# Deploy Security and VPN Apps > Install Mobile Threat Defense and VPN Apps silently on Android and Apple Devices, with servers, tenant IDs and tokens already configured from your Policy. Source: https://docs.applivery.com/en/device-management/integrations/security/deploy-security-vpn-apps/ • Last updated: 2026-11-06 **Key topics:** Mobile Threat Defense, VPN, Managed Properties, Always-On VPN, Applivery, AppConfig, Android Enterprise, Apple Business --- **TL;DR:** Add the App to a Policy as Force installed or Required for setup, and fill in its configuration so it works from the start. A security or VPN App only protects a Device once it's installed and configured. If that depends on the user, Devices stay unprotected for days, and typing errors end up as support tickets. From a Policy, you can install **Mobile Threat Defense (MTD)** and **VPN** Apps silently and send them their configuration, so the user doesn't have to type anything. :::info You can find specific guides for [Check Point Harmony Mobile](https://docs.applivery.com/en/device-management/integrations/security/checkpoint-harmony-mobile-integration/), [Check Point Harmony VPN](https://docs.applivery.com/en/device-management/android/policies/checkpoint-harmony-vpn/) on Android, [Check Point VPN](https://docs.applivery.com/en/device-management/apple/apple-policies/checkpoint-vpn/) on Apple, [Microsoft Defender](https://docs.applivery.com/en/device-management/android/app-management/microsoft-defender/) on Android and [Cloudflare WARP](https://docs.applivery.com/en/device-management/apple/macos/app-management/cloudflare-warp-deployment/) on macOS. ::: ## What you can preconfigure Each vendor decides which settings its App exposes and what they're called, so check its documentation. These are the most common:

Setting

What it's for

Server or gateway address

The VPN server or gateway the App connects to.

Tenant or customer ID

Identifies your organization in the vendor's console.

Token

Authorizes the Device with the vendor.

User and Device identifiers

Link the Device to its user in the vendor's console.

Auto-connect

Starts protection or the tunnel automatically.

For values that change on each Device, use [Dynamic Variables](https://docs.applivery.com/en/device-management/general-settings/dynamic-variables/) such as `{{device.serialNumber}}`, `{{device.udid}}`, `{{device.imei}}` or `{{user.email}}`. ## Deploy on Android **Add the App to your Policy** Once in the [**Applivery Dashboard**](https://dashboard.applivery.io/), go to **Policies** 1, select your Android Policy, and open **Apps** in the left-hand menu. Click **\+ Add App** and select the App in Managed Google Play. **Choose the install type** In **Install Type**, choose one of these: - **Force installed**: the App installs without user interaction and the user can't remove it. - **Required for setup**: the same, and Device setup doesn't finish until the install completes. ![harmony app](https://docs.applivery.com/int/_r2/media/09ac0a4e-3ad8-478f-9f15-3474973eec71/eb66541c-dcd8-4d8b-9778-8f49f44b8e91.png) **Fill in the Managed Properties** Fill in the properties that the App exposes with the values from your vendor. You can learn more about **Managed Properties** by following this [link.](https://docs.applivery.com/en/device-management/android/app-management/managed-apps-properties/) **Force the VPN connection** If it's a VPN App, select **Network** in the left-hand menu and go to **AlwaysOn Vpn Package** 2. Enter the App's package name in **Package Name**. Turn on **Lockdown Enabled** if you want to block network traffic whenever the VPN isn't connected. ![always-on vpn package](https://docs.applivery.com/int/_r2/media/09ac0a4e-3ad8-478f-9f15-3474973eec71/f1d22d30-18cf-4cbe-a229-72e66f2c567d.png) :::info The VPN App must be force-installed through the Policy before this setting takes effect. ::: **Save the Policy** Click **Save changes**. Managed Properties and Always-On VPN are also available on [AOSP](https://docs.applivery.com/en/device-management/android/aosp/) Devices. ## Deploy on Apple **Get the App licenses** Get the licenses you need in Apple Business and sync them with Applivery. You can learn more about **VPP** by following this [link.](https://docs.applivery.com/en/device-management/apple/app-management/vpp/) **Add the App to your Policy** Once in the [**Applivery Dashboard**](https://dashboard.applivery.io/), go to **Policies**, select your Apple Policy and open **Apps**. Click **\+ Add App** and select the App. **Choose the install mode** In **Install mode**, select **Force installed** or **Required for setup**. On [Supervised Devices](https://docs.applivery.com/en/device-management/apple/supervision/), the App installs silently. **Add the App configuration** On iPhones and iPads, add the keys and values from your vendor in the **Configuration** field. Click **Add property** to add them one by one, or **Define as JSON** to paste them all at once. ![harmony mobile protect configuration](https://docs.applivery.com/int/_r2/media/09ac0a4e-3ad8-478f-9f15-3474973eec71/47b4a1a0-b6b9-4e8b-b4e0-e5c3e910553f.png) On a Mac, use the method your vendor documents. For example, [Cloudflare WARP](https://docs.applivery.com/en/device-management/apple/macos/app-management/cloudflare-warp-deployment/) is configured with a configuration profile. **Add the VPN configuration** If your App needs a VPN configuration, click **\+ Add configuration** and choose **VPN**. Fill in the fields with the values from your vendor. These are the ones that identify the App: - **Provider Type**: `Packet-tunnel`. - **VPN Subtype**: the identifier your vendor gives you. - **Vendor Config**: the JSON parameters from your vendor. - **Account Username**: you can use a Dynamic Variable such as `{{user.email}}`. ![vpn](https://docs.applivery.com/int/_r2/media/09ac0a4e-3ad8-478f-9f15-3474973eec71/e0d19974-6738-4e7d-9bd0-30ce18a46b4f.png) **Connect the VPN automatically** Turn on **Enable VPN On Demand**. In **On-Demand Rules**, add a rule with the **Connect** action for each type of connection: Wi-Fi and Mobile, plus Ethernet for wired connections. The tunnel then connects by itself, with no action from the user. **Add the certificate** If your gateway uses a private certificate authority, click **\+ Add configuration**, choose **Certificate (Trusted CA),** and upload the certificate in **Payload Content**. **Save the Policy** Save the Policy and deploy it. ## Best practices - **Keep security in its own Policy**: use [Policy Composition](https://docs.applivery.com/en/device-management/general-settings/policy-composition/) to separate these settings from the ones each department needs. - **Test before you roll out**: create a [Device Audience](https://docs.applivery.com/en/device-management/general-settings/device-audiences/) with a few test Devices and check that the values reach the App correctly. - **Check your licenses**: make sure Apple Business has enough licenses so installs don't get stuck. - **Apply a stricter Policy to at-risk Devices**: if you mark those Devices with a [Device tag](https://docs.applivery.com/en/device-management/general-settings/device-tags/), an [Automation Rule](https://docs.applivery.com/en/device-management/general-settings/automation-rules/) can select them and apply a stricter Policy with **Set a Policy**. Automation Rules don't send commands, so they can't lock or wipe a Device.