Configure Versa SASE with Ivanti for IOS and MacOS

Create a PLIST File

Create a file that contains the key-value pairs for your configuration. Use a plain text editor or a dedicated .plist editor to create this file. Save it with a .plist extension (for example, versa_sase_config.plist). 

For each configuration parameter, enter a key and corresponding value, as shown in the example below. Replace the variables with values with your actual environment. 

XML
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>device_id</key>
        <string>${deviceGUID}</string>
        <key>fqdn</key>
        <string>replace with your portal FQDN</string>
        <key>enterprise_name</key>
        <string>replace with your enterprise name</string>
        <key>user_id</key>
        <string>${userEmailAddress}</string>
        <key>device_name</key>
        <string>${deviceName}</string>
        <key>managed_device</key>
        <true/>
        <key>default_browser</key>
        <false/>
        <key>is_versa_root_ca_required</key>
        <true/>
        <key>skip_onboarding_screens</key>
        <false/>
        <key>auto_logon</key>
        <true/>
        <key>fetch_username_from_certificate</key>
        <false/>
        <key>ekuid</key>
        <true/>
        <key>eku_id_devicecert</key>
        <string>{EKU Authentication ID to be matched}</string>
        <key>eku_id_usercert</key>
        <string>{EKU Authentication ID to be matched}</string>
</dict>
</plist> 

Upload a PLIST File for App Configuration (IOS)

Use app configuration for user-specific parameters, such as email address and tenant name, so the app is pre-configured when it launches.

To upload the .plist file for app configuration:

1. In Ivanti Neurons for MDM, click Apps > App Catalog.
2. Select the Versa SASE application (for iOS platform).
3. Click the App Configurations tab.
4. In the Apple Managed App Configuration section, click the + icon.
   
   
5. Enter a Name for the Configuration Setup.
6. In the Apple Managed App Settings section, upload the configuration using one of the following methods:
   • To upload a .plist file, click Use .plist. Ivanti parses the file and displays the keys in a table.
   • To manually enter each key-value pair, click + Add. For a full list of keys, see Obtain the Configuration Parameters.
     
     
7. In Distribute this App Config, select one of the following options: Everyone with App, No One, or Custom.
8. Click Save.

Upload a PLIST File for System Preferences (MacOS Custom Profile)

The following steps allow you to push the .plist file to the /Library/Preferences folder on the device. Use this configuration type for system-wide settings or extensions.

To upload a .plist file for system preferences: 

1. In Ivanti Neurons for MDM, click Configurations > + Add.
2. Search for and select Custom.
3. In the Name field, enter macOS – Versa System Prefs.
4. Under Choose OS, select macOS.
5. In the Configuration Setup section, click Choose File and then upload your .plist file.
   
   
6. Click Next.
7. In step 2, Distribute, click the Enable this Configuration checkbox.
8. Select the appropriate channel for who the configuration applies to: 
   • Device Channel—Applies the profile at the system level, before any user logs in. Recommended for system extensions and VPN profiles.
   • User Channel—Applies the profile per logged-in user.
     
     
9. Choose one of the following options to define distribution:
   • All Devices
   • No Devices
   • Custom
10. Click Done.

Upload the Versa SASE Application Package

1. Log in to your Ivanti Neurons for MDM console.
2. Select Apps > App Catalog.
3. Click + Add.
4. Select In-House as the app type.
5. Drag and drop the Versa SASE .pkg file.
   
   
6. Click Next.
7. In the Package Apps section, select com.versa.systemextension as the primary application.
   
   
8. Click Next.
9. In step 3, Add Screenshots, you can upload images to add screenshots, or you can skip this step.
   
   
10. Click Next.
11. In step 4, Delegate, select Do not delegate this app.
    
    
12. Click Next.
13. In step 5, Distribute, select a distribution group.
    
    
14. Click Next.
15. In step 6, Configure, click the + icon next to Install on device.
    
    
16. In the Configuration Setup page, enter the following information:
     

    Field	Description
    Name	Enter the following value: Install Application configuration settings.
    Description (Optional)	Click + Add to enter a description. This allows specifying install settings for an application.
    Device Installation Configurations	Click the toggle to the On position, and then select Require installation on device.
    Set App Install Priority	Select High.

    
    
17. In Distribute this App Config section, select the same group used in step 5, Distribute.
18. Click Done.

Configure VPN (Silent VPN Adapter)

A silent VPN adapter establishes a VPN tunnel in the background without requiring user interaction or approval prompts. The Versa SASE system extension functions as a packet tunnel provider, which macOS registers as a network interface and manages automatically.

To configure a packet tunnel provider for the Versa SASE system extension, you must use a Custom VPN setup in Ivanti Neurons for MDM. Use the provider bundle identifier com.versa.systemextension to support both SSL and IPsec-based tunnels. This ensures macOS treats the extension as a network interface.

Approve System Extension

You can prevent system extension blocked prompts from displaying. To do this, approve the Versa SASE system extension in Ivanti Neurons for MDM.

To approve system extension:

1. In Ivanti Neurons for MDM, click Configurations > Add.
2. Search for and select macOS System Extension.
3. In the Name field, enter Versa SASE - System Extension Approval.
4. In the Configuration Setup section, enter information for the following fields.
   
   
    

   Field	Description
   Allowed System Extensions (Group of fields)	Click + Add to activate the fields below.
   Allowed Team Identifiers	Enter the following value: 47J4JTFE29.
   Allowed System Extensions	Enter the following value: com.versa.systemextension.sslse.
   Allowed System Extension Types (Group of fields)	Click + Add to activate the fields below.
   Allowed Team Identifiers	Enter the following value: 47J4JTFE29.
   Allowed System Extensions Types	Enter the following value: Network extension.

5. Click Next.
6. In Distribution, select the target macOS device group.
7. Click Done.

Configure App Notifications

You can ensure critical security alerts are visible and prevent Allow Notifications prompts from displaying. To do this, you deploy an app notifications configuration for the Versa SASE client.

To configure app notifications:

1. In Ivanti Neurons for MDM, click Configurations > Add.
2. Search for and select App Notifications.
3. In the Name field, enter the following value: macOS - Versa Notifications.
4. In the Configuration Setup section, click Add Apps, and then click the Add Manually tab.
   
   
5. In the Bundle Id / Package Id field, enter the following value: com.versa.systemextension. Then, click Add To List.
6. Repeat the previous step to add com.versa.versasase (required if using the standard GUI app).
7. Enter information for the following fields.
    

   Field	Description
   Notification Settings (Group of fields)	Select the following options: Allow Notifications Show in Notification Center Sounds Badge App Icon Show on Lock Screen Show the critical alert when using CarPlay
   Unlock Alert Style	Click the drop-down list and select Banners.
   Grouping Type	Click the drop-down list and select Automatic.
   Preview Type	Click the drop-down list and select User Controlled.

8. Click  Next.
9. In Distribution, assign the configuration to your macOS device group.
10. Click Done.

Enroll MacOS Devices

To enroll MacOS devices, you must create a distribution in Ivanti Neurons for MDM.

To create a distribution:

1. In Ivanti Neurons for MDM, click Apps> App Catalog.
2. Click Versa SASE, and then click Distribution.
3. Click Edit.
4. In Distribution, select the target user group or device group — for example, Everyone.
   
   
5. Click Save.
6. Click Configurations, click your Versa SASE configuration, and then click Edit.
7. In Distribution, select the same group used for the application.
8. Click Save.

Create a User and Enroll the Device

1. Log in to the Ivanti Admin Portal with your admin credentials.
   
   
2. Click Users, and then click + Add.
   
   
3. Fill in the user credentials (username and password). Note these for later steps.
   
   
4. The enrolled user receives an invitation email from Ivanti with a link to download the MDM enrollment profile. Alternatively, the user can download the Ivanti Go app directly from the App Store.
5. On the target iPhone or iPad, open the enrollment link or launch the Ivanti Go app and sign in with the credentials created in Step 3.
6. Complete the enrollment process on the device. The device is now managed under Ivanti Neurons MDM.

Upload and Distribute the Versa SASE IOS Application

1. Return to the Ivanti Admin Portal.
2. Click Apps > App Catalog.
   
   
3. Click + Add.
4. Select In-House to upload the IPA application package.
   
   
5. Click Choose File and upload the Versa SASE .ipa file.
6. Select the appropriate Category for the application and add an optional description.
7. Upload screenshots of the application if required.
8. Select Do not delegate this app.
9. Select Custom and choose Devices / Specific Devices to deploy to selected devices only.
   
   
10. Under Apple Managed App Configuration, click the + icon.
    
    
11. Enter a configuration name.
12. Upload the configuration parameters using one of the following methods:
    • Select Use .plist, click Choose File, and upload your .plist file. 
    • Alternatively, click Add+ to manually enter each key-value pair. For a list of keys and their corresponding values, see Obtain the Configuration Parameters.
13. Click Done.
14. Go to Apps > App Catalog, and select the newly-added Versa SASE application.
    
    
15. Click the three-dot menu and select Send Install/Update Request.
16. Select the checkboxes for both Install and Update requests.
17. Choose the target devices, and then click Send.
    
    
18. The enrolled device displays a popup notification prompting the user to install the application.
    
    
    
    The following screen displays when you open the application for the first time.
    
    

Sample PLIST File for IOS App Configuration

The following is a sample .plist for iOS app configuration:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>device_id</key>
    <string>${deviceGUID}</string>
    <key>fqdn</key>
    <string>Replace with your portal FQDN</string>
    <key>enterprise_name</key>
    <string>Replace with your Enterprise Name</string>
    <key>user_id</key>
    <string>${userEmailAddress}</string>
    <key>device_name</key>
    <string>${deviceName}</string>
    <key>managed_device</key>
    <true/>
    <key>PayloadRemovalDisallowed</key>
    <true/>
    <key>is_versa_root_ca_required</key>
    <true/>
</dict>
</plist>