We were able to test and replicate this on a clean machine that had never had the app installed. This was again via TestFlight. I don’t know, but I agree that it’s something to be concerned about. It seems like you have everything in place to test this for yourself. What happens if you try this? Is it possible to add the quarantine flag to an app so as to try and replicate the translocation issue? If not, I think we would have to go through the submission process as this has only occurred so far during App review.

Thanks Quinn Are you able to reproduce this on a ‘clean’ machine? That is, a machine that’s never seen your app before? I usually run tests like this on a VM, restoring from a snapshot between each test. We'll try, but it may be difficult as all our VMs are on Apple silicon and can't login with an Apple Id. This issue first arose when one of our clients submitted an update for review and App Review were unable to run it due to the check I mentioned above. The client had recently updated their provisioning profile after the previous one expired - could this have been a trigger for App Translocation? One question - if an app is translocated, can it still activate its system extensions given the requirements in this documentation? If so, we may be able to run our app regardless of translocation status and remove the check, Thanks Alan

Thanks for response Quinn My general advice for Personal VPN problems is that you start by creating a configuration profile that embodies the VPN settings you’re trying to apply. That rules out any incompatibilities down at the VPN layer. In this case it’s probably worth doing, just to be sure, but I doubt it’ll reveal anything interesting. This seems to be an issue with applying the settings in the first place. I recommend that you file a bug about that. When doing that, follow the VPN (Network Extension) for iOS instructions on our Bug Reporting > Profiles and Logs page; by doing that your sysdiagnose log will capture more info relevant to VPN. I tried configuring via a profile and it worked as expected so I have logged a bug: FB13384090 Do you think that all users with that configuration are having this problem? Or is it just some subset? I would guess it's a subset or we would have heard more via our support team. In the latter case, there’s likely something about the user’s configuration that’s triggering this, and a potential way to clear that is to reset the device’s network settings. Have any of your affected user’s tried that? I actually tried this yesterday before posting but it didn't fix the issue. Thanks again.