MDM · For IT admins
Build the configuration.
Put together connections, policies and trust, check them against the schema and take them away in your MDM's format. Everything stays in your browser.
The generator writes the remotenxConfiguration described on the MDM page and packages it for the way you deliver it: a DDM declaration with its data asset, an Intune policy, a Jamf Pro <dict>, Workspace ONE XML or plain JSON. Every change is checked right away against the schema and against the rules the app applies when it reads the configuration.
What never goes in here
- Passwords, private keys, PKCS #12 files. They come from your MDM as ManagedApp assets, over DDM only: passwords as a
userpasswordasset, keys and client certificates as a SCEP, ACME or PKCS #12 identity, root CAs as a certificate asset. The configuration only names their identifiers – see certificates, identities and passwords. - Anything suspicious in an opened file is removed. If the generator finds a private key, certificate data or a password where an asset identifier belongs, it removes it and shows you where it was.
1. Start
Pick a template, start empty or open a configuration you already have.
Open an existing configuration: drop the file here or
JSON, a DDM data asset (.plist), Intune JSON, a Jamf Pro plist or Workspace ONE XML, up to 1 MB. The file is only read here in your browser; from app configurations the generator takes the embedded remotenxConfiguration and the flat keys.
Changed when opening
The generator removed or merged these entries from :
2. Edit
Every section is optional. Links are picked from a list; problems show right at the field.
3. Check
4. Deliver
Such as your organisation's reverse domain. The declaration and asset identifiers are built from it.
Empty: a placeholder you replace in your MDM.
Flat keys can be changed one by one in the console and win on the device over the same values in the JSON.
The draft stays in this browser's storage (localStorage) until you clear it. None of it leaves your device.
How to roll out
DDM (iOS and iPadOS 18.4 and later)
The com.apple.configuration.app.managed declaration installs remoteNX and attaches the data asset. Upload remotenx-config.plist to your MDM, enter its address as DataURL and create the matching asset for every certificate, identity and password the configuration names. Only this channel delivers assets. Details: Delivery and certificates, identities and passwords.
Microsoft Intune
Apps → App configuration policies → Add → Managed devices, platform iOS/iPadOS, app remoteNX. In the configuration designer each entry under settings is one row: remotenxConfiguration as String, switches as Boolean, numbers as Integer. Intune fills {{userprincipalname}}, {{mail}} and {{devicename}} per user. More under Delivery.
Jamf Pro
Mobile Device Apps → remoteNX → App Configuration: paste the <dict> block. Jamf fills in $USERNAME, $EMAIL and $DEVICENAME. Per-app VPN is set up as described under VPN before connecting.
Workspace ONE UEM
Resources → Apps → Native → remoteNX → Assign → Application Configuration → Upload XML. {EnrollmentUser}, {EmailAddress} and {DeviceFriendlyName} are Workspace ONE lookup values. The XML follows the AppConfig format but has not been tested in a real console yet. More under Delivery.
Check on the device
Settings → Managed by Your Organisation → Check Configuration lists every error and warning with its path, errors first. An entry with an error is not applied; the rest is. See Validate a configuration; the schema and the examples are under Downloads.
Questions
Is my configuration uploaded?
No. Everything you type or open stays in this browser tab. The page uploads nothing, keeps no analytics and loads no third-party code; its Content Security Policy forbids it any network connection. Once loaded, it works offline too.
Where do passwords and certificates go?
Into your MDM, never into the configuration. With DDM an identity names an asset's identifier (managedIdentity or password) and the MDM delivers the asset itself. The classic app configuration cannot deliver assets: there remoteNX asks for the password when connecting. More under certificates, identities and passwords.
What does “not set” mean for a policy?
The policy is not enforced and the user decides. true or false fix the switch and lock it; the app then shows Set by your organisation.
What happens to {{username}} in the outputs?
In connections and identities {{username}} stays: it is remoteNX's own variable. Where it gets its value from is userInfo, and that is where the generator puts each MDM's own variable. The JSON and the DDM data asset keep the neutral placeholders, because not every MDM replaces variables in data assets.
Can I open the examples from the MDM page?
Yes: sample-org.json and the Intune, Jamf and Workspace ONE examples open directly. The DDM declarations only point to the configuration by URL; open the data asset for those. The files are under Downloads.
If the generator accepts it, is the app fine with it?
Yes. It checks against the same JSON Schema we publish, and also that ids are unique, every link has a target and no jump host chain loops. Notes such as “only takes effect with requireAppLock” match the warnings of Check Configuration.
And for individuals without an MDM?
That is what the package generator is for: a file with connections that everyone imports themselves, without policies.