Android app directory · VPN and access

Cisco Secure Client managed configuration for Android

These are the managed configuration keys Cisco documents in its own articles for the Secure Client VPN app on Android. They let IT skip the license prompt, supply a certificate alias, tag the device for network access control and provision one or several VPN entries. Cisco states that the complete schema is built into the app, so this page covers only the keys Cisco publishes in its support documents. Your MDM may not expose every option.

Package name com.cisco.anyconnect.vpn.android.avf

Deploy Cisco Secure Client with Nomid Book a demo

Developer: Cisco Systems, Inc.
Keys on this page: 5 documented
Last checked: 2026-11-08

Common setups

Common Cisco Secure Client setups

Copy a setup into the managed configuration of a policy, then adjust the values. Each one uses only keys explained below.

Quiet first launch

Accept the license prompt for people so that the first start does not stop on a screen they may not understand.

{
  "accept_seula_for_user": true
}

Certificate sign-in with device tag

Use a certificate already delivered to the keychain and pass a device ID so your network can recognize managed devices.

{
  "vpn_keychain_cert_alias": "corp-vpn-cert",
  "vpn_connection_device_id": "{{DeviceID}}"
}

Umbrella-only always-on VPN

Use this when Umbrella is the only VPN on the device. Cisco notes that accepting the license prompt is independent of the always-on setting, so both are set here, and the configuration should reach the device before the app first launches.

{
  "vpn_always_on_umbrella_only": true,
  "accept_seula_for_user": true
}

Managed configuration

Cisco Secure Client managed configuration keys

Key names and value types come from the vendor’s documentation. The explanations are written by Nomid.

Key	Type	What it does	Example
First run and Umbrella
`accept_seula_for_user`	On or off	Accepts the software license prompt on behalf of the person, so the app can start working without a manual step.	`true`
`vpn_always_on_umbrella_only`	On or off	Limits the always-on VPN to Umbrella protection. Cisco says to use it when Umbrella is your only VPN. If you run other VPNs, Cisco says to enable Always-On VPN without restricting it to Umbrella.	`true`
VPN connections and identity
`vpn_configuration_list`	List of VPN entries	Provisions several VPN entries at once. Each item in the list is a vpn_configuration bundle. For a single entry, Cisco points to the vpn_connection fields instead.
`vpn_keychain_cert_alias`	Certificate alias	Names the certificate in the Android keychain to use. If it is not imported yet, the app asks for it. A wrong alias makes the person see repeated prompts.	`corp-vpn-cert`
`vpn_connection_device_id`	Device identifier	Passes a device identifier, usually a placeholder filled in by your MDM, for network access control or reporting.	`{{DeviceID}}`

Deploy with Nomid

Roll Cisco Secure Client out in three steps

Step 1Add Cisco Secure Client to a policy
Find it on Google Play from the policy’s apps list and choose how it is installed.
Step 2Set its managed configuration
In the policy, set the app’s managed configuration with the keys and values from this page.
Step 3Assign the policy
Devices in the policy receive Cisco Secure Client and its configuration on their next sync.

Questions

Cisco Secure Client on managed Android

What is Cisco Secure Client's package name on Android?

This page uses com.cisco.anyconnect.vpn.android.avf. The Cisco articles cited here do not state the package name, so confirm it in your MDM's app list when you add the app.

Where is the full list of keys?

Cisco says the schema is embedded in the app's APK, in res/restrictions.xml, and can be retrieved through Google's EMM API. This page only lists keys Cisco documents publicly in the articles linked below.

Can the certificate be approved without a prompt?

Cisco says that when vpn_keychain_cert_alias is set, the app asks Android's KeyChain to import the certificate if it is not there yet, which normally shows an OS prompt. Cisco suggests the MDM app implement onChoosePrivateKeyAlias to avoid that prompt. Whether your MDM does this is not covered by Cisco's article.

Is the old AnyConnect name still valid?

Cisco's managed configuration article is still titled for AnyConnect, and Cisco lists the product it applies to as Secure Client, including AnyConnect. The keys on this page come from those articles.

Manage Cisco Secure Client on your fleet

Add the app to a Nomid policy, set its configuration and choose its permissions.

Start free Book a demo