MobileIron Tunnel installation on macOS

MobileIron Tunnel is distributed to macOS devices from MobileIron Core using Apple Volume Purchase Plan (VPP). For information on distributing MobileIron Tunnel for macOS, see

No user action is required for installing MobileIron Tunnel on macOS. The app is automatically installed on macOS devices when the administrator applies the VPP label to the app in the app catalog in MobileIron Core. Users see the Tunnel icon on the top menu bar. The Tunnel icon is also seen on the Launchpad. However, Tunnel cannot be launched from the Launchpad.

Allow keychain

When users access enterprise resources from a Safari browser or a managed app to which the Tunnel VPN configuration is applied, MobileIron Tunnel is automatically used to secure access to the enterprise resource. The experience is seamless to the end user. However, when the Tunnel is first pushed to the device or when the Tunnel configuration is re-pushed to the device, macOS prompts users to authorize the key. When prompted to authorize, click Allow.

Figure 1. Allow keychain

IMPORTANT: . If users either click Deny or ignore the prompt, the dialog is presented the next time Tunnel tries to connect.

Note The Following:  

  • If Tunnel is in use, the app cannot be removed from the device. Users will see the following message: The item MITunnel can’t be moved to the Trash because some of its extensions are in use.
  • Per app VPN connection status is not provided on macOS.
  • For countries for which a VPP program is not available, device users can download and install MobileIron Tunnel directly from the Mac App Store.
  • Users cannot launch Tunnel from the Launchpad.