Azure VPN Client PacketTunnel killed by nesessionmanager on macOS 26 Tahoe Beta (Build 25D2128)

Question

Azure VPN Client PacketTunnel killed by nesessionmanager on macOS 26 Tahoe Beta (Build 25D2128)

Wajyh Ulhassan 10

Azure VPN Client on macOS 26 Tahoe Beta — PacketTunnel killed by nesessionmanager

I am facing a reproducible issue with Azure VPN Client (latest Mac App Store version) on macOS 26.3.1 Tahoe Beta (Build 25D2128).

Environment: • OS: macOS 26.3.1 Tahoe Beta (Build 25D2128) • App: Azure VPN Client (Mac App Store, latest) • Auth: Microsoft Entra ID (AAD) • Gateway SKU: Azure VpnGw1 • Tunnel Type: OpenVPN over TCP 443

What works: • TCP/UDP 443 and UDP 1194 to the gateway are reachable • Entra ID authentication succeeds and token is received • VPN profile registration in macOS succeeds • PacketTunnel process starts successfully • Dial status returns “Status = Success” • Azure gateway has been confirmed healthy by admin

What fails: • systemextensionsctl list shows 0 extension(s) • com.microsoft.AzureVpnMac.PacketTunnel is killed by nesessionmanager via SIGKILL after around 18 seconds • No tunnel interface is created

Exact error:

launchd: [com.microsoft.AzureVpnMac.PacketTunnel [2850]:] exited due to SIGKILL | sent by nesessionmanager[375], ran for 18657ms

Why this looks like a NetworkExtension issue: On the same machine, Tunnelblick 8.0 with OpenVPN 2.6.14 successfully creates the tunnel interface. Since Tunnelblick bypasses Apple’s NetworkExtension PacketTunnel path, this confirms: • gateway reachability is fine • authentication flow is fine • macOS TUN functionality is fine

This makes the issue look isolated to Azure VPN Client’s NEPacketTunnelProvider path.

Possible cause: It seems macOS 26 Tahoe beta may have introduced a breaking change affecting NEPacketTunnelProvider. Possible causes include: 1. startTunnel() not completing within a stricter timeout window 2. entitlement or sandboxing changes for App Store PacketTunnel extensions 3. a regression in NEPacketTunnelProvider causing the provider to hang until nesessionmanager force-kills it

Question: Is there any known fix, updated entitlement requirement, workaround, or beta build of Azure VPN Client that addresses NEPacketTunnelProvider being killed by nesessionmanager on macOS 26 Tahoe?

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-24T15:03:33.4633333+00:00
Hello Wajyh Ulhassan,

Thanks for the detailed info.

From your description, Azure and authentication are working as expected. The issue starts when macOS terminates the PacketTunnel process after ~18 seconds.

The key signals are:

No tunnel interface is created

systemextensionsctl list shows 0 extensions

This points to the NetworkExtension not loading or being accepted by macOS. When that happens, nesessionmanager will terminate the tunnel provider if it doesn’t complete startup within the system’s expectations.

On macOS 26 Tahoe beta, this is most likely a platform compatibility issue. Apple’s NetworkExtension framework enforces strict lifecycle and timeout behavior for NEPacketTunnelProvider, and changes in beta builds can impact VPN clients until they’re updated.

Relevant Apple documentation:

NetworkExtension framework overview https://developer.apple.com/documentation/networkextension

NEPacketTunnelProvider lifecycle and startTunnel expectations https://developer.apple.com/documentation/networkextension/nepackettunnelprovider

Also, Microsoft’s Azure VPN Client for macOS relies on this framework, so any OS-level changes can affect tunnel initialization.

There’s no known public fix or updated Azure VPN Client build specifically for Tahoe beta at this time.

You can try reinstalling the client and checking for extension approval under Privacy & Security, then re-run:

systemextensionsctl list

If needed, capture logs:

log stream --predicate 'subsystem == "com.apple.networkextension"' --info

For now, using Tunnelblick/OpenVPN is a reasonable workaround.

Overall, this looks like a macOS beta limitation rather than a configuration issue. Testing on a stable macOS version should confirm it.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-01T17:35:18.86+00:00

Hello Wajyh Ulhassan,

Any update on this? Please confirm if you still have further queries on this.

1 answer

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-24T15:03:33.4633333+00:00

Hello Wajyh Ulhassan,

Thanks for the detailed info.

From your description, Azure and authentication are working as expected. The issue starts when macOS terminates the PacketTunnel process after ~18 seconds.

The key signals are:

No tunnel interface is created

systemextensionsctl list shows 0 extensions

This points to the NetworkExtension not loading or being accepted by macOS. When that happens, nesessionmanager will terminate the tunnel provider if it doesn’t complete startup within the system’s expectations.

On macOS 26 Tahoe beta, this is most likely a platform compatibility issue. Apple’s NetworkExtension framework enforces strict lifecycle and timeout behavior for NEPacketTunnelProvider, and changes in beta builds can impact VPN clients until they’re updated.

Relevant Apple documentation:

NetworkExtension framework overview https://developer.apple.com/documentation/networkextension

NEPacketTunnelProvider lifecycle and startTunnel expectations https://developer.apple.com/documentation/networkextension/nepackettunnelprovider

Also, Microsoft’s Azure VPN Client for macOS relies on this framework, so any OS-level changes can affect tunnel initialization.

There’s no known public fix or updated Azure VPN Client build specifically for Tahoe beta at this time.

You can try reinstalling the client and checking for extension approval under Privacy & Security, then re-run:

systemextensionsctl list

If needed, capture logs:

log stream --predicate 'subsystem == "com.apple.networkextension"' --info

For now, using Tunnelblick/OpenVPN is a reasonable workaround.

Overall, this looks like a macOS beta limitation rather than a configuration issue. Testing on a stable macOS version should confirm it.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-01T17:35:18.86+00:00

Hello Wajyh Ulhassan,

Any update on this? Please confirm if you still have further queries on this.

Answer 1

There is no documented fix or updated entitlement requirement for Azure VPN Client on macOS 26 Tahoe in the provided information.

The available macOS-specific details are:

Azure VPN Client for macOS is supported for Microsoft Entra ID authentication only over the OpenVPN protocol and requires the Azure VPN Client app.
The client is versioned up to 2.8.100 with a minimum supported macOS version of 13.0, and recent releases include stability and performance improvements, Entra login fixes, and TLS 1.3 support.
The macOS client is not available in France and China due to local regulations.

No content describes:

Behavior or support status on macOS 26 Tahoe or any macOS beta builds.
Changes to NetworkExtension / NEPacketTunnelProvider handling.
Any known issue where com.microsoft.AzureVpnMac.PacketTunnel is killed by nesessionmanager.
Any workaround, entitlement change, or preview/beta build of Azure VPN Client that targets macOS 26 Tahoe.

Based on the context, only the following can be stated:

Microsoft Entra ID authentication with Azure VPN Client on macOS is supported over OpenVPN for Virtual WAN and VPN Gateway scenarios.
The latest documented Azure VPN Client for macOS versions (up to 2.8.100) target macOS 13 and later, but there is no mention of macOS 26 Tahoe or NetworkExtension-related regressions.

No additional, Tahoe-specific guidance, fixes, or workarounds are documented in the provided material.

References: