Restrictions (iOS)
com.apple.applicationaccess
The payload that configures restrictions on a device.
97 of 218 settings are available in the Intune Settings Catalog. The remaining settings require a custom .mobileconfig profile.
DDM recommended — 97 of 218 settings support Declarative Device Management. In Intune use Settings Catalog → Declarative Device Management.
Configuration Keys (219)
Showing 219 of 219 keys
| Key | Type | Description | Default | Range | DDM |
|---|---|---|---|---|---|
PFC_SegmentedControl_0stringrequired | string | — | Default: — | Range: — | |
| boolean | If 'false', the system disables the camera and removes its icon from the Home Screen, and users are unable to take photographs. Support for this restriction on unsupervised devices is deprecated. | Default: true | Range: — | ||
Allowed exceptions to camera restriction iOS 26.0+ · not on macOS, tvOS, watchOS, visionOS | array | If present, the system exempts apps with bundle IDs in the array from the 'allowCamera' restriction. The system doesn't grant these apps access to the camera automatically; they're only exempted from the 'allowCamera' restriction. This key has no effect when the camera isn't restricted. Multiple payloads combine using an intersect operation. Requires a supervised device. | Default: — | Range: — | |
bundleIDExceptionstringBundle ID to be excepted | string | — | Default: — | Range: — | |
allowVideoConferencingbooleanAllow video conferencing iOS · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'false', the system hides the FaceTime app. Requires a supervised device in iOS 13 and later. | Default: true | Range: — | |
| boolean | If 'false', the system disables backing up the device to iCloud. Support for this restriction on unsupervised devices is deprecated. | Default: true | Range: — | ||
allowCloudPhotoLibrarybooleanAllow iCloud photo library iOS 9.0+ · macOS 10.12+ · visionOS 2.0+ · not on tvOS, watchOS | boolean | If 'false', the system disables iCloud Photo Library. The system removes any photos from local storage that aren't fully downloaded from iCloud Photo Library to the device. Support for this restriction on unsupervised devices and with Managed Apple Accounts is deprecated. | Default: true | Range: — | |
allowPhotoStreambooleanAllow Photo Stream iOS 5.0+ · deprecated 17.0 · not on macOS, tvOS, watchOS, visionOS deprecated | boolean | If 'false', the system disables Photo Stream. | Default: true | Range: — | |
| boolean | If 'false', the system disables Shared Photo Stream. Support for this restriction on unsupervised devices is deprecated. | Default: true | Range: — | ||
allowPasswordAutoFillbooleanAllow password AutoFill iOS 12.0+ · macOS 10.14+ · visionOS 2.0+ · not on tvOS, watchOS | boolean | If 'false', the system disables: The AutoFill Passwords feature in iOS, with Keychain and third-party password managers Prompting the user to use a saved password in Safari or in apps Automatic strong passwords Suggesting strong passwords to users However, if 'false', the system doesn't prevent AutoFill for contact info and credit cards in Safari. | Default: true | Range: — | |
allowAutoUnlockbooleanAllow Apple Watch to auto unlock device iOS 14.5+ · macOS 10.12+ · not on tvOS, watchOS, visionOS | boolean | If 'false', the system disallows auto unlock. Support for this restriction on unsupervised devices is deprecated. | Default: true | Range: — | |
allowFingerprintForUnlockbooleanAllow Touch ID to unlock device iOS 7.0+ · macOS 10.12.4+ · visionOS 2.0+ · not on tvOS, watchOS | boolean | If 'false', the system prevents Touch ID, Face ID, or Optic ID from unlocking a device. Support for this restriction on unsupervised devices is deprecated. | Default: true | Range: — | |
| boolean | If 'false', the system removes the Book Store tab from the Books app. | Default: true | Range: — | ||
| boolean | If 'false', the system disables the use of iMessage with supervised devices. If the device supports text messaging, the user can still send and receive text messages. | Default: true | Range: — | ||
| boolean | If 'false', the system disables the iTunes Music Store and removes its icon from the Home Screen. Users can't preview, purchase, or download content. Requires a supervised device in iOS 13 and later. | Default: true | Range: — | ||
| boolean | If 'false', the system disables the Music service, and the Music app reverts to classic mode. | Default: true | Range: — | ||
| boolean | If 'false', the system disables News. | Default: true | Range: — | ||
| boolean | If 'false', the system disables podcasts. | Default: true | Range: — | ||
| boolean | If 'false', the system disables Apple Music Radio. | Default: true | Range: — | ||
allowYouTubebooleanAllow Apple's YouTube | boolean | This key is ignored on iOS 6 and later because the YouTube app is no longer built in. | Default: true | Range: — | |
| boolean | If 'false', disables the ability for the user to hide apps. It doesn't affect the user's ability to leave it in the App Library, while removing it from the Home Screen. | Default: true | Range: — | ||
| boolean | If 'false', disables the ability for the user to lock apps. Because hiding apps also requires locking them, disallowing locking also disallows hiding. | Default: true | Range: — | ||
allowCloudDocumentSyncbooleanAllow iCloud document sync iOS 5.0+ · macOS 10.11+ · visionOS 2.0+ · not on tvOS, watchOS | boolean | If 'false', the system disables document and key-value syncing to iCloud. Requires a supervised device in iOS 13 and later, and Shared iPad doesn't support it. Support for this restriction on unsupervised devices and with Managed Apple Accounts is deprecated. | Default: true | Range: — | |
allowCloudKeychainSyncbooleanAllow iCloud Keychain iOS 7.0+ · macOS 10.12+ · visionOS 2.0+ · not on tvOS, watchOS | boolean | If 'false', the system disables iCloud Keychain synchronization. Support for this restriction on unsupervised devices and with Managed Apple Accounts is deprecated. | Default: true | Range: — | |
allowDefinitionLookupbooleanAllow definition lookup iOS 8.1.3+ · deprecated 26.4 · macOS 10.11+ · deprecated 26.4 · not on tvOS, watchOS, visionOS deprecated | boolean | If 'false', the system disables definition lookup. Deprecated: use the declarative management 'com.apple.configuration.keyboard.settings' configuration. | Default: true | Range: — | |
allowDeprecatedWebKitTLSbooleanAllow accessing websites using TLS 1.0 and 1.1 | boolean | Allow websites that use TLS 1.0 and TLS 1.1 to be accessed using Safari. | Default: false | Range: — | |
| boolean | If 'false', the system disables AirPrint. | Default: true | Range: — | ||
Allow discovery of AirPrint printers using iBeacons iOS 11.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables iBeacon discovery of AirPrint printers, which prevents spurious AirPrint Bluetooth beacons from phishing for network traffic. | Default: true | Range: — | |
Disallow AirPrint to destinations with untrusted certificates iOS 11.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'true', the system requires trusted certificates for TLS printing communication. | Default: false | Range: — | |
allowScreenShotbooleanAllow screenshots and screen recording iOS 3.1+ · macOS 10.14.4+ · visionOS 2.0+ · not on tvOS | boolean | If 'false', the system disables saving a screenshot of the display and capturing a screen recording. It also disables the Classroom app from observing remote screens. | Default: true | Range: — | |
allowRemoteScreenObservationbooleanAllow remote screen observation iOS 9.3+ · macOS 10.14.4+ · not on tvOS, watchOS, visionOS | boolean | If 'false', the system disables remote screen observation by the Classroom app. Nest this key beneath 'allowScreenShot' as a subrestriction. If 'allowScreenShot' is 'false', the Classroom app doesn't observe remote screens. Requires a supervised device until iOS 13 and macOS 10.15. Allowed for user enrollments in macOS 12 and later. | Default: true | Range: — | |
Allow Classroom app to perform AirPlay and View Screen without prompting iOS 11.0+ · macOS 10.14.4+ · not on tvOS, watchOS, visionOS | boolean | If 'true' and 'ScreenObservationPermissionModificationAllowed' is also 'true' in the Education payload, a student enrolled in a managed course through the Classroom app automatically gives permission to that course teacher's requests to observe the student's screen without prompting the student. | Default: false | Range: — | |
| boolean | Deprecated in iOS 11. Use forceClassroomUnpromptedScreenObservation instead. | Default: false | Range: — | ||
allowVoiceDialingbooleanAllow voice dialing while device is locked iOS · deprecated 17.0 · not on macOS, tvOS, watchOS, visionOS deprecated | boolean | If 'false', the system disables voice dialing if the device is locked with a passcode. | Default: true | Range: — | |
allowAssistantbooleanAllow Siri iOS 5.0+ · deprecated 26.4 · macOS 14.0+ · deprecated 26.4 · visionOS 2.0+ · deprecated 26.4 · not on tvOS, watchOS deprecated | boolean | If 'false', the system disables Siri. Deprecated: use the declarative management 'com.apple.configuration.siri.settings' configuration. | Default: true | Range: — | |
allowAssistantWhileLockedbooleanAllow Siri while locked iOS 5.1+ · deprecated 26.4 · watchOS · deprecated 26.4 · not on macOS, tvOS, visionOS deprecated | boolean | If 'false', the system disables Siri when the device is locked. The system ignores this restriction if the device doesn't have a passcode set. Deprecated: use the declarative management 'com.apple.configuration.siri.settings' configuration. | Default: true | Range: — | |
Enable Siri profanity filter iOS 5.0+ · deprecated 26.4 · macOS 10.13+ · deprecated 26.4 · not on tvOS, watchOS, visionOS deprecated | boolean | If 'true', the system forces the use of the profanity filter for Siri and dictation. Requires a supervised device in iOS. Deprecated: use the declarative management 'com.apple.configuration.siri.settings' configuration. | Default: false | Range: — | |
Show user-generated content in Siri iOS 7.0+ · deprecated 26.4 · watchOS · deprecated 26.4 · not on macOS, tvOS, visionOS deprecated | boolean | If 'false', the system prevents Siri from querying user-generated content from the web. Deprecated: use the declarative management 'com.apple.configuration.siri.settings' configuration. | Default: true | Range: — | |
allowSiriServerLoggingbooleanAllow server-side logging of Siri commands | boolean | Allow server-side logging of Siri commands | Default: true | Range: — | |
Allow Siri suggestions iOS 8.0+ · macOS 10.11+ · not on tvOS, watchOS, visionOS | boolean | If 'false', the system disables Spotlight Internet search results in Siri Suggestions. Support for this restriction on unsupervised devices is deprecated. | Default: true | Range: — | |
| boolean | If 'false', the system disables the App Store and removes its icon from the Home Screen. Users are unable to install or update their apps. This applies to App Store apps, marketplace apps, and locally installed apps (using Configurator, Xcode, and so forth). In iOS 10 and later, MDM commands can override this restriction. Requires a supervised device in iOS 13 and later. | Default: true | Range: — | ||
allowUIAppInstallationbooleanAllow app installation from app store iOS 9.0+ · watchOS · visionOS 2.0+ · not on macOS, tvOS | boolean | If 'false', the system disables the App Store and removes its icon from the Home Screen. However, users can continue to install or update their apps either locally (via Configurator, Xcode, and so forth), or using alternative marketplace apps. In iOS 10 and later, MDM commands can override this restriction. | Default: true | Range: — | |
allowAutomaticAppDownloadsbooleanAllow automatic app downloads iOS 9.0+ · watchOS · not on macOS, tvOS, visionOS | boolean | If 'false', the system prevents automatic downloading of apps purchased on other devices. This setting doesn't affect updates to existing apps. | Default: true | Range: — | |
Allow app installation from alternative marketplaces iOS 17.4+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system prevents installation of alternative marketplace apps from the web and prevents any installed alternative marketplace apps from installing apps. | Default: true | Range: — | |
Allow app installation from web sites iOS 17.5+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the device prevents installation of apps directly from the web. | Default: true | Range: — | |
| boolean | If 'false', the system disables removal of apps from an iOS device. This applies to App Store apps, marketplace apps, and locally installed apps (using Configurator, Xcode, and so forth). | Default: true | Range: — | ||
| boolean | If 'false', the system prevents a user from adding any App Clips, and removes any existing App Clips on the device. | Default: true | Range: — | ||
allowSystemAppRemovalbooleanAllow removing system apps iOS 11.0+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'false', the system disables the removal of system apps from the device. | Default: true | Range: — | |
| boolean | If 'false', the system prohibits in-app purchasing. Support for this restriction on unsupervised devices is deprecated. | Default: true | Range: — | ||
Require iTunes password for all purchases iOS 6.0+ · deprecated 17.0 · not on macOS, tvOS, watchOS, visionOS deprecated | boolean | If 'true', the system forces the user to enter their iTunes password for each transaction. | Default: false | Range: — | |
allowManagedAppsCloudSyncbooleanAllow iCloud sync for managed apps iOS 8.0+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'false', the system prevents managed apps from using iCloud sync. | Default: true | Range: — | |
allowEnterpriseBookBackupbooleanAllow enterprise books backup iOS 8.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables backup of Enterprise books. | Default: true | Range: — | |
Allow enterprise books notes and highlights sync iOS 8.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables sync of Enterprise books, notes, and highlights. | Default: true | Range: — | |
allowCloudPrivateRelaybooleanAllow iCloud Private Relay iOS 15.0+ · macOS 12.0+ · visionOS 2.0+ · not on tvOS, watchOS | boolean | If 'false', the system disables iCloud Private Relay. Support for this restriction on unsupervised devices and with Managed Apple Accounts is deprecated. | Default: true | Range: — | |
Allow automatic sync while roaming iOS · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables global background fetch activity when an iOS phone is roaming. Support for this restriction on unsupervised devices is deprecated. | Default: true | Range: — | |
| boolean | If 'true', the system encrypts all backups. | Default: false | Range: — | ||
allowEraseContentAndSettingsbooleanAllow erase all content and settings iOS 8.0+ · macOS 12.0+ · visionOS 2.0+ · not on tvOS, watchOS | boolean | If 'false', the system disables the Erase All Content and Settings option in the Reset UI. | Default: true | Range: — | |
forcePreserveESIMOnErasebooleanForce preserve ESIM on erase iOS 17.2+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'true', the system preserves eSIM when it erases the device due to too many failed password attempts or the Erase All Content and Settings option in Settings > General > Reset. Note: The system doesn't preserve eSIM if Find My initiates erasing the device. | Default: false | Range: — | |
allowUntrustedTLSPromptbooleanAllow user to accept untrusted TLS certificates iOS 5.0+ · visionOS 1.1+ · not on macOS, tvOS, watchOS | boolean | If 'false', the system automatically rejects untrusted HTTPS certificates without prompting the user. | Default: true | Range: — | |
allowEnterpriseAppTrustbooleanAllow trusting enterprise apps iOS 9.0+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'false', the system removes the Trust Enterprise Developer button in Settings > General > VPN & Device Management, which prevents provisioning apps by universal provisioning profiles. This restriction applies to free developer accounts and enterprise app developers that aren't implicitly trusted by apps that install through MDM. This restriction doesn't revoke previously granted trust. | Default: true | Range: — | |
allowOTAPKIUpdatesbooleanAllow automatic updates to certificate trust settings iOS 7.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables over-the-air PKI updates. Setting this restriction to 'false' doesn't disable CRL and OCSP checks. | Default: true | Range: — | |
Allow UI configuration profile installation iOS 6.0+ · macOS 13.0+ · visionOS 2.0+ · not on tvOS, watchOS | boolean | If 'false', the system prohibits the user from installing configuration profiles and certificates interactively. | Default: true | Range: — | |
allowVPNCreationbooleanAllow adding VPN configurations (supervised devices only) iOS 11.0+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'false', the system allows only managed apps to create VPN configurations. Prior to iOS 18, the system also allows unmanaged apps to create VPN configurations. | Default: true | Range: — | |
forceAutomaticDateAndTimebooleanForce automatic date and time iOS 12.0+ · tvOS 12.2+ · visionOS 2.0+ · not on macOS, watchOS | boolean | If 'true', the system enables the Set Automatically feature in Date & Time and the user can't disable it. The system updates the device's time zone only when the device can determine its location using a cellular connection or Wi-Fi with location services enabled. | Default: false | Range: — | |
Allow Classroom to lock apps or the device without prompting iOS 11.0+ · macOS 10.14.4+ · not on tvOS, watchOS, visionOS | boolean | If 'true', the system allows the teacher to lock apps or the device without prompting the student. | Default: false | Range: — | |
Automatically join Classroom classes without prompting iOS 11.0+ · macOS 10.14.4+ · not on tvOS, watchOS, visionOS | boolean | If 'true', the system automatically gives permission to the teacher's requests without prompting the student. | Default: false | Range: — | |
Require teacher permission to leave Classroom app unmanaged classes iOS 11.3+ · macOS 10.14.4+ · not on tvOS, watchOS, visionOS | boolean | If 'true', a student enrolled in an unmanaged course through Classroom needs to request permission from the teacher to leave the course. | Default: false | Range: — | |
allowAccountModificationbooleanAllow modifying account settings iOS 7.0+ · macOS 14.0+ · watchOS · visionOS 2.0+ · not on tvOS | boolean | If 'false', the system disables modification of accounts, such as Apple Accounts, and internet-based accounts, such as Mail, Contacts, and Calendar. | Default: true | Range: — | |
allowBluetoothModificationbooleanAllow modifying Bluetooth settings iOS 11.0+ · macOS 13.0+ · visionOS 27.0+ · not on tvOS, watchOS | boolean | If 'false', the system prevents modification of Bluetooth settings. | Default: true | Range: — | |
Allow modifying cellular data usage for apps settings iOS 7.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables changing settings for cellular data usage for apps. | Default: true | Range: — | |
Allow modifying celluar plan settings iOS 11.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system prevents users from changing settings related to their cellular plan (available only on select carriers). | Default: true | Range: — | |
allowESIMModificationbooleanAllow eSIM modification iOS 12.1+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables modifications of eSIMs. This also disables the phone number sharing setup on iPhones, in iOS 27 and later. | Default: true | Range: — | |
Allow modifying Find My Friends settings iOS 7.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables changes to Find My Friends. | Default: true | Range: — | |
Allow modifying notifications settings iOS 9.3+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'false', the system disables modification of notification settings. | Default: true | Range: — | |
| boolean | If 'false', the system disables NFC. | Default: true | Range: — | ||
allowPasscodeModificationbooleanAllow modifying passcode iOS 9.0+ · macOS 10.13+ · visionOS 2.0+ · not on tvOS, watchOS | boolean | If 'false', the system prevents adding, changing, or removing the passcode. The system ignores this restriction on Shared iPad. | Default: true | Range: — | |
allowFingerprintModificationbooleanAllow modifying Touch ID / Face ID iOS 8.3+ · macOS 14.0+ · visionOS 2.0+ · not on tvOS, watchOS | boolean | If 'false', the system prevents the user from modifying Touch ID or Face ID. | Default: true | Range: — | |
allowEnablingRestrictionsbooleanAllow configuring restrictions or ScreenTime iOS 8.0+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'false', the system disables the Enable Restrictions option in the Restrictions UI in Settings. If 'false' in iOS 12 and later, the system disables the Enable ScreenTime option in the ScreenTime UI in Settings and disables ScreenTime if already enabled. | Default: true | Range: — | |
allowWallpaperModificationbooleanAllow modifying wallpaper iOS 9.0+ · macOS 10.13+ · not on tvOS, watchOS, visionOS | boolean | If 'false', the system prevents changing the wallpaper. | Default: true | Range: — | |
allowUSBRestrictedModebooleanAllow USB Restricted Mode iOS 11.4.1+ · macOS 13.0+ · not on tvOS, watchOS, visionOS | boolean | If 'false', the system allows iOS devices to always connect to USB accessories while locked. In macOS, allows new USB and Thunderbolt accessories, and SD cards to connect without authorization. If the system has Lockdown mode enabled, it ignores this value. This restriction isn't supported on the user channel. | Default: true | Range: — | |
allowHostPairingbooleanAllow pairing with non-Configurator hosts iOS 7.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables host pairing with the exception of the supervision host. If there's no configured supervision host certificate, the system disables all pairing. Host pairing lets the administrator control whether an iOS device can pair with a host Mac or PC. | Default: true | Range: — | |
allowiPhoneWidgetsOnMacbooleanAllow iPhone widget on Mac iOS 17.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disallows iPhone widgets on a Mac that signs in with the same Apple Account for iCloud. | Default: true | Range: — | |
Allow booting into recovery by unpaired devices iOS 14.5+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'true', the system allows unpaired devices to boot devices into recovery. | Default: false | Range: — | |
Enable allow open from managed to unmanaged iOS 7.0+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'false', documents in managed apps and accounts open only in other managed apps and accounts. | Default: true | Range: — | |
Enable allow open from unmanaged to managed iOS 7.0+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'false', documents in unmanaged apps and accounts open only in other unmanaged apps and accounts. | Default: true | Range: — | |
Allow unmanaged apps to read managed contacts accounts iOS 12.0+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'true', the system allows unmanaged apps to read from managed contacts accounts. If 'allowOpenFromManagedToUnmanaged' is 'true', this restriction has no effect. Important: Use MDM to install profiles that contain this restriction. | Default: false | Range: — | |
Allow managed apps to write to managed contacts accounts iOS 12.0+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'true', the system allows managed apps to write contacts to unmanaged accounts. If 'allowOpenFromManagedToUnmanaged' is 'true', this restriction has no effect. Important: Use MDM to install profiles that contain this restriction. | Default: false | Range: — | |
requireManagedPasteboardbooleanRequire managed pasteboard iOS 15.0+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'true', the 'allowOpenFromManagedToUnmanaged' and 'allowOpenFromUnmanagedToManaged' restrictions also limit copy-and-paste functionality. | Default: false | Range: — | |
| boolean | If 'false', the system disables AirDrop. | Default: true | Range: — | ||
forceAirDropUnmanagedbooleanTreat AirDrop as unmanaged destination iOS 9.0+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'true', the system considers AirDrop to be an unmanaged drop target. | Default: false | Range: — | |
allowActivityContinuationbooleanAllow handoff iOS 8.0+ · macOS 10.15+ · visionOS 2.0+ · not on tvOS, watchOS | boolean | If 'false', the system disables activity continuation. Support for this restriction on unsupervised devices and with Managed Apple Accounts is deprecated. In a future release, this restriction will begin requiring supervision and will apply to personal Apple Accounts only. | Default: true | Range: — | |
allowDiagnosticSubmissionbooleanAllow diagnostic submission iOS 6.0+ · macOS 10.13+ · visionOS 2.0+ · not on tvOS | boolean | If 'false', the system prevents the device from automatically submitting diagnostic reports to Apple. | Default: true | Range: — | |
Allow modifying diagnostics settings iOS 9.3.2+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'false', the system disables changing the diagnostic submission and app analytics settings in the Diagnostics & Usage UI in Settings. | Default: true | Range: — | |
Require Touch ID / Face ID authentication before Autofill iOS 11.0+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'true', the user needs to authenticate before the system can autofill passwords or credit card information in Safari and apps. If this restriction isn't enforced, the user can toggle this feature in Settings. Only supported on devices with Face ID or Touch ID. | Default: false | Range: — | |
allowPairedWatchbooleanAllow pairing with Apple Watch iOS 9.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables pairing with an Apple Watch, and the system unpairs any currently paired Apple Watch and erases its content. | Default: true | Range: — | |
forceWatchWristDetectionbooleanForce Apple Watch wrist detection iOS 8.2+ · not on macOS, tvOS, visionOS | boolean | If 'true', the system forces a paired Apple Watch to use Wrist Detection. | Default: false | Range: — | |
forceWiFiPowerOnbooleanDisallow Wi-Fi from being turned off iOS 13.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'true', the system prevents turning off Wi-Fi in Settings or Control Center, even by entering or leaving Airplane Mode. It doesn't prevent selecting which Wi-Fi network to use. and later. | Default: false | Range: — | |
Join only Wi-Fi networks installed by a Wi-Fi payload iOS 14.5+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'true', the system limits the device to only join Wi-Fi networks set up through a configuration profile. | Default: false | Range: — | |
forceWiFiWhitelistingbooleanOnly join Wi-Fi networks installed by profiles iOS 10.3+ · deprecated 14.5 · not on macOS, tvOS, watchOS, visionOS deprecated | boolean | Use 'forceWiFiToAllowedNetworksOnly' instead. | Default: false | Range: — | |
Allow setting up new nearby iOS devices iOS 11.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', disables the prompt to set up new devices that are nearby. Starting with iOS 26.3, this also prevents exporting iOS data to set up new Android devices. | Default: true | Range: — | |
allowPredictiveKeyboardbooleanAllow predictive keyboard iOS 8.1.3+ · deprecated 26.4 · not on macOS, tvOS, watchOS, visionOS deprecated | boolean | If 'false', the system disables predictive keyboards. Deprecated: use the declarative management 'com.apple.configuration.keyboard.settings' configuration. | Default: true | Range: — | |
allowKeyboardShortcutsbooleanAllow keyboard shortcuts iOS 9.0+ · deprecated 26.4 · not on macOS, tvOS, watchOS, visionOS deprecated | boolean | If 'false', the system disables keyboard shortcuts. Deprecated: use the declarative management 'com.apple.configuration.keyboard.settings' configuration. | Default: true | Range: — | |
allowAutoCorrectionbooleanAllow auto correction iOS 8.1.3+ · deprecated 26.4 · not on macOS, tvOS, watchOS, visionOS deprecated | boolean | If 'false', the system disables keyboard autocorrection. Deprecated: use the declarative management 'com.apple.configuration.keyboard.settings' configuration. | Default: true | Range: — | |
allowContinuousPathKeyboardbooleanAllow continuous path keyboard iOS 13.0+ · deprecated 26.4 · not on macOS, tvOS, watchOS, visionOS deprecated | boolean | If 'false', the system disables QuickPath keyboard. Deprecated: use the declarative management 'com.apple.configuration.keyboard.settings' configuration. | Default: true | Range: — | |
allowSpellCheckbooleanAllow spell check iOS 8.1.3+ · deprecated 26.4 · not on macOS, tvOS, watchOS, visionOS deprecated | boolean | If 'false', the system disables the keyboard spell checker. Deprecated: use the declarative management 'com.apple.configuration.keyboard.settings' configuration. | Default: true | Range: — | |
Allow Shared iPad temporary session iOS 13.4+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system makes temporary sessions unavailable on Shared iPad. | Default: true | Range: — | |
allowDictationbooleanAllow dictation iOS 10.3+ · deprecated 26.4 · macOS 10.13+ · deprecated 26.4 · not on tvOS, watchOS, visionOS deprecated | boolean | If 'false', the system disallows dictation input. Deprecated: use the declarative management 'com.apple.configuration.keyboard.settings' configuration. | Default: true | Range: — | |
forceOnDeviceOnlyDictationbooleanForce on-device only dictation iOS 14.5+ · deprecated 26.4 · macOS 14.0+ · deprecated 26.4 · watchOS · deprecated 26.4 · visionOS 2.0+ · deprecated 26.4 · not on tvOS deprecated | boolean | If 'true', the system disables connections to Siri servers for the purposes of dictation. Deprecated: use the declarative management 'com.apple.configuration.intelligence.settings' configuration. | Default: false | Range: — | |
forceOnDeviceOnlyTranslationbooleanForce on-device only translation iOS 15.0+ · deprecated 26.4 · watchOS · deprecated 26.4 · not on macOS, tvOS, visionOS deprecated | boolean | If 'true', the device can't connect to Siri servers for the purposes of translation. Deprecated: use the declarative management 'com.apple.configuration.intelligence.settings' configuration. | Default: false | Range: — | |
allowPassbookWhileLockedbooleanAllow Wallet while locked iOS 6.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system hides Passbook notifications from the Lock Screen. | Default: true | Range: — | |
Allow modifying personal hotspot settings iOS 12.2+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables modifications of the personal hotspot setting. | Default: true | Range: — | |
allowLiveVoicemailbooleanAllow live voicemail iOS 17.2+ · macOS 26.0+ · not on tvOS, watchOS, visionOS | boolean | If 'false', the system disables live voicemail on the device. | Default: true | Range: — | |
allowLockScreenControlCenterbooleanShow Control Center on Lock screen iOS 7.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system prevents Control Center from appearing on the Lock Screen. | Default: true | Range: — | |
Show Notification Center on Lock screen iOS 7.0+ · not on macOS, tvOS, visionOS | boolean | If 'false', the system disables the Notifications history view on the Lock Screen, so users can't view past notifications. However, they can still see notifications when they arrive. | Default: true | Range: — | |
allowLockScreenTodayViewbooleanShow Today view on Lock screen iOS 7.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables the Today view in Notification Center on the Lock Screen. | Default: true | Range: — | |
Require passcode on first AirPlay pairing iOS 7.1+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'true', the system forces all devices receiving AirPlay requests from this device to use a pairing password. | Default: false | Range: — | |
Allow storage of AirPrint credentials in keychain iOS 11.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables Keychain storage of user name and password for AirPrint. | Default: true | Range: — | |
forceLimitAdTrackingbooleanForce limited ad tracking iOS 7.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'true', the system limits ad tracking. Additionally, it disables app tracking and the Allow Apps to Request to Track setting. | Default: false | Range: — | |
Allow Apple-personalized advertizing iOS 14.0+ · macOS 12.0+ · visionOS 2.0+ · not on tvOS, watchOS | boolean | If 'false', the system limits Apple personalized advertising. | Default: true | Range: — | |
allowMailPrivacyProtectionbooleanAllow mail privacy protection iOS 15.2+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables Mail Privacy Protection on the device. | Default: true | Range: — | |
| boolean | If 'false', disables auto dim on iPads with OLED displays. | Default: true | Range: — | ||
| boolean | If 'false', the system disables Game Center, and the system removes its icon from the Home Screen. | Default: true | Range: — | ||
allowAddingGameCenterFriendsbooleanAllow adding Game Center friends iOS 4.2.1+ · macOS 10.13+ · not on tvOS, watchOS, visionOS | boolean | If 'false', the system prohibits adding friends to Game Center. Requires a supervised device in iOS 13 and later. | Default: true | Range: — | |
allowMultiplayerGamingbooleanAllow multiplayer gaming iOS 4.1+ · macOS 10.13+ · not on tvOS, watchOS, visionOS | boolean | If 'false', the system prohibits multiplayer gaming. | Default: true | Range: — | |
| boolean | If 'false', the system disables the Safari web browser app, and the system removes its icon from the Home Screen. This setting also prevents users from opening web clips. Requires a supervised device in iOS 13 and later. | Default: true | Range: — | ||
safariAllowAutoFillbooleanAllow AutoFill in Safari iOS · macOS 10.13+ · visionOS 2.0+ · not on tvOS, watchOS | boolean | If 'false', the system disables Safari AutoFill for passwords, contact info, and credit cards, and also prevents using the Keychain for AutoFill. Requires a supervised device in iOS 13 and later. Note: The system still allows third-party password managers, and apps can use AutoFill. | Default: true | Range: — | |
| boolean | If 'true', the system enables Safari fraud warning. | Default: false | Range: — | ||
| boolean | If 'false', Safari doesn't execute JavaScript. This restriction will require supervision in a future release. | Default: true | Range: — | ||
| boolean | If 'false', Safari doesn't allow pop-up windows. Support for this restriction on unsupervised devices is deprecated. | Default: true | Range: — | ||
| real | Defines the conditions under which the device accepts cookies. The user-facing settings changed in iOS 11, although the possible values remain the same. Support for this restriction on unsupervised devices is deprecated. Allowed values: '0': Enables Prevent Cross-Site Tracking and Block All Cookies, and the user canʼt disable either setting. '1' or '1.5': Enables Prevent Cross-Site Tracking, and the user canʼt disable it. Doesn't enable Block All Cookies, but the user can enable it. '2': Enables Prevent Cross-Site Tracking, but doesn't enable Block All Cookies. The user can toggle either setting. | Default: 2 | Range: Never / Prevent Cross-Site Tracking & Block All Cookies (User Restricted) (0), Allow from current website only / Prevent Cross-Site Tracking (User Restricted) (1), Allow from websites visited (iOS 10 & earlier) (1.5), Always / Prevent Cross-Site Tracking (2) | ||
allowDeviceNameModificationbooleanAllow modifying device name iOS 9.0+ · macOS 14.0+ · tvOS 11.0+ · visionOS 2.0+ · not on watchOS | boolean | If 'false', the system prevents the user from changing the device name. | Default: true | Range: — | |
blockedAppBundleIDsarrayBlocked apps iOS 15.0+ · deprecated 27.0 · tvOS 15.0+ · deprecated 27.0 · visionOS 27.0+ · deprecated 27.0 · not on macOS, watchOS deprecated | array | If present, the system prevents showing or launching apps with bundle IDs in the array. Include the value 'com.apple.webapp' to restrict all webclips. This applies to App Store apps, marketplace apps, and locally installed apps (using Configurator, Xcode, and so forth). Deprecated: use the declarative management 'com.apple.configuration.app.settings' configuration. Note: Denying system apps may disable other functionality. For example, denying the App Store app may prevent users from accepting the terms and conditions for the user-based Volume Purchase Program (VPP). | Default: — | Range: — | |
appBlockedBundleIDstringBundle ID | string | — | Default: — | Range: — | |
Restrict App Usage - Denylist iOS 9.3+ · deprecated 15.0 · tvOS 11.0+ · deprecated 15.0 · not on macOS, watchOS, visionOS deprecated | array | Deprecated: use the declarative management 'com.apple.configuration.app.settings' configuration. | Default: — | Range: — | |
appBlacklistedBundleIDstringiOS / tvOS Bundle ID | string | — | Default: — | Range: — | |
Allow listed apps iOS 15.0+ · deprecated 27.0 · tvOS 15.0+ · deprecated 27.0 · visionOS 27.0+ · deprecated 27.0 · not on macOS, watchOS deprecated | array | If present, the system only shows or can launch apps with bundle IDs in the array. Include the value 'com.apple.webapp' to allow all webclips. This applies to App Store apps, marketplace apps, and locally installed apps (using Configurator, Xcode, and so forth). Deprecated: use the declarative management 'com.apple.configuration.app.settings' configuration. | Default: — | Range: — | |
appAllowlistedBundleIDstringBundle ID | string | — | Default: — | Range: — | |
Restrict App Usage - Allowlist iOS 9.3+ · deprecated 15.0 · tvOS 11.0+ · deprecated 15.0 · not on macOS, watchOS, visionOS deprecated | array | Deprecated: use the declarative management 'com.apple.configuration.app.settings' configuration. | Default: — | Range: — | |
appWhitelistedBundleIDstringiOS / tvOS Bundle ID | string | — | Default: — | Range: — | |
Autonomous Single App Mode Permitted App IDs iOS 7.0+ · not on macOS, tvOS, watchOS, visionOS | array | If present, the system allows apps identified by the bundle IDs listed in the array to autonomously enter Single App Mode. | Default: — | Range: — | |
Apps allow list for autonomous single app mode | string | — | Default: — | Range: — | |
| string | The two-letter key that profile tools use to display the proper ratings for the given region. The client doesn't recognize or report this data. | Default: "us" | Range: United States (us), Australia (au), Canada (ca), Germany (de), France (fr), Ireland (ie), Japan (jp), New Zealand (nz), United Kingdom (gb) | ||
| integer | The maximum level of app content allowed on the device. Starting with iOS 26.2, this rating may apply to certain system apps. Age bands and the number of discrete age values vary by region, but the values are consistent across regions. For example, in a region that defines rating level 14+, its value is guaranteed to be larger than 300 (12+) and smaller than 600 (17+). Also, the value of rating level 15+ is guaranteed to be larger than the assigned value of rating level 14+. For more information about age ratings, see Age ratings values and definitions (https://developer.apple.com/help/app-store-connect/reference/age-ratings-values-and-definitions). Below is the complete list of age rating values used across all App Store regions. '1000': All '621': 21+ '620': 20+ '619': 19+ '618': 18+ '600': 17+ '416': 16+ '415': 15+ '314': 14+ '313': 13+ '300': 12+ '211': 11+ '210': 10+ '200': 9+ '108': 8+ '107': 7+ '106': 6+ '105': 5+ '100': 4+ '3': 3+ '2': 2+ '1': 1+ '0': None This restriction will require supervision in a future release. | Default: 1000 | Range: Allow All Apps (1000), 900 (900), 800 (800), 700 (700), 600 (600), 500 (500), 400 (400), 300 (300), 200 (200), 100 (100), Don't Allow Apps (0) | ||
| integer | The maximum level of movie content allowed on the device. Support for this restriction on unsupervised devices is deprecated. Possible values, with the U.S. description of the rating level: '1000': All '500': NC-17 '400': R '300': PG-13 '200': PG '100': G '0': None | Default: 1000 | Range: Allow All Movies (1000), 900 (900), 800 (800), 700 (700), 600 (600), 500 (500), 400 (400), 300 (300), 200 (200), 100 (100), Don't Allow Movies (0) | ||
ratingTVShowsintegerAllowed content ratings - TV Shows iOS · macOS 15.0+ · tvOS 11.3+ · not on watchOS, visionOS | integer | The maximum level of TV content allowed on the device. Support for this restriction on unsupervised devices is deprecated. Possible values, with the U.S. description of the rating level: '1000': All '600': TV-MA '500': TV-14 '400': TV-PG '300': TV-G '200': TV-Y7 '100': TV-Y '0': None | Default: 1000 | Range: Allow All TV Shows (1000), 900 (900), 800 (800), 700 (700), 600 (600), 500 (500), 400 (400), 300 (300), 200 (200), 100 (100), Don't Allow TV Shows (0) | |
allowExplicitContentbooleanAllow explicit content iOS · macOS 15.0+ · tvOS 11.3+ · not on watchOS, visionOS | boolean | If 'false', the system hides explicit music or video content purchased from the iTunes Store. The system marks explicit content as such by content providers, such as record labels, when sold through the iTunes Store. Explicit content in the News and Podcast apps is also hidden. Requires a supervised device in iOS 13 and later. Support for this restriction on unsupervised devices is deprecated. | Default: true | Range: — | |
allowFilesUSBDriveAccessbooleanAllow Files USB Drive Access iOS 13.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system prevents connecting to any connected USB devices in the Files app. | Default: true | Range: — | |
allowBookstoreEroticabooleanAllow Book Store erotica iOS 6.0+ · macOS 15.0+ · tvOS 11.3+ · deprecated 17.0 · not on watchOS, visionOS deprecated | boolean | If 'false', the system prevents the user from downloading Apple Books media that's tagged as erotica. Support for this restriction on unsupervised devices is deprecated. | Default: true | Range: — | |
allowPasswordSharingbooleanAllow password sharing iOS 12.0+ · macOS 10.14+ · visionOS 2.0+ · not on tvOS, watchOS | boolean | If 'false', the system disables sharing passwords with the AirDrop passwords feature, or with the Passwords app. | Default: true | Range: — | |
Allow proximity based password sharing requests iOS 12.0+ · macOS 10.14+ · tvOS 12.0+ · removed 26.4 · not on watchOS, visionOS deprecated | boolean | If 'false', the system disables requesting passwords from nearby devices. | Default: true | Range: — | |
forceDelayedSoftwareUpdatesbooleanDefer Software Updates iOS 11.3+ · removed 27.0 · macOS 10.13+ · removed 27.0 · tvOS 12.2+ · removed 27.0 · not on watchOS, visionOS deprecated | boolean | If 'true', the system delays user visibility of software updates. In macOS, the system allows seed build updates without delay. The delay is 30 days unless you set 'enforcedSoftwareUpdateDelay' to another value. Removed: use the declarative management 'com.apple.configuration.softwareupdate.settings' configuration. | Default: false | Range: — | |
enforcedSoftwareUpdateDelayintegerDeferred Software Updates Delay iOS 11.3+ · removed 27.0 · macOS 10.13.4+ · removed 27.0 · tvOS 12.2+ · removed 27.0 · not on watchOS, visionOS deprecated | integer | How many days to delay a software update on the device. With this restriction in place, the user doesn't see a software update until the specified number of days after the software update release date. The restrictions 'forceDelayedAppSoftwareUpdates' and 'forceDelayedSoftwareUpdates' use this value. Removed: use the declarative management 'com.apple.configuration.softwareupdate.settings' configuration. | Default: 30 | Range: 1 – 90 | |
Allow Background Security Improvements installation iOS 16.0+ · removed 27.0 · macOS 13.0+ · removed 27.0 · not on tvOS, watchOS, visionOS deprecated | boolean | If 'false', the system prohibits installation of Background Security Improvements. Removed: use the declarative management 'com.apple.configuration.softwareupdate.settings' configuration. | Default: true | Range: — | |
Allow Background Security Improvements removal iOS 16.0+ · removed 27.0 · macOS 13.0+ · removed 27.0 · not on tvOS, watchOS, visionOS deprecated | boolean | If 'false', the system prohibits removal of Background Security Improvements. Removed: use the declarative management 'com.apple.configuration.softwareupdate.settings' configuration. | Default: true | Range: — | |
allowFindMyDevicebooleanAllow Find My Devices iOS 13.0+ · macOS 10.15+ · not on tvOS, watchOS, visionOS | boolean | If 'false', the system disables Find My Device in the Find My app. | Default: true | Range: — | |
allowFindMyFriendsbooleanAllow Find My Friends iOS 13.0+ · macOS 10.15+ · not on tvOS, watchOS, visionOS | boolean | If 'false', the system disables Find My Friends in the Find My app. | Default: true | Range: — | |
allowFilesNetworkDriveAccessbooleanAllow Files Network Drive Access iOS 13.1+ · visionOS 2.0+ · not on macOS, tvOS, watchOS | boolean | If 'false', the system prevents connecting to network drives in the Files app. | Default: true | Range: — | |
allowESIMOutgoingTransfersbooleanAllow eSIM outgoing transfers iOS 18.0+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', prevents the transfer of an eSIM from the device on which the restriction is installed to a different device. | Default: true | Range: — | |
allowGenmojibooleanAllow Genmoji iOS 18.0+ · deprecated 26.4 · macOS 15.0+ · deprecated 26.4 · visionOS 2.4+ · deprecated 26.4 · not on tvOS, watchOS deprecated | boolean | If 'false', prohibits creating new Genmoji. Deprecated: use the declarative management 'com.apple.configuration.intelligence.settings' configuration. | Default: true | Range: — | |
allowImagePlaygroundbooleanAllow Image Playground iOS 18.0+ · deprecated 26.4 · macOS 15.0+ · deprecated 26.4 · visionOS 2.4+ · deprecated 26.4 · not on tvOS, watchOS deprecated | boolean | If 'false', prohibits the use of image generation. Deprecated: use the declarative management 'com.apple.configuration.intelligence.settings' configuration. | Default: true | Range: — | |
allowImageWandbooleanAllow Image Wand iOS 18.0+ · deprecated 26.4 · visionOS 2.4+ · deprecated 26.4 · not on macOS, tvOS, watchOS deprecated | boolean | If 'false', prohibits the use of Image Wand. Deprecated: use the declarative management 'com.apple.configuration.intelligence.settings' configuration. | Default: true | Range: — | |
allowiPhoneMirroringbooleanAllow iPhone mirroring iOS 18.0+ · macOS 15.0+ · not on tvOS, watchOS, visionOS | boolean | If 'false', prohibits the use of iPhone Mirroring. In macOS, this prevents the Mac from mirroring any iPhone. In iOS, this prevents the iPhone from mirroring to any Mac. | Default: true | Range: — | |
Allow personalized handwriting results iOS 18.0+ · deprecated 26.4 · not on macOS, tvOS, watchOS, visionOS deprecated | boolean | If false, prevents the system from generating text in the user's handwriting. Deprecated: use the declarative management 'com.apple.configuration.intelligence.settings' configuration. | Default: true | Range: — | |
allowWritingToolsbooleanAllow writing tools iOS 18.0+ · deprecated 26.4 · macOS 15.0+ · deprecated 26.4 · visionOS 2.4+ · deprecated 26.4 · not on tvOS, watchOS deprecated | boolean | If 'false', disables Apple Intelligence writing tools. Deprecated: use the declarative management 'com.apple.configuration.intelligence.settings' configuration. | Default: true | Range: — | |
allowCallRecordingbooleanAllow call recording iOS 18.1+ · macOS 26.0+ · not on tvOS, watchOS, visionOS | boolean | If 'false', disables call recording. | Default: true | Range: — | |
allowMailSummarybooleaniOS 18.1+ · deprecated 26.4 · macOS 15.1+ · deprecated 26.4 · visionOS 2.4+ · deprecated 26.4 · not on tvOS, watchOS deprecated | boolean | If 'false', disables the ability to create summaries of email messages manually. This doesn't affect automatic summary generation. Deprecated: use the declarative management 'com.apple.configuration.intelligence.settings' configuration. | Default: true | Range: — | |
allowMailSmartRepliesbooleaniOS 18.4+ · deprecated 26.4 · macOS 15.4+ · deprecated 26.4 · visionOS 2.4+ · deprecated 26.4 · not on tvOS, watchOS deprecated | boolean | If 'false', disables smart replies in Mail. Deprecated: use the declarative management 'com.apple.configuration.intelligence.settings' configuration. | Default: true | Range: — | |
allowRCSMessagingbooleaniOS 18.1+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', prevents the use of RCS messaging. | Default: true | Range: — | |
Allow default browser modification iOS 18.2+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', disables default browser preference modification. The MDM Settings command to set the default browser preference still works when applying this. | Default: true | Range: — | |
Allow default calling app modification iOS 18.4+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', disables default calling app preference modification. The MDM Settings command to set the default calling app preference still works when applying this. | Default: true | Range: — | |
Allow default messaging app modification iOS 18.4+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', disables default messaging app preference modification. The MDM Settings command to set the default messaging app preference still works when applying this. | Default: true | Range: — | |
Allow external intelligence integrations iOS 18.2+ · deprecated 26.4 · macOS 15.2+ · deprecated 26.4 · visionOS 2.4+ · deprecated 26.4 · not on tvOS, watchOS deprecated | boolean | If 'false', disables the use of external, cloud-based intelligence services with Siri. In iOS, this restriction is temporarily allowed on unsupervised and user enrollments. In a future release, this restriction will require supervision, and will be ignored on unsupervised devices. Deprecated: use the declarative management 'com.apple.configuration.external-intelligence.settings' configuration. | Default: true | Range: — | |
Allow external intelligence integrations sign-in iOS 18.2+ · deprecated 26.4 · macOS 15.2+ · deprecated 26.4 · visionOS 2.4+ · deprecated 26.4 · not on tvOS, watchOS deprecated | boolean | If 'false', forces external intelligence providers into anonymous mode. If a user is already signed in to an external intelligence provider, applying this restriction signs them out when attempting the next request. Deprecated: use the declarative management 'com.apple.configuration.external-intelligence.settings' configuration. | Default: true | Range: — | |
Allowed external intelligence workspace IDs iOS 18.3+ · deprecated 26.4 · macOS 15.3+ · deprecated 26.4 · visionOS 2.4+ · deprecated 26.4 · not on tvOS, watchOS deprecated | array | An array of strings, but currently restricted to a single element. If present, Apple Intelligence allows use of only the given external integration workspace ID, and requires a sign-in to make requests. The user is required to sign in to integrations that support signing in. Multiple payloads combine using an intersect operation. This means the allowed set of workspace IDs can become the empty set if multiple payloads specify conflicting values. Deprecated: use the declarative management 'com.apple.configuration.external-intelligence.settings' configuration. | Default: — | Range: — | |
allowedWorkspaceIDstringAllowed workspace ID | string | — | Default: — | Range: — | |
iOS 18.3+ · deprecated 26.4 · macOS 15.3+ · deprecated 26.4 · not on tvOS, watchOS, visionOS deprecated | boolean | If 'false', disables transcription summarization in Notes. Deprecated: use the declarative management 'com.apple.configuration.intelligence.settings' configuration. | Default: true | Range: — | |
allowNotesTranscriptionbooleaniOS 18.4+ · deprecated 26.4 · macOS 15.4+ · deprecated 26.4 · not on tvOS, watchOS, visionOS deprecated | boolean | If 'false', disables transcription in Notes. Deprecated: use the declarative management 'com.apple.configuration.intelligence.settings' configuration. | Default: true | Range: — | |
Allow visual intelligence summary iOS 18.3+ · deprecated 26.4 · not on macOS, tvOS, watchOS, visionOS deprecated | boolean | If 'false', the system disables visual intelligence summarization. Deprecated: use the declarative management 'com.apple.configuration.intelligence.settings' configuration. | Default: true | Range: — | |
allowSatelliteConnectionbooleanAllow use of satellite connectivity iOS 18.2+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', the system prohibits the connection to and use of satellite services. | Default: true | Range: — | |
allowAppleIntelligenceReportbooleanAllow Apple Intelligence report iOS 18.4+ · deprecated 26.4 · macOS 15.4+ · deprecated 26.4 · not on tvOS, watchOS, visionOS deprecated | boolean | If 'false', the system disables Apple Intelligence reports. Deprecated: use the declarative management 'com.apple.configuration.intelligence.settings' configuration. | Default: true | Range: — | |
allowSafariSummarybooleaniOS 18.4+ · deprecated 26.4 · macOS 15.4+ · deprecated 26.4 · visionOS 2.4+ · deprecated 26.4 · not on tvOS, watchOS deprecated | boolean | If 'false', the system disables the ability to summarize content in Safari. Deprecated: use the declarative management 'com.apple.configuration.intelligence.settings' configuration. | Default: true | Range: — | |
Allow video conferencing remote control iOS 18.4+ · not on macOS, tvOS, watchOS, visionOS | boolean | If 'false', disables the ability for a remote FaceTime session to request control of the device. | Default: true | Range: — | |
allowSafariHistoryClearingbooleaniOS 26.0+ · macOS 26.0+ · visionOS 26.0+ · not on tvOS, watchOS | boolean | If 'false', the system disables the ability to clear browsing history in Safari. | Default: true | Range: — | |
allowSafariPrivateBrowsingbooleaniOS 26.0+ · macOS 26.0+ · visionOS 26.0+ · not on tvOS, watchOS | boolean | If 'false', the system disables the ability to use private browsing in Safari. | Default: true | Range: — | |
iOS 26.0+ · not on macOS, tvOS, watchOS, visionOS | array | An array of strings representing ICCIDs of cellular plans. The device prevents use of any matching cellular networks in iMessage and FaceTime. The array must contain no more than 4 ICCID strings. | Default: — | Range: — | |
Denied ICCID for iMessage and FaceTime | string | An ICCID. | Default: — | Range: — | |
deniedICCIDsForRCSarrayiOS 26.0+ · not on macOS, tvOS, watchOS, visionOS | array | An array of strings representing ICCIDs of cellular plans. The device prevents use of any matching cellular networks with RCS messaging. The array must contain no more than 4 ICCID strings. | Default: — | Range: — | |
deniedICCIDForRCSstringDenied ICCID for RCS | string | An ICCID. | Default: — | Range: — | |
Apps exempted from rating restrictions iOS 26.1+ · not on macOS, tvOS, watchOS, visionOS | array | If present, the system exempts apps with bundle IDs in the array from age-based rating restrictions. The system uses intersection combine rules to combine multiple payloads and any exceptions that parental control apps provide, including ScreenTime. | Default: — | Range: — | |
Exempted app | string | — | Default: — | Range: — | |
allowSiriAIbooleanAllow Siri Apple Intelligence integration iOS 27.0+ · deprecated 27.0 · not on macOS, tvOS, watchOS, visionOS deprecated | boolean | If 'false', the system disables Apple Intelligence integration in Siri. Deprecated: use the declarative management 'com.apple.configuration.siri.settings' configuration. | Default: true | Range: — | |
allowAirPlayIncomingRequestsbooleanAllow incoming AirPlay requests macOS 12.3+ · tvOS 10.2+ · not on iOS, watchOS, visionOS | boolean | If 'false', the system disables incoming AirPlay requests. | Default: true | Range: — | |
| boolean | If 'false', the system disables content caching. This restriction is not supported on the user channel. | Default: true | Range: — | ||
Allow modifying Printer Sharing setting macOS 14.0+ · not on iOS, tvOS, watchOS, visionOS | boolean | If 'false', the system prevents modifying Printer Sharing settings in System Settings. | Default: true | Range: — | |
allowUniversalControlbooleanAllow Universal Control macOS 13.0+ · not on iOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables Universal Control. | Default: true | Range: — | |
allowiTunesFileSharingbooleanAllow iTunes File Sharing macOS 10.13+ · not on iOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables iTunes file sharing services. | Default: true | Range: — | |
Allow modifying remote Apple Events Sharing setting macOS 14.0+ · not on iOS, tvOS, watchOS, visionOS | boolean | If 'false', the system prevents modifying Remote Apple Events Sharing settings in System Settings. | Default: true | Range: — | |
allowCloudBTMMbooleanAllow iCloud Back to My Mac | boolean | — | Default: true | Range: — | |
| boolean | If 'false', the system disables iCloud Bookmark sync. | Default: true | Range: — | ||
| boolean | If 'false', the system disables iCloud Calendar services. | Default: true | Range: — | ||
| boolean | If 'false', the system disables iCloud Contacts services. | Default: true | Range: — | ||
Allow iCloud Desktop & Documents macOS 10.12.4+ · not on iOS, tvOS, watchOS, visionOS | boolean | If 'false', the system disables iCloud Desktop and Document services. | Default: true | Range: — | |
allowCloudFMMbooleanAllow iCloud Find My Mac | boolean | — | Default: true | Range: — | |
| boolean | If 'false', the system disallows iCloud Freeform services. | Default: true | Range: — | ||
| boolean | If 'false', the system disables iCloud Mail services. | Default: true | Range: — | ||
| boolean | If 'false', the system disables iCloud Notes services. | Default: true | Range: — | ||
| boolean | If 'false', the system disables iCloud Reminder services. | Default: true | Range: — | ||
allowFileSharingModificationbooleanAllow modifying file sharing setting macOS 14.0+ · not on iOS, tvOS, watchOS, visionOS | boolean | If 'false', the system prevents modifying File Sharing setting in System Settings. | Default: true | Range: — | |
Allow modifying internet sharing setting macOS 14.0+ · not on iOS, tvOS, watchOS, visionOS | boolean | If 'false', the system prevents modifying the Internet Sharing setting in System Settings. | Default: true | Range: — | |
allowLocalUserCreationbooleanAllow creating users in System Settings macOS 14.0+ · not on iOS, tvOS, watchOS, visionOS | boolean | If 'false', the system prevents creating users in System Settings. | Default: true | Range: — | |
Allow modifying Remote Management Sharing setting macOS 14.0+ · not on iOS, tvOS, watchOS, visionOS | boolean | If 'false', the system prevents modifying the Remote Management Sharing setting in System Settings. | Default: true | Range: — | |
Allow modifying Bluetooth sharing setting macOS 14.0+ · not on iOS, tvOS, watchOS, visionOS | boolean | If 'false', the system prevents modifying Bluetooth settings in System Settings. | Default: true | Range: — | |
allowStartupDiskModificationbooleanAllow modifying startup disk settings macOS 14.0+ · not on iOS, tvOS, watchOS, visionOS | boolean | If 'false', the system prevents modification of Startup Disk settings in System Settings. | Default: true | Range: — | |
allowTimeMachineBackupbooleanAllow modifying Time Machine settings macOS 14.0+ · not on iOS, tvOS, watchOS, visionOS | boolean | If 'false', the system prevents modification of Time Machine settings in System Settings. This restriction isn't supported on the user channel. | Default: true | Range: — | |
Deferred Minor Software Updates Delay macOS 11.3+ · removed 27.0 · not on iOS, tvOS, watchOS, visionOS deprecated | integer | This restriction allows the administrator to set the number of days to delay a minor OS software update on the device. When this restriction is in place, the user sees a software update only after the specified delay after the release of the software update. This value controls the delay for 'forceDelayedSoftwareUpdates'. Removed: use the declarative management 'com.apple.configuration.softwareupdate.settings' configuration. | Default: 30 | Range: 1 – 90 | |
Defer non-OS Software Updates macOS 11.0+ · removed 27.0 · not on iOS, tvOS, watchOS, visionOS deprecated | boolean | If 'true', the system delays user visibility of non-OS software updates. Control visibility of operating system updates through 'forceDelayedSoftwareUpdates'. The delay is 30 days unless you set 'enforcedSoftwareUpdateDelay' to another value. | Default: false | Range: — | |
Deferred non-OS Software Updates Delay macOS 11.3+ · removed 27.0 · not on iOS, tvOS, watchOS, visionOS deprecated | integer | This restriction allows the administrator to set the number of days to delay an app software update on the device. When this restriction is in place, the user sees a non-OS software update only after the specified delay after the release of the software. This value controls the delay for 'forceDelayedAppSoftwareUpdates'. Removed: use the declarative management 'com.apple.configuration.softwareupdate.settings' configuration. | Default: 30 | Range: 1 – 90 | |
Defer Major OS Software Updates macOS 11.3+ · removed 27.0 · not on iOS, tvOS, watchOS, visionOS deprecated | boolean | If 'true', the system delays user visibility of major OS updates. Removed: use the declarative management 'com.apple.configuration.softwareupdate.settings' configuration. | Default: false | Range: — | |
Deferred Major Software Updates Delay macOS 11.3+ · removed 27.0 · not on iOS, tvOS, watchOS, visionOS deprecated | integer | This restriction allows the administrator to set the number of days to delay a major software upgrade on the device. When this restriction is in place, the user sees a software upgrade only after the specified delay after the release of the software upgrade. This value controls the delay for 'forceDelayedMajorSoftwareUpdates'. Removed: use the declarative management 'com.apple.configuration.softwareupdate.settings' configuration. | Default: 30 | Range: 1 – 90 | |
enforcedFingerprintTimeoutintegerEnforced Fingerprint Timeout macOS 12.0+ · not on iOS, tvOS, watchOS, visionOS | integer | The value, in seconds, after which the fingerprint unlock requires a password to authenticate. The default value is 48 hours. | Default: 172800 | Range: — | |
Allow modifying Media Sharing setting macOS 15.1+ · not on iOS, tvOS, watchOS, visionOS | boolean | If 'false', prevents modification of Media Sharing settings. | Default: true | Range: — | |
macOS 15.1+ · not on iOS, tvOS, watchOS, visionOS | boolean | If 'true', then the system bypasses the presentation of a screen capture alert. | Default: false | Range: — | |
allowRosettaUsageAwarenessbooleanAllow Rosetta Usage Awareness macOS 26.4+ · not on iOS, tvOS, watchOS, visionOS | boolean | If 'false', disables Rosetta usage awareness. When Rosetta usage awareness is active, the device displays a pop-up dialog to the user when launching an app that uses Rosetta. The pop-up dialog indicates that Rosetta will be removed in a future version of the operating system so that the user can contact the app vendor regarding a replacement for the current app. | Default: true | Range: — | |
allowAutomaticScreenSaverbooleanAllow Automatic Screen Saver tvOS 15.4+ · not on iOS, macOS, watchOS, visionOS | boolean | If 'false', the system disables Apple TV's automatic screen saver. | Default: true | Range: — | |
Require passcode on first AirPlay pairing not on iOS, macOS, watchOS, visionOS | boolean | If 'true', the system forces all devices sending AirPlay requests to this device to use a pairing password. This key isn't supported in tvOS 10.2 and later. Use the AirPlay Security Payload instead. | Default: false | Range: — | |
allowRemoteAppPairingbooleanAllow pairing with Remote app tvOS 10.2+ · not on iOS, macOS, watchOS, visionOS | boolean | If 'false', the system disables pairing Apple TV for use with the Control Center widget. | Default: true | Range: — | |
| boolean | If 'false', the system prevents the device from automatically sleeping. | Default: true | Range: — | ||
allowMediaSharingbooleanAllow Media Sharing | boolean | Controls whether media sharing is permitted on the device | Default: false | Range: — | |
Siri Data Sharing Opt-In Status | integer | Manages the user's opt-in status for sharing data with Siri and related services | Default: 2 | Range: Not Set (0), Opted In (1), Opted Out (2) |