IntuneVPNConfigurationPolicyMacOS

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
Assignments	Write	MSFT_DeviceManagementConfigurationPolicyAssignments[]	Represents the assignment to the Intune policy.
AssociatedDomains	Write	String[]	Associated Domains
AuthenticationMethod	Write	String	Authentication method for this VPN connection. Possible values are: certificate, usernameAndPassword, sharedSecret, derivedCredential, azureAD.	certificate, usernameAndPassword, sharedSecret, derivedCredential, azureAD
ConnectionName	Write	String	Connection name displayed to the user.
ConnectionType	Write	String	Connection type. Possible values are: ciscoAnyConnect, pulseSecure, f5EdgeClient, dellSonicWallMobileConnect, checkPointCapsuleVpn, customVpn, ciscoIPSec, citrix, ciscoAnyConnectV2, paloAltoGlobalProtect, zscalerPrivateAccess, f5Access2018, citrixSso, paloAltoGlobalProtectV2, ikEv2, alwaysOn, microsoftTunnel, netMotionMobility, microsoftProtect.	ciscoAnyConnect, pulseSecure, f5EdgeClient, dellSonicWallMobileConnect, checkPointCapsuleVpn, customVpn, ciscoIPSec, citrix, ciscoAnyConnectV2, paloAltoGlobalProtect, zscalerPrivateAccess, f5Access2018, citrixSso, paloAltoGlobalProtectV2, ikEv2, alwaysOn, microsoftTunnel, netMotionMobility, microsoftProtect
CustomData	Write	MSFT_MicrosoftGraphKeyValue[]	Custom data when connection type is set to Custom VPN. Use this field to enable functionality not supported by Intune, but available in your VPN solution. Contact your VPN vendor to learn how to add these key/value pairs. This collection can contain a maximum of 25 elements.
CustomKeyValueData	Write	MSFT_MicrosoftGraphKeyValuePair2[]	Custom data when connection type is set to Custom VPN. Use this field to enable functionality not supported by Intune, but available in your VPN solution. Contact your VPN vendor to learn how to add these key/value pairs. This collection can contain a maximum of 25 elements.
DeploymentChannel	Write	String	Indicates the deployment channel type used to deploy the configuration profile. Possible values are deviceChannel, userChannel. Possible values are: deviceChannel, userChannel, unknownFutureValue.	deviceChannel, userChannel, unknownFutureValue
Description	Write	String	Admin provided description of the Device Configuration.
DisableOnDemandUserOverride	Write	Boolean	Toggle to prevent user from disabling automatic VPN in the Settings app
DisconnectOnIdle	Write	Boolean	Whether to disconnect after on-demand connection idles
DisconnectOnIdleTimerInSeconds	Write	SInt32	The length of time in seconds to wait before disconnecting an on-demand connection. Valid values 0 to 65535
DisplayName	Key	String	Admin provided name of the device configuration.
EnablePerApp	Write	Boolean	Setting this to true creates Per-App VPN payload which can later be associated with Apps that can trigger this VPN conneciton on the end user's iOS device.
EnableSplitTunneling	Write	Boolean	Send all network traffic through VPN.
ExcludedDomains	Write	String[]	Domains that are accessed through the public internet instead of through VPN, even when per-app VPN is activated
ExcludeLocalNetworks	Write	Boolean	Indicates whether local network traffic is excluded from the VPN tunnel. When TRUE, local network traffic bypasses the VPN tunnel. Default value is null. Only takes effect when includeAllNetworks is TRUE or enforceVpnRouting is TRUE. Not applicable when enablePerApp is TRUE.
Id	Write	String	The unique identifier for an entity. Read-only.
Identifier	Write	String	Identifier provided by VPN vendor when connection type is set to Custom VPN. For example: Cisco AnyConnect uses an identifier of the form com.cisco.anyconnect.applevpn.plugin
IncludeAllNetworks	Write	Boolean	Indicates whether most network traffic is routed through the VPN tunnel. When TRUE, most network traffic is sent through the VPN tunnel. Default value is null. Not applicable when enablePerApp is TRUE.
LoginGroupOrDomain	Write	String	Login group or domain when connection type is set to Dell SonicWALL Mobile Connection.
OnDemandRules	Write	MSFT_MicrosoftGraphVpnOnDemandRule[]	On-Demand Rules. This collection can contain a maximum of 500 elements.
OptInToDeviceIdSharing	Write	Boolean	Opt-In to sharing the device's Id to third-party vpn clients for use during network access control validation.
ProviderType	Write	String	Provider type for per-app VPN. Possible values are: notConfigured, appProxy, packetTunnel.	notConfigured, appProxy, packetTunnel
ProxyServer	Write	MSFT_MicrosoftGraphVpnProxyServer	Proxy Server.
Realm	Write	String	Realm when connection type is set to Pulse Secure.
Role	Write	String	Role when connection type is set to Pulse Secure.
RoleScopeTagIds	Write	String[]	List of Scope Tags for this Entity instance.
SafariDomains	Write	String[]	Safari domains when this VPN per App setting is enabled. In addition to the apps associated with this VPN, Safari domains specified here will also be able to trigger this VPN connection.
Server	Write	MSFT_MicrosoftGraphVpnServer1	VPN Server on the network. Make sure end users can access this network location.
Ensure	Write	String	Specify if the policy should exist.	Present, Absent
Credential	Write	PSCredential	Credentials of the Intune Admin
ApplicationId	Write	String	Id of the Entra ID application to authenticate with.
TenantId	Write	String	Id of the Entra ID tenant used for authentication.
ApplicationSecret	Write	PSCredential	Secret of the Entra ID application to authenticate with.
CertificateThumbprint	Write	String	Thumbprint of the Entra ID application's authentication certificate to use for authentication.
CertificatePassword	Write	PSCredential	Username can be made up to anything but password will be used for CertificatePassword
CertificatePath	Write	String	Path to certificate used in service principal usually a PFX file.
ManagedIdentity	Write	Boolean	Managed ID being used for authentication.
AccessTokens	Write	String[]	Access token used for authentication.

Embedded Instances

MSFT_DeviceManagementConfigurationPolicyAssignments

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
dataType	Required	String	The type of the target assignment.	#microsoft.graph.cloudPcManagementGroupAssignmentTarget, #microsoft.graph.groupAssignmentTarget, #microsoft.graph.allLicensedUsersAssignmentTarget, #microsoft.graph.allDevicesAssignmentTarget, #microsoft.graph.exclusionGroupAssignmentTarget, #microsoft.graph.configurationManagerCollectionAssignmentTarget
deviceAndAppManagementAssignmentFilterType	Write	String	The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude.	none, include, exclude
deviceAndAppManagementAssignmentFilterId	Write	String	The Id of the filter for the target assignment.
deviceAndAppManagementAssignmentFilterDisplayName	Write	String	The display name of the filter for the target assignment.
groupId	Write	String	The group Id that is the target of the assignment.
groupDisplayName	Write	String	The group Display Name that is the target of the assignment.
collectionId	Write	String	The collection Id that is the target of the assignment.(ConfigMgr)

MSFT_MicrosoftGraphKeyValue

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
Key	Write	String	Key.
Value	Write	String	Value.

MSFT_MicrosoftGraphKeyValuePair2

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
Name	Write	String	Name for this key-value pair
Value	Write	String	Value for this key-value pair

MSFT_MicrosoftGraphVpnOnDemandRule

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
Action	Write	String	Action. Possible values are: connect, evaluateConnection, ignore, disconnect.	connect, evaluateConnection, ignore, disconnect
DnsSearchDomains	Write	String[]	DNS Search Domains.
DnsServerAddressMatch	Write	String[]	DNS Search Server Address.
DomainAction	Write	String	Domain Action (Only applicable when Action is evaluate connection). Possible values are: connectIfNeeded, neverConnect.	connectIfNeeded, neverConnect
Domains	Write	String[]	Domains (Only applicable when Action is evaluate connection).
InterfaceTypeMatch	Write	String	Network interface to trigger VPN. Possible values are: notConfigured, ethernet, wiFi, cellular.	notConfigured, ethernet, wiFi, cellular
ProbeRequiredUrl	Write	String	Probe Required Url (Only applicable when Action is evaluate connection and DomainAction is connect if needed).
ProbeUrl	Write	String	A URL to probe. If this URL is successfully fetched (returning a 200 HTTP status code) without redirection, this rule matches.
Ssids	Write	String[]	Network Service Set Identifiers (SSIDs).

MSFT_MicrosoftGraphVpnProxyServer

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
Address	Write	String	Address.
AutomaticallyDetectProxySettings	Write	Boolean	Automatically detect proxy settings.
AutomaticConfigurationScriptUrl	Write	String	Proxy's automatic configuration script url.
BypassProxyServerForLocalAddress	Write	Boolean	Bypass proxy server for local address.
ODataType	Write	String	The type of the entity.	#microsoft.graph.windows10VpnProxyServer, #microsoft.graph.windows81VpnProxyServer
Port	Write	SInt32	Port. Valid values 0 to 65535

MSFT_MicrosoftGraphVpnServer1

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
Address	Write	String	Address (IP address, FQDN or URL)
Description	Write	String	Description.
IsDefaultServer	Write	Boolean	Default server.

Description

This resource configures a Intune V P N Configuration Policy for macOS.

Permissions

Graph

To authenticate with the Graph API, this resource requires the following permissions:

Delegated permissions

• Read

• GroupMember.Read.All, DeviceManagementConfiguration.Read.All, DeviceManagementRBAC.Read.All

• Update

• GroupMember.Read.All, DeviceManagementConfiguration.ReadWrite.All, DeviceManagementRBAC.Read.All

Application permissions

• Read

• GroupMember.Read.All, DeviceManagementConfiguration.Read.All, DeviceManagementRBAC.Read.All

• Update

• GroupMember.Read.All, DeviceManagementConfiguration.ReadWrite.All, DeviceManagementRBAC.Read.All

Examples

Example 1

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        IntuneVPNConfigurationPolicyMacOS 'IntuneVPNConfigurationPolicyMacOS-Example'
        {
            Assignments                    = @(
                MSFT_DeviceManagementConfigurationPolicyAssignments{
                    dataType                                   = "#microsoft.graph.allDevicesAssignmentTarget"
                    deviceAndAppManagementAssignmentFilterType = "none"
                }
            );
            AssociatedDomains              = @("contoso.com", "corp.contoso.com");
            AuthenticationMethod           = "certificate";
            ConnectionName                 = "Contoso Corporate VPN";
            ConnectionType                 = "ciscoAnyConnect";
            CustomData                     = @(
                MSFT_MicrosoftGraphKeyValue{
                    Key   = "tunnelGroup"
                    Value = "CONTOSO-EMPLOYEES"
                }
            );
            CustomKeyValueData             = @(
                MSFT_MicrosoftGraphKeyValuePair2{
                    Name  = "vpnProfile"
                    Value = "contoso-full-tunnel"
                }
            );
            DeploymentChannel              = "deviceChannel";
            Description                    = "Corporate VPN for managed Macs";
            DisableOnDemandUserOverride    = $true;
            DisconnectOnIdle               = $true;
            DisconnectOnIdleTimerInSeconds = 300;
            DisplayName                    = "macOS Corporate VPN";
            EnablePerApp                   = $false;
            EnableSplitTunneling           = $false;
            ExcludedDomains                = @("guest.contoso.com", "cdn.contoso.com");
            ExcludeLocalNetworks           = $true;
            IncludeAllNetworks             = $false;
            LoginGroupOrDomain             = "CONTOSO-EMPLOYEES";
            OnDemandRules                  = @(
                MSFT_MicrosoftGraphVpnOnDemandRule{
                    Action                = "connect"
                    DnsSearchDomains      = @("contoso.com", "corp.contoso.com")
                    DnsServerAddressMatch = @("10.10.0.10", "10.10.0.11")
                    DomainAction          = "connectIfNeeded"
                    Domains               = @("intranet.contoso.com", "portal.contoso.com")
                    InterfaceTypeMatch    = "wiFi"
                    ProbeRequiredUrl      = "https://vpnprobe.contoso.com/required"
                    ProbeUrl              = "https://vpnprobe.contoso.com"
                    Ssids                 = @("Contoso-Corp", "Contoso-Guest")
                }
            );
            OptInToDeviceIdSharing         = $true;
            ProviderType                   = "notConfigured";
            ProxyServer                    = MSFT_MicrosoftGraphVpnProxyServer{
                Address                          = "proxy.contoso.com"
                AutomaticallyDetectProxySettings = $false
                AutomaticConfigurationScriptUrl  = "https://proxy.contoso.com/proxy.pac"
                BypassProxyServerForLocalAddress = $true
                ODataType                        = "#microsoft.graph.windows10VpnProxyServer"
                Port                             = 8080
            };
            Realm                          = "CONTOSO.COM";
            Role                           = "Employees";
            RoleScopeTagIds                = @("0");
            SafariDomains                  = @("intranet.contoso.com", "portal.contoso.com");
            Server                         = MSFT_MicrosoftGraphVpnServer1{
                Address         = "vpn.contoso.com"
                Description     = "Zurich datacentre"
                IsDefaultServer = $true
            };
            Ensure                         = "Present";
            ApplicationId                  = $ApplicationId;
            TenantId                       = $TenantId;
            CertificateThumbprint          = $CertificateThumbprint;
        }
    }
}

Example 2

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        IntuneVPNConfigurationPolicyMacOS 'IntuneVPNConfigurationPolicyMacOS-Example'
        {
            Assignments                    = @(
                MSFT_DeviceManagementConfigurationPolicyAssignments{
                    dataType                                   = "#microsoft.graph.allDevicesAssignmentTarget"
                    deviceAndAppManagementAssignmentFilterType = "none"
                }
            );
            AssociatedDomains              = @("contoso.com", "corp.contoso.com");
            AuthenticationMethod           = "certificate";
            ConnectionName                 = "Contoso Corporate VPN (Zurich)"; # Updated Property
            ConnectionType                 = "ciscoAnyConnect";
            CustomData                     = @(
                MSFT_MicrosoftGraphKeyValue{
                    Key   = "tunnelGroup"
                    Value = "CONTOSO-EMPLOYEES"
                }
            );
            CustomKeyValueData             = @(
                MSFT_MicrosoftGraphKeyValuePair2{
                    Name  = "vpnProfile"
                    Value = "contoso-full-tunnel"
                }
            );
            DeploymentChannel              = "deviceChannel";
            Description                    = "Corporate VPN for managed Macs";
            DisableOnDemandUserOverride    = $true;
            DisconnectOnIdle               = $true;
            DisconnectOnIdleTimerInSeconds = 300;
            DisplayName                    = "macOS Corporate VPN";
            EnablePerApp                   = $false;
            EnableSplitTunneling           = $false;
            ExcludedDomains                = @("guest.contoso.com", "cdn.contoso.com");
            ExcludeLocalNetworks           = $true;
            IncludeAllNetworks             = $false;
            LoginGroupOrDomain             = "CONTOSO-EMPLOYEES";
            OnDemandRules                  = @(
                MSFT_MicrosoftGraphVpnOnDemandRule{
                    Action                = "connect"
                    DnsSearchDomains      = @("contoso.com", "corp.contoso.com")
                    DnsServerAddressMatch = @("10.10.0.10", "10.10.0.11")
                    DomainAction          = "connectIfNeeded"
                    Domains               = @("intranet.contoso.com", "portal.contoso.com")
                    InterfaceTypeMatch    = "wiFi"
                    ProbeRequiredUrl      = "https://vpnprobe.contoso.com/required"
                    ProbeUrl              = "https://vpnprobe.contoso.com"
                    Ssids                 = @("Contoso-Corp", "Contoso-Guest")
                }
            );
            OptInToDeviceIdSharing         = $true;
            ProviderType                   = "notConfigured";
            ProxyServer                    = MSFT_MicrosoftGraphVpnProxyServer{
                Address                          = "proxy.contoso.com"
                AutomaticallyDetectProxySettings = $false
                AutomaticConfigurationScriptUrl  = "https://proxy.contoso.com/proxy.pac"
                BypassProxyServerForLocalAddress = $true
                ODataType                        = "#microsoft.graph.windows10VpnProxyServer"
                Port                             = 8080
            };
            Realm                          = "CONTOSO.COM";
            Role                           = "Employees";
            RoleScopeTagIds                = @("0");
            SafariDomains                  = @("intranet.contoso.com", "portal.contoso.com");
            Server                         = MSFT_MicrosoftGraphVpnServer1{
                Address         = "vpn.contoso.com"
                Description     = "Zurich datacentre"
                IsDefaultServer = $true
            };
            Ensure                         = "Present";
            ApplicationId                  = $ApplicationId;
            TenantId                       = $TenantId;
            CertificateThumbprint          = $CertificateThumbprint;
        }
    }
}

Example 3

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        IntuneVPNConfigurationPolicyMacOS 'IntuneVPNConfigurationPolicyMacOS-Example'
        {
            DisplayName           = "macOS Corporate VPN";
            Ensure                = "Absent";
            ApplicationId         = $ApplicationId;
            TenantId              = $TenantId;
            CertificateThumbprint = $CertificateThumbprint;
        }
    }
}