Enforce Routes capability in Apple VPN profiles

What changed

Admins define routing behavior with Include all networks and Exclude local networks , and Intune automatically derives the appropriate Enforce Routes configuration. This helps reduce VPN traffic bypass and de-cloaking risks while keeping routing behavior consistent with Apple's platform semantics.

Why it matters

VPN routing controls can reduce traffic bypass on managed Apple devices.

Known limitations

• Availability, prerequisites and rollout scope remain authoritative in the linked Microsoft documentation.

Now check

• Review Include all networks and Exclude local networks in existing Apple VPN profiles.
• Pilot routing with corporate and local destinations on supported iOS/iPadOS and macOS devices.
• Verify expected VPN connectivity and application access before broad assignment.