macOS

To distribute the Twingate macOS Client with Workspace ONE, you will need to distribute Twingate as a non-App Store app. Follow Workspace ONE’s official documentation to configure and distribute Twingate. To deploy a package, you’ll need to upload a PKG to Workspace ONE. You can download the Twingate PKG installer from the download page.

iOS

Link Workspace ONE with Apple Business Manager

To distribute the Twingate iOS Client with Jamf, you will first need to add the Twingate Client app to Apple Business Manager. The iOS Client can then be distributed by using Workspace ONE’s integration with Apple Business Manager.

If you haven’t already, link Workspace ONE with Apple Business Manager by navigating to Settings → Apple (under Devices & Users) → VPP Managed Distribution in Workspace ONE. From there, follow the guided steps to link your Apple Business Manager account. Ensure that “Automatically Send Invites” is unchecked. When you’re done, your configuration should appear similar to the screenshot below:

Enable device assignment

To prevent users from being required to use their personal Apple ID to accept app assignments, you must change the default deployment method to enable device assignment. Navigate to Applications → Native → Purchased and select the Twingate iOS app. From More Actions select Enable Device Assignment.

Enable automatic updates

We recommend enabling automatic updates. You can do this by selecting the Twingate iOS app, and choosing Enable Auto Updates from the More Actions menu.

Tips

Remove manually installed Twingate Clients

If any end users manually installed the Twingate Client on their device prior to implementing Client distribution with Workspace ONE, you should uninstall those Clients first. If you do not do so, those end users may run into issues like their installed Twingate Client differing from your distributed version.

To remove manually installed Clients, set up a temporary policy defined specifically to remove the Twingate Client application from all devices. This policy should be deactivated once you are ready to roll out the Twingate Client via Workspace ONE.

Pre-configuring the macOS Client

You can pre-configure the macOS Client by following the configuration profiles guide. By following this guide, you can automatically enable the VPN configuration for Twingate, enable the system extension, and pre-populate the Network that your users connect to.