A VPN provider is looking to offer better support for their Android customers who are migrating from Device Administrator to Android Enterprise. Their customers have previously been complaining that their application has not been receiving the configurations to resolve the VPN host. What is Google's suggested best practice to support this functionality?

Managed configurations via managed Google Play is the correct answer because Android Enterprise leverages managed configurations as the standard, secure, and scalable method for IT administrators to remotely configure applications. This allows the VPN provider to define configurable properties (like VPN hostnames) that can be pushed to the app by the EMM, ensuring consistent and correct setup across all managed devices. Externally readable ini files are not secure or manageable in an enterprise context. Inserting VPN configuration as part of DPC extras is a legacy approach from Device Administrator and is not the recommended practice for Android Enterprise. Configuring it within the WiFi details for NFC bump is unrelated to application-specific VPN configuration and is used for network provisioning.