Android Work Profile – VPN DNS Resolution not enforced with GlobalProtect (DNS leaking to Google DNS)

Question

We have an Android app developed using Kotlin Jetpack Compose, which is distributed through Microsoft Intune and installed from the Company Portal.

The app works perfectly when connected to the organization’s Wi-Fi network. However, when using the same app over another network (for example, home Wi-Fi) while connected through the GlobalProtect VPN, the app fails to connect — it seems to be a DNS resolution issue.

Important note: We are not using the Intune SDK in our Android project. The app is only managed through Intune and installed from the Company Portal.

Could you please help us ensure that all DNS resolution for our Intune-managed work profile app is routed strictly through the VPN (GlobalProtect) instead of Google’s DNS?

Answer 1

Hello Jainish Suthar,Few things to note here,

1. VPN connection is not automatically triggered when the app opens. Connection must be started manually, or you need to use always-on-VPN. Refer to: https://learn.microsoft.com/en-us/intune/intune-service/configuration/vpn-settings-android-enterprise#always-on-vpn-fully-managed-dedicated-and-corporate-owned-work-profile
2. Try configuring the per-app VPN for your app and check. Refer to: https://learn.microsoft.com/en-us/intune/intune-service/apps/app-configuration-vpn-ae#per-app-vpn-overview

Hope this helps!

If you found the information above helpful, please Click Yes. This will assist others in the community who encounter a similar issue, enabling them to quickly find the solution and benefit from the guidance provided.