Contents

Introduction

This document describes how to configure Cisco Secure Client to automatically accept VPN and SEULA prompts to manage pop-ups.

Overview

You can configure Cisco Secure Client to launch automatically and accept essential VPN and SEULA (Software End User License Agreement) pop-up prompts without user interaction on Android devices using MDM solutions such as Cisco Meraki and Microsoft Intune. By enabling Always-On VPN and setting the SEULA acceptance property in your MDM, you eliminate the need for users to respond to VPN connection and SEULA pop-ups during initial deployment.

Note: For zero-touch deployment with Workspace One, see our documentation: Deploy the Android Client: VMware Workspace ONE

Settings Impacting Initial Launch

1. VPN Connection Request for Umbrella:

- The device must accept a connection request for Umbrella protection to start.

- You can auto-accept this by enablingAlways-On VPNin your MDM configuration.

2. SEULA Acceptance:

- The SEULA agreement must be accepted for the app to function.

- Set theaccept_seula_for_userproperty key totruein the Managed App Configuration in your MDM.

Configure Auto-Accept in Cisco Meraki MDM

Complete these steps for a fresh Android installation:

1. Configure and deploy the Cisco Secure Client application in your MDM.

2. EnableAlways-On VPNin MDM settings (do not enable Lockdown).

- If Lockdown cannot be disabled, Always-On VPN must also be turned off.

3. Push the Cisco Secure Client configuration properties to the application.

4. Verify installation and the VPN connection status (look for the key icon in the notification panel).

5. Test access to blocked websites to confirm Umbrella policy enforcement. Use a browser within the work profile for testing.

- Enable "Always-On VPN for Umbrella protection only" by setting thevpn_always_on_umbrella_onlyproperty.

- Use this setting if Umbrella is your only VPN.

- If using other VPNs, enable "VPN Always On" without restricting to Umbrella.

6. Enableaccept_seula_for_userto auto-accept the SEULA agreement. This is independent of the Always-On VPN setting.

Important: If you launch the app before pushing the Always-On VPN configuration, the VPN connection request pop-up will still appear. Ensure Always-On VPN is configured and pushed before first launch to prevent this.

Configure Auto-Accept in Microsoft Intune

1. Create a VPN profile and a device restrictions profile with the Always-On VPN setting enabled.

2. Assign these profiles to your target groups.

3. Select a VPN client that supports Always-On. You can choose either "Cisco AnyConnect" or specify a "Custom" client by entering the package ID of the app in the Google Play store as "com.cisco.anyconnect.vpn.android.avf" (Cisco AnyConnect VPN application specifically for Android devices).

4. Set the SEULA acceptance property and Always-On VPN.