OS-enforced,
app-transparent
network control
A managed device profile is all it takes. Any application's traffic to any DNS name — forced through a controlled relay, invisible to the app, impossible to bypass.
as a primitive
Understand how Apple Network Relay works, what it can enforce, and what you can build with it. VDI, internal apps, APIs, browser isolation — anything with a DNS name.
tenant isolation
How we gave secure Azure Virtual Desktop access to devices managed by a different organisation's MDM — without Intune Compliant Device or GSA available. The project that started all this.
What is MASQUE Network Relay?
Apple's Network Relay — built on the MASQUE protocol (HTTP/3 QUIC) — is an MDM-deployable network extension that intercepts traffic to specified domains below the application layer. The application sends traffic normally. The OS silently redirects it through the relay. The application cannot detect this, cannot opt out, and cannot work around it.
Mutual TLS with ACME device attestation means the relay only accepts connections from hardware-verified, MDM-enrolled devices. No certificate — no connection, no log entry.
Traffic interception happens in the network stack, below any application. No app changes, no proxy settings to override, no awareness of the relay's existence.
P-384 key in Secure Enclave, Apple-attested, MDM-provisioned. The relay verifies the hardware, not a password or a shared secret.
Pushed as a mobileconfig profile. The toggle is hidden. The user cannot remove it, disable it, or know it is there unless they inspect the profile list.
The relay terminates wherever your resource lives — private cloud, public cloud, on-premises. If it has a DNS name, the relay can front it.