The packet tunnel provider is only using Authentication services without UI. If user interaction is required then it is expected for the auth from packet tunnel provider to fail. Filed FB16381436.

Yes, Authentication Services is being called from the packet tunnel provider process (However, indirectly via the MSAL SDK).

Our packet tunnel provider is just requesting a silent token through MSAL. I believe MSAL triggers the SSO auth here: https://github.com/AzureAD/microsoft-authentication-library-common-for-objc/blob/f6048060f96b54d5debdc2a4d53cdeee86209518/IdentityCore/src/requests/broker/MSIDSSOExtensionSilentTokenRequest.m#L206C1-L229C1

The VPN is an NE provider that we created. (It uses PacketTunnelProvider.)

Yes, we have a packet tunnel provider app extension.

Actually I may have been able to repro by calling NETunnelProviderSession startTunnelWithOptions on a Destination IP VPN. Whether it got stuck connecting seemed to depend on the timing of when it was called. What could be causing it to get stuck in a connecting state? Is there a good way to automatically recover when it does get stuck connecting?

There is an issue although it does not occur all the time. The VPN gets stuck in a connecting state until forced to disconnect. I can't say with certainty it is caused by trying to manually connect the Per-App VPN. Should manually connecting a Per-App VPN be avoided then?