Why an iOS VPN Profile Stays Locked, and How to Remove It
An iOS VPN entry belongs to an app or a signed profile. Read the owner in Settings, remove the right object, and revoke what local deletion leaves alive.
Removing a VPN entry on an iPhone or iPad fails for one of two reasons, and neither of them is a stuck toggle. Either the entry was installed by a device management service and the Remove control was never yours to press, or an app you still have installed treats the configuration as its own and writes it back the next time it launches. Both kinds sit in nearly the same place in Settings, so people delete the same row three times and blame iOS. Identify the owner of the object first, then remove it the way that owner allows.
Two objects share one settings row
An app-created VPN is built through the NetworkExtension framework. The app assembles a configuration in code, saves it to the system store, and iOS lists it under VPN with a status switch. The app stays the owner of that record: it can update it later, attach connect-on-demand rules, or add it again after you delete it. Recent iOS versions ask for confirmation when an app wants to add a VPN configuration, and that prompt is where the ownership is granted.
A configuration profile is a different object. It is a signed file, normally a .mobileconfig, that can carry a VPN payload alongside Wi-Fi settings, certificates, restrictions and mail accounts. Someone installs it from a download or through Apple Configurator, or a management service pushes it. The profile is the unit of removal, not the VPN row. iOS does not offer to delete one payload out of a signed profile, so removing it takes everything else in that profile with it.
The two look similar at the top level and behave nothing alike, so match what you see against this table before changing anything.
| What you see | Usual owner | Who can remove it |
|---|---|---|
| VPN row with an app name and a status switch | The app, through NetworkExtension | You, in Settings, or the app itself |
| Profile with a VPN payload and a Remove button | You, or whoever handed you the file | You, from the profile screen |
| Profile with no Remove button and an organization name | A management server | The organization that enrolled the device |
Read the owner from Settings
On current iOS and iPadOS versions the list is under Settings, General, VPN & Device Management; older versions called the same screen Profiles. Open the profile and read the detail screen before touching anything. A line naming the organization, or the words Managed by, means the profile arrived from a management server. A Remove Profile button means this installation is removable by hand, which does not yet tell you whether the server will push it back at the next check-in.
Then check the VPN section of that same screen. Entries created by apps show the app name next to them, and the info button opens the configuration with its own Delete VPN option. A row whose details name a payload rather than an app belongs to a profile and has to be handled there. Turning the status switch off is not removal: the configuration stays saved, and a connect-on-demand rule can raise the tunnel again the moment a matching network appears.
Removing a personal configuration that keeps returning
Open the VPN entry, tap the info button, choose Delete VPN, and confirm. If the entry is back after a relaunch, the app is recreating it, which is designed behavior rather than a bug. Stop the recreation at the source: turn off connect-on-demand inside the configuration, decline the approval prompt if the app asks to add the configuration again, or uninstall the app once you no longer need it. Remove the entry before uninstalling, because an uninstalled app can leave a saved configuration behind with nothing left to manage it.
When the vendor shipped a profile instead of a NetworkExtension configuration, it appears in the same profile list under the vendor’s name. Remove the profile first, then the app. Do not delete unrelated certificates to weaken the configuration: a certificate in that list may be trusted by mail, Wi-Fi or internal sites, and removing it breaks more than the tunnel.
When device management holds the profile
A management server installs a profile with an install command and removes it with a matching remove command. Until that happens the profile is not the device’s to delete, and a managed profile that can be removed locally is usually pushed again at the next check-in. Erasing the device does not change the assignment either. With automated enrollment the serial number is tied to the organization, so Setup Assistant enrolls the device again and the same profile lands before you reach the home screen.
The way out is administrative. Ask the administrator to remove the device record from the management service, which retires the enrollment and stops future installs, or to delete just the VPN profile from the assignment if the device should stay managed without it. For a device leaving the organization, ask for both: the enrollment removed and the VPN account or certificate revoked. Local deletion alone leaves credentials that still authenticate from a copy of the profile somewhere else.
If the profile is still listed after the server-side change, restart the device and read the list again before erasing anything. Some removals only land when the device next checks in, and a restart forces that conversation.
Verify, then revoke what removal did not
After the entry is gone, confirm three things in order: the VPN list no longer holds the configuration, the profile list no longer shows the profile that carried it, and a restart brings back neither. A configuration that reappears after a restart points at an owner you have not found, not at a failed deletion. Then test the access you meant to end: a request to an internal host should fail, and the status area should stay idle.
Removal is local; revocation is not. Delete or disable the user’s VPN account on the server, revoke the certificate the profile carried, and clear saved credentials the app kept in the keychain. Apple’s guide to installing and removing configuration profiles covers the on-device path for each iOS version; the management side is where the remaining authority sits. Record what was removed, who approved it, and whether the account was revoked, because the next person to hold this device meets the same two objects.