how to tell if end users is using default VPN configuration instead of a Application.

[JARVIS1]

We would like to check all MAC user whether they using default VPN configuration on MAC System Preferences. or they were using an App(e.g Cisco Anyconnect VPN)

[AJPinto]

Just make a smart group looking for the VPN apps, if its not on your approved list then yo have a red flag. You could also monitor IP addresses.

Most VPN clients like AnyConnect have always on functions and can prevent other VPN clients from establishing a connection. I have never found macOS's built in VPN tooling to be sufficient for anything other than personal use.