Why deleting the app is not enough
A VPN app on iOS does not contain the VPN. It installs a configuration profile at the system level, and the app is a front end for it. Deleting the app usually removes the profile too, but not always — a crash during removal, a managed device, or a profile installed by a different app can leave it behind.
The symptom is a VPN icon in the status bar with no app to turn it off, or a connection that re-establishes itself after you thought it was gone. Both are the profile still doing its job with nothing left to control it.
The same applies on macOS, where a configuration can persist in System Settings → VPN after the application that created it is in the Trash.
Where to look on each platform
On iPhone and iPad: Settings → General → VPN & Device Management. This screen has two sections. VPN lists connection configurations. Below it, any management profile — from an employer, a school, or an MDM system — appears separately, and removing one of those may remove several settings at once.
On Mac: System Settings → VPN for connection configurations, with the ⓘ button beside each to remove it, and System Settings → General → Device Management for management profiles. Apple moved VPN out of the Network pane in macOS Ventura, so guides telling you to look under Network are describing an older system.
Settings → VPN on iOS also exists as a shortcut and shows the same list. The connect toggle there works whether or not the provider’s app is installed.
- iPhone: Settings → General → VPN & Device Management → VPN → ⓘ → Delete VPN
- Mac configurations: System Settings → VPN → ⓘ → Remove Configuration
- Mac profiles: System Settings → General → Device Management
The profile you cannot delete
If the delete option is greyed out or the profile reappears, the device is supervised — enrolled in a mobile device management system by an employer, a school, or whoever originally set it up. That is working as designed: the point of MDM is that the user cannot remove it.
You cannot bypass this locally, and attempting to usually means wiping the device, which the management system will simply reapply on re-enrolment. The route is asking whoever administers the device.
This is also worth knowing before you assume a VPN on a work phone is protecting you. A managed device can route traffic through the employer’s inspection infrastructure, and the profile you cannot delete is what does it.
Avoid
- Assuming a VPN icon means your own VPN; on a managed device it may be the employer’s
- Wiping the device to remove a managed profile — re-enrolment reinstalls it
- Leaving an old provider’s profile installed after switching; two can conflict
Switching between providers cleanly
Remove the old profile before installing the new one. Two VPN configurations can coexist in the list, but only one can be active, and iOS picking the wrong one is a common cause of "I connected but I am in the wrong country".
Check for an "on-demand" or always-on flag on the old configuration first. A profile with on-demand rules will reconnect itself whenever its conditions are met, which makes it look as though the new provider is failing.