/VPNv2/VPNProfileName/DeviceCompliance/SSO/IssuerHash
ffffffffffffffffffffffffffffffffffffffff;ffffffffffffffffffffffffffffffffffffffee
10011
-
./Vendor/MSFT/VPNv2/VPNProfileName/DeviceCompliance/SSO/EKU
1.3.6.1.5.5.7.3.2
```
PluginProfile
```xml
10001
-
./Vendor/MSFT/VPNv2/VPNProfileName/PluginProfile/ServerUrlList
selfhost.corp.contoso.com
10002
-
./Vendor/MSFT/VPNv2/VPNProfileName/PluginProfile/PluginPackageFamilyName
TestVpnPluginApp-SL_8wekyb3d8bbwe
10003
-
./Vendor/MSFT/VPNv2/VPNProfileName/PluginProfile/CustomConfiguration
auto443172.10.10.024.vpnbackend.com172.10.10.11
```
NativeProfile
```xml
10001
-
./Vendor/MSFT/VPNv2/VPNProfileName/NativeProfile/Servers
Selfhost.corp.contoso.com
10007
-
./Vendor/MSFT/VPNv2/VPNProfileName/NativeProfile/RoutingPolicyType
ForceTunnel
10002
-
./Vendor/MSFT/VPNv2/VPNProfileName/NativeProfile/NativeProtocolType
Automatic
10003
-
./Vendor/MSFT/VPNv2/VPNProfileName/NativeProfile/Authentication/UserMethod
Eap
10004
-
./Vendor/MSFT/VPNv2/VPNProfileName/NativeProfile/Authentication/MachineMethod
Eap
10004
-
./Vendor/MSFT/VPNv2/VPNProfileName/NativeProfile/Authentication/CryptographySuite/AuthenticationTransformConstants
SHA196
10004
-
./Vendor/MSFT/VPNv2/VPNProfileName/NativeProfile/Authentication/CryptographySuite/CipherTransformConstants
AES192
10004
-
./Vendor/MSFT/VPNv2/VPNProfileName/NativeProfile/Authentication/CryptographySuite/EncryptionMethod
AES128
10004
-
./Vendor/MSFT/VPNv2/VPNProfileName/NativeProfile/Authentication/CryptographySuite/IntegrityCheckMethod
SHA256
Group14
-
./Vendor/MSFT/VPNv2/VPNProfileName/NativeProfile/Authentication/CryptographySuite/DHGroup
Group2
10004
-
./Vendor/MSFT/VPNv2/VPNProfileName/NativeProfile/Authentication/CryptographySuite/PfsGroup
PFS2048
10011
-
./Vendor/MSFT/VPNv2/VPNProfileName/NativeProfile/DisableClassBasedDefaultRoute
bool
true
```
## Related articles
[Configuration service provider reference](configuration-service-provider-reference.md)