Disclosed are various approaches for providing on-demand virtual private network (VPN) connectivity on a per-application basis. First, an application is determined to have begun execution on a computing device. The application is then identified. A determination that the application is authorized to access a VPN connection is made. Subsequently, the VPN connection is initiated.