diff --git a/res/values/strings.xml b/res/values/strings.xml
index e6cc2358627..08769bd1614 100644
--- a/res/values/strings.xml
+++ b/res/values/strings.xml
@@ -5259,6 +5259,8 @@
     <string name="vpn_no_vpns_added">No VPNs added.</string>
     <!-- Preference summary for active always-on vpn [CHAR LIMIT=40] -->
     <string name="vpn_always_on_active">Always-on active</string>
+    <!-- Preference summary for app not supporting always-on vpn [CHAR LIMIT=NONE] -->
+    <string name="vpn_not_supported_by_this_app">Not supported by this app</string>
 
     <!-- Summary describing the always-on VPN feature. [CHAR LIMIT=NONE] -->
     <string name="vpn_lockdown_summary">Select a VPN profile to always remain connected to. Network traffic will only be allowed when connected to this VPN.</string>
diff --git a/src/com/android/settings/vpn2/AppManagementFragment.java b/src/com/android/settings/vpn2/AppManagementFragment.java
index 170b128f251..99d2f556179 100644
--- a/src/com/android/settings/vpn2/AppManagementFragment.java
+++ b/src/com/android/settings/vpn2/AppManagementFragment.java
@@ -224,8 +224,14 @@ public class AppManagementFragment extends SettingsPreferenceFragment
             mPreferenceForget.checkRestrictionAndSetDisabled(UserManager.DISALLOW_CONFIG_VPN,
                     mUserId);
 
-            if (!checkTargetVersion()) {
+            if (checkTargetVersion()) {
+                // setSummary doesn't override the admin message when user restriction is applied
+                mPreferenceAlwaysOn.setSummary(null);
+                // setEnabled is not required here, as checkRestrictionAndSetDisabled
+                // should have refreshed the enable state.
+            } else {
                 mPreferenceAlwaysOn.setEnabled(false);
+                mPreferenceAlwaysOn.setSummary(R.string.vpn_not_supported_by_this_app);
             }
         }
     }