SkieCan students set up a VPN on a managed tablet?
No. Skie blocks VPN setup with Android's configure-VPN restriction, and it is on by default. A student cannot add a VPN profile in Settings or let an app create one. VPN apps, proxy apps and DNS changer apps are also on the always-blocked list, whatever an app list says.
A VPN sends all traffic through a tunnel to another server. That is a legitimate privacy tool for adults, and a very effective way to bypass a school filter. Students in India and elsewhere know the names of free VPN apps well.
Skie covers it in two ways. First, it sets DISALLOW_CONFIG_VPN as the device owner. Android then prevents adding, editing or connecting a VPN configuration, and apps cannot establish a tunnel on their own. Second, VPN apps, proxy apps and DNS changer apps are in the always-blocked list, so they are not available to install or use. That list works regardless of what a particular app list says.
The first is a hardening protection with its own switch. It is on by default and is read back from Android after every apply, appearing in the compliance score. The always-blocked list is a separate feature, described by another writer, so we only mention it here.
What if a school's own staff needs a VPN on managed devices to reach a campus system? Turn the switch off for that group, and let the admin decide which VPN app is allowed. Do it deliberately and for a defined group.
Practical tip: tell students and parents in the device policy that VPNs are not available on school tablets, and explain why. It reduces the number of attempts.