Enforce VPN usage across your organization with Always-on VPN. This Proton VPN for Business feature is available on the following plans:

• VPN Professional
• VPN and Pass Professional
• Workspace (any)

Currently, Always-on VPN allows you to enforce VPN usage across Windows devices only.

• How to configure Always-on VPN
• How to deploy Always-on VPN
• Deploy via MDM
• Deploy via PowerShell
• Deploy manually
• How to remove Always-on VPN from a device
• De-provisioning users

Prerequisites

All target devices must be have the latest version (minimum 5.3.0) of our Windows app installed. As an administrator, you can deploy these across your organization using MDM.

How to configure Always-on VPN

1. Sign in to account.proton.me and select the VPN app.

2. Go to VPN → Always-on VPN and select Configure Always-on VPN.

3. Click Generate device profile.

How to deploy Always-on VPN

Once your device profile has been generated, it needs reach C:\Program Files\Proton\VPN\Policies on every device where you wish to enforce VPN usage. The Proton VPN client will detect it there and enforce the profile automatically.

You can deploy the profile via:

• Your MDM platform (recommended)
• Running a PowerShell script on each target Windows device
• Manually

To access the necessary files and instructions on how to deploy your profile at any time, go to VPN → Always-on VPN → Deploy device profile to your devices → Instructions.

1. Deploy via MDM

Either:

• Deploy protonvpn-deviceprofile.rego(jendela baru) directly via your MDM file deployment
• Or run the generated .ps1 script via your MDM script execution

2. Deploy via PowerShell

1. Download the protonvpn-install-xxxxx.ps1 script file to each target Windows device.

2. Right-click on the file

3. Select Run with PowerShell

3. Deploy manually

1. Download the protonvpn-deviceprofile.rego(jendela baru) file to every device where you wish to enforce VPN usage, download

2. On each device, open Explorer and navigate to C:\Program Files\Proton\VPN\Policies.

3. Drag the protonvpn-deviceprofile.rego(jendela baru) file into the Policies folder.

How to remove Always-on VPN from a device

Enforcement stops when the profile file is deleted from the device.

Delete protonvpn.rego from C:\Program Files\Proton\VPN\Policies using any of the following:

• MDM: Remove the file through the same file-deployment or script mechanism you used to deploy it (recommended)
• Powershell script: Generate run protonvpn-deviceprofile-remove.ps1 on the device
• Manually: Open Explorer, go to C:\Program Files\Proton\VPN\Policies, and delete the file

You can generate a powershell script to aid in this as follows.

1. Sign in to account.proton.me and select the VPN app.

2. Go to VPN → Always-on VPN and select Delete device profile from the menu.

3. Run the generated powershell script (protonvpn-deviceprofile-remove.ps1).

De-provisioning users

If you remove a user from your organization while Always-on VPN is still enforced, the device will be effectively locked until an admin signs in locally on the device. This means you can’t remote wipe the device.

So when removing a user, you should:

• Remove the device profile (as described above) or delete the Proton VPN app from the managed device
• De-provision the user in your MDM admin console.

Doing this in the reverse order prevents the device from connecting to the internet, preventing any kind of remote management.