---
title: OpenVPN Connect macOS Network Extension
canonical: https://openvpn.net/connect-docs/macos-network-extension/
product: OpenVPN Connect Docs
description: OpenVPN Connect 3.9.0 for macOS introduces Network Extension, Apple's native VPN framework — covers activation steps, MDM deployment via Jamf Pro and Microsoft Intune, terminal management with scutil --nc, and known limitations including hardware token reassignment.
---

# OpenVPN Connect macOS Network Extension

## Overview

Starting with OpenVPN Connect 3.9.0 for macOS, VPN connections use **Network Extension**, Apple’s native VPN framework. Network Extension replaces the previous background process that required elevated system permissions to manage the VPN tunnel.

The way you use OpenVPN Connect doesn’t otherwise change. You can continue to import and manage connection profiles, authenticate, and connect from the OpenVPN Connect app.

Network Extension also integrates VPN connections with macOS. After activation, your OpenVPN Connect connection profiles appear in **System Settings → VPN**, where you can connect without opening OpenVPN Connect. You can also manage VPN connections from Terminal with `scutil --nc`.

For the complete list of changes in OpenVPN Connect 3.9.0, refer to [macOS Release Notes](https://openvpn.net/connect-docs/macos-release-notes.md). For more information about the framework itself, refer to [Apple’s Network Extension documentation](https://developer.apple.com/documentation/networkextension).

## How Network Extension changes OpenVPN Connect

With Network Extension:

- OpenVPN Connect uses the macOS Network Extension framework to manage VPN tunnels.
- Your existing OpenVPN Connect workflow for connection profiles, authentication, and VPN connections remains the same.
- OpenVPN Connect connection profiles appear in **System Settings → VPN**.
- You can connect or disconnect from **System Settings** without opening OpenVPN Connect.
- You can monitor and interact with VPN connections from Terminal using `scutil --nc`.

After you approve Network Extension the first time, OpenVPN Connect automatically applies extension updates with future app releases. You don't need to repeat the approval process.

## Before you begin

Ensure you’ve installed or updated to OpenVPN Connect 3.9.0 or newer. Refer to [How to Install OpenVPN Connect on macOS](https://openvpn.net/connect-docs/macos-installation-guide.md) for installation and update instructions.

Activating Network Extension interactively requires **administrative privileges** on the Mac.

If you deploy OpenVPN Connect to **non-admin users**, preapprove the OpenVPN Connect system extension with a mobile device management (MDM) solution before users launch the updated app. This lets macOS activate the extension without requiring an administrator to approve it on each device.

## Activate Network Extension

After installing or updating OpenVPN Connect, activate Network Extension the first time you open the app:

1. Launch OpenVPN Connect.
   - OpenVPN Connect prompts you for permission to activate Network Extension.
2. Select **Open System Settings**.
3. In **System Settings**, allow the OpenVPN Connect system extension when macOS prompts you.
4. When macOS prompts you to add the VPN configuration, approve the request.
   - After activation, OpenVPN Connect uses Network Extension for VPN connections.

## Verify Network Extension

To verify that the VPN configuration is available to macOS:

1. Navigate to **System Settings → VPN**.
2. Confirm that your OpenVPN Connect connection profiles appear.
3. Connect to a profile from **System Settings**, or open OpenVPN Connect and connect as usual.

You can also use `scutil --nc` in Terminal to monitor and interact with VPN connections. Run the following command to view the available `scutil --nc` commands:

```
scutil --nc help
```

## Preapprove Network Extension for non-admin users

If your users don’t have administrative privileges, use MDM to preapprove the OpenVPN Connect system extension.

The system extension uses these identifiers:

| **Identifier** | **Value** |
| --- | --- |
| Team ID | `ACV7L3WCD8` |
| System extension bundle identifier | `org.openvpn.client.app.nip` |
| System extension type | NetworkExtension |

Preapproving the extension avoids requiring an administrator to approve Network Extension interactively on each managed Mac.

If you also manage OpenVPN Connect settings and connection profiles through MDM, refer to [Global Configuration File Support for macOS](https://openvpn.net/connect-docs/macos-global-configuration-file-support.md).

### Preapprove the system extension with Jamf Pro

To configure the OpenVPN Connect system extension in Jamf Pro:

1. In Jamf Pro, navigate to **Computers → Configuration Profiles**, then select **+ New**.
2. Configure **General:**
   - **Name:** Enter `OpenVPN Connect – System Extension`
   - **Level:** Select **Computer Level**.
   - **Distribution Method:** Select **Install Automatically**.
3. Select **System Extensions → Configure**.
4. Add these system extension entries:

   | **Display Name** | **System Extension Types** | **Team ID** | **Value** |
   | --- | --- | --- | --- |
   | OpenVPN Connect Extension | Allowed System Extensions | `ACV7L3WCD8` | `org.openvpn.client.app.nip` |
   | OpenVPN Connect Type | Allowed System Extension Types | `ACV7L3WCD8` | Network Extension |
5. Leave **Allow users to approve system extensions** cleared if you don't want users to approve additional system extensions that aren't included in your configuration profiles.
6. Open **Scope** and add the computers or computer groups that should receive the profile.
7. Select **Save**.
   - Jamf Pro deploys the system extension configuration to the targeted Macs.

### Preapprove the system extension with Microsoft Intune

Use the Microsoft Intune Settings catalog to configure the OpenVPN Connect system extension:

1. In the Microsoft Intune admin center, navigate to **Devices → Configuration**.
2. Select **Create → New Policy**.
3. Configure the policy:
   - **Platform:** Select **macOS**.
   - **Profile type:** Select **Settings catalog**.
4. Select **Create**.
5. On **Basics**, enter a descriptive name such as `OpenVPN Connect – System Extension`, then select **Next**.
6. On **Configuration settings**, select **Add settings**.
7. Search for `allowed system`, then select **System Configuration → System Extensions**.
8. Add these settings:
   - **Allowed System Extensions**
   - **Allowed System Extension Types**
9. Configure **Allowed System Extensions**:

   | **Setting** | **Value** |
   | --- | --- |
   | Team Identifier | `ACV7L3WCD8` |
   | Allowed System Extensions | `org.openvpn.client.app.nip` |
10. Configure **Allowed System Extension Types**:

    | **Setting** | **Value** |
    | --- | --- |
    | Team Identifier | `ACV7L3WCD8` |
    | Allowed System Extension Types | `NetworkExtension` |
11. If your organization wants to prevent users from approving additional system extensions that aren’t included in your MDM configuration, add **Allow User Overrides** and set it to `False`.
12. Continue to **Assignments** and add the device group that should receive the policy.
13. Review the configuration, then select **Create**.
    - Intune deploys the system extension policy the next time the targeted devices check in.

## Known limitations

### Hardware tokens and YubiKey

If a connection profile uses a certificate and key pair stored on a hardware token such as a YubiKey, the certificate and key pair are detached from the connection profile when you move to Network Extension.

Open OpenVPN Connect and reassign the certificate/key pair from the hardware token to the affected connection profile.

### Terminal deployment

You can’t activate or approve Network Extension with Bash or other Terminal commands.

For managed deployments, use an MDM system extension payload to preapprove the OpenVPN Connect system extension.

## Related resources

- [Release notes for OpenVPN Connect on macOS](https://openvpn.net/connect-docs/macos-release-notes.md)
- [How to Install OpenVPN Connect on macOS](https://openvpn.net/connect-docs/macos-installation-guide.md)
- [Global Configuration File Support for macOS](https://openvpn.net/connect-docs/macos-global-configuration-file-support.md)
- [Manage OpenVPN Connect from the Command Line](https://openvpn.net/connect-docs/command-line-functionality-macos.md)
- [Frequently Asked Questions](https://openvpn.net/connect-docs/macos-faq.md)
- [macOS Security FAQs](https://openvpn.net/connect-docs/macos-security-faq.md)

---

Prev: [Settings](https://openvpn.net/connect-docs/app-settings-macos.md)
Next: [Command-Line Functionality](https://openvpn.net/connect-docs/command-line-functionality-macos.md)
Index: https://openvpn.net/connect-docs/llms.txt