We use a content filter called iBoss on our iPads that uses a VPN. Their latest cloud connector app requires the profile settings be installed first, before the app, or else it breaks all network connection. I would love some kind of conditional rule...