Parental Controls: Application Restrictions

com.apple.applicationaccess.new

The payload that configures parental controls for apps.

macOS

macOS 10.7+combined

1 of 4 settings are available in the Intune Settings Catalog. Remaining settings require a custom .mobileconfig profile.

DDM recommended — 1 of 4 settings support Declarative Device Management

Apple recommends DDM over legacy profiles. DDM declarations are autonomous — the device enforces them without server round-trips. In Intune, use Settings Catalog → Declarative Device Management to configure these settings.

Configuration Keys (4)

Key	Type	Title	Description	Default	Range
`familyControlsEnabled`required	boolean	Enable application access restrictions	If 'true', enables app access restrictions.	—	—
`whiteList`	array	Allowlisted Applications by Code Signature	The allow list of app item dictionaries.	—	—
`pathWhiteList`	array	Allowlisted Application Folders	The paths to apps in the allow list. This property is deprecated in macOS 10.15 and later.	—	—
`pathBlackList`	array	Denylisted Application Folders	The paths to apps in the deny list. This property is deprecated in macOS 10.15 and later.	—	—
`whiteListItem`	dict	Allowlisted Item	A dictionary defining an app for parental control.	—	—
`bundleID`required	string	Bundle Identifier	The bundle ID of the app.	—	—
`displayName`	string	Display Name	The name used for display purposes.	—	—
`appID`required	data	Code Requirement	The identifier of the app. Obtain this value from the Security framework using 'SecCodeCopyDesignatedRequirement'.	—	—
`subApps`	array	Sub Apps	An array of nested helper applications.	—	—
`detachedSignature`	data	Detached Signature	The signature for an unsigned binary.	—	—
`appStore`	boolean	App Store	—	—	—
`disabled`	boolean	Disabled	If 'true', this app isn't added to the allow list.	false	—
`whiteListItem`	dict	—	A dictionary defining an app for parental control.	—	—
`bundleID`required	string	Bundle Identifier	The bundle ID of the app.	—	—
`displayName`	string	Display Name	The name used for display purposes.	—	—
`appID`required	data	Application Identifier	The identifier of the app. Obtain this value from the Security framework using 'SecCodeCopyDesignatedRequirement'.	—	—
`detachedSignature`	data	Detached Signature	The signature for an unsigned binary.	—	—
`appStore`	boolean	App Store	—	—	—
`disabled`	boolean	Disabled	If 'true', this app isn't added to the allow list.	—	—
`pathWhiteListItem`required	string	Folder Path	A path.	—	—
`pathBlackListItem`required	string	Folder Path	A path.	—	—