You Sent One VPN Profile to Everyone and It Has Your Password

The profile installs cleanly, everybody connects, and then the account password rotates. Every device that received the file stops authenticating at the same minute, because they all carry the same secret. That is the tell: one credential copied into a shared artifact turns a routine password change into a fleet-wide outage. Keeping the reusable configuration and the individual identity as two separate handoffs avoids it, and Apple's own device-management documentation treats profiles as settings and authorization, not as a secret store.

The symptom appears at the first rotation

A mobileconfig file is XML or a signed plist. Anyone holding a copy can decode the payload and read what is in it, so an AuthPassword value in a template is a plaintext credential with an unusual file extension. Signing changes integrity and origin, not readability. Meanwhile the parts you genuinely want to share, such as the gateway address, the expected server identity and the traffic policy, are identical for everyone.

Sort the fields before editing anything, because the boundary is not where people assume it is.

Sort shared settings from individual credentials

The interactive path is to leave the password out and let the supported authentication arrangement prompt for it. Read that carefully: deleting a field that merely looks similar is not a universal conversion to interactive login. The IKEv2 payload distinguishes AuthName from AuthPassword, and the authentication method decides whether a prompt is even reachable; a certificate-based method will not ask for a password at all.

Certificates do not need a shared key either

If the gateway expects certificate authentication, enroll the intended user or device identity through the approved mechanism and keep the private key out of the template. One shared private key inside every copy gives you the same rotation problem with a worse blast radius, because a key cannot be revoked per person unless it was issued per person.

Record issuance, renewal and revocation for that identity alongside the profile revision. When the two are tracked together, a renewal is a scheduled task instead of an incident.

Unattended machines need a third answer

A machine that has to connect before anyone signs in cannot answer a prompt. That is a different requirement from making setup easier for a signed-in person, and it should be solved with a managed identity or a per-device certificate agreed with the gateway owner, not by storing a human password in a profile.

Storing a password does not remove a second factor either. If the gateway requires MFA, a profile with a saved password still fails at boot, and the failure looks like a broken profile rather than a missing factor.

Check the artifact that was actually generated

Templates lie by omission. A management service or export tool can inject credentials into the finished file, and accompanying identity payloads or diagnostic copies can carry material the template never showed. Open the generated artifact before deciding who may receive it. Keep the trusted issuer and expected server-identity settings intact as well; removing a password is not a reason to weaken gateway trust.

If a real password or private identity has already travelled too widely, revoke it at the issuer and replace it. Editing tomorrow's template does nothing to the copies already installed, and those copies will keep authenticating until the credential behind them is withdrawn.

Accept the handoff with a test identity

Install through the approved flow on a device enrolled as a separate test identity, complete the intended authentication, and reach the private resource rather than just watching the tunnel come up. Confirm that the profile contains no credential material, then confirm the credential exists in the identity record that will be renewed. That pairing is the acceptance test.

One revision for shared settings, one record per person, and a revocation path you have actually used once.