Workspace ONE UEM: Is the Tunnel app mandatory for Per-App VPN on Android, or can a custom VPN client be used?

3 days ago 8

I’m working with Workspace ONE UEM (AirWatch) and Android Enterprise devices.

Requirement:
Enable Per-App VPN so that only selected apps’ traffic goes through a VPN tunnel, while other apps bypass it.

Questions:

1. Does Workspace ONE UEM support Per-App VPN on Android only through the Workspace ONE Tunnel app?

2. Is it possible to configure Per-App VPN for a custom VPN client (IKEv2/IPSec, strongSwan-based)?

3. If Workspace ONE cannot manage Per-App VPN for custom apps, is the alternative to implement custom routing logic inside Android’s VpnService?

4. Has anyone successfully integrated a third-party or custom VPN client with Workspace ONE’s Per-App VPN profile?

Looking for confirmation from someone who has implemented Per-App VPN with Workspace ONE on Android.

Hidden in mobile, Best for skyscrapers.