Global Protect Per-App VPN in Intune for Andoid devices

OSokol — Fri, 17 Sep 2021 15:07:11 GMT

I need to resolve the following task:

when user start Google Chrome or Edge browser on Android device traffic only from this applications routed via VPN,
all other just for instance, Microsoft Teams or Outlook should goes directly to Internet.
Mobile devices are enrolled in Intune with Android Fully Managed Profile
My approach is:
I'm try to configure a Per-App VPN with App Configuration Policy for fully managed Android devices policy config

In App List parameter put an application ID of google chrome browser and put in allow list

With user-logon Connection method when user start the phone there is notification that Always-On is enabled, but in Intune device restriction profile Always-On option is disabled
And all traffic from all applications and browser goes via VPN tunnel
With On-demand Connection Method user need manually start Global Protect VPN client but that's not a good idea because in other case user will have a full access to Internet.
OS version of Global Protect Gateway is PanOS 9.1.9

topic Global Protect Per-App VPN in Intune for Andoid devices in GlobalProtect Discussions

Global Protect Per-App VPN in Intune for Andoid devices