CalvinBackup/apple-device-management-mdm
1
0
Fork 0
mirror of https://github.com/apple/device-management.git synced 2026-09-27 11:52:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

Release-v27.0

Browse Source
This commit is contained in:
Cyrus Daboo
2026-09-17 09:59:16 -04:00
parent 67045e2fa0
commit 09f249a06e
759 changed files with 22171 additions and 2539 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mdm/checkin/authenticate.yaml
+2 -4
View File
@@ -118,10 +118,8 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: |-
The per-enrollment identifier for the device. The system requires this value if the enrollment type is a user enrollment.
Available in iOS 13 and later, macOS 10.15 and later, and visionOS 2 and later.
content: The per-enrollment identifier for the device. The system requires this
value if the enrollment type is a user enrollment.
- key: OSVersion
supportedOS:
iOS:
mdm/checkin/checkout.yaml
+2 -4
View File
@@ -76,10 +76,8 @@ payloadkeys:
introduced: n/a
type: <string>
presence: required
content: |-
The per-enrollment identifier for the device. The system requires this value if the enrollment type is a user enrollment.
Available in iOS 13 and later, macOS 10.15 and later, and visionOS 2 and later.
content: The per-enrollment identifier for the device. The system requires this
value if the enrollment type is a user enrollment.
notes:
- title: ''
content: |-
mdm/checkin/declarativemanagement.yaml
+4 -4
View File
@@ -167,11 +167,11 @@ notes:
content: |-
The `Data` field is optional, depending on the `Endpoint` value, as described below:
- `tokens`: The client uses the `tokens` endpoint to request the current synchronization tokens from the server. It doesn't use the `Data` field. A successful response to this request is a `200 OK` HTTP status, with a response body that's a JSON object conforming to the `TokensResponse` schema.
- `declaration-items`: The client uses the `declaration-items` endpoint to request the current declaration manifest from the server. It doesn't use the `Data` field. A successful response to this request is a `200 OK` HTTP status, with a response body that's a JSON object conforming to the `DeclarationItemsResponse` schema.
- `declaration/…/…` : The client uses the `declaration/…/…` endpoint to request a specific declaration from the server. It doesn't use the `Data` field.
* `tokens`: The client uses the `tokens` endpoint to request the current synchronization tokens from the server. It doesn't use the `Data` field. A successful response to this request is a `200 OK` HTTP status, with a response body that's a JSON object conforming to the `TokensResponse` schema.
* `declaration-items`: The client uses the `declaration-items` endpoint to request the current declaration manifest from the server. It doesn't use the `Data` field. A successful response to this request is a `200 OK` HTTP status, with a response body that's a JSON object conforming to the `DeclarationItemsResponse` schema.
* `declaration/…/…` : The client uses the `declaration/…/…` endpoint to request a specific declaration from the server. It doesn't use the `Data` field.
The endpoint value is a path with three segments separated by a slash character (`/`). The first segment is always `declaration`. The second segment indicates the declaration type and is one of `activation`, `asset`, `configuration`, or `management`. The third segment is the `Identifier` of the declaration to fetch.
A successful response to this request is a `200 OK` HTTP status, with a response body that's a JSON object representing the requested declaration. If the declaration isn't present on the server, it needs to return a `404 Not Found` HTTP status response to the device. That causes the device to remove any corresponding declaration that is present on it.
- `status`: The client uses the `status` endpoint to send a status report to the server. The `Data` field needs to be present and set to a Base64-encoded JSON object conforming to the `StatusReport` schema. A successful response to this request is a `200 OK` HTTP status, with an empty response body.
* `status`: The client uses the `status` endpoint to send a status report to the server. The `Data` field needs to be present and set to a Base64-encoded JSON object conforming to the `StatusReport` schema. A successful response to this request is a `200 OK` HTTP status, with an empty response body.
mdm/checkin/gettoken.yaml
+10 -10
View File
@@ -52,7 +52,7 @@ payloadkeys:
content: Parameters that the system uses to generate the token.
subkeys:
- key: SecurityToken
title: Security Token
title: Security token
supportedOS:
iOS:
sharedipad:
@@ -65,10 +65,10 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: A security token to generate the server token. Required by the `com.apple.watch.pairing`
service type.
content: A security token to generate the server token. The `com.apple.watch.pairing`
service type requires this key.
- key: PhoneUDID
title: Phone Identifier
title: Phone identifier
supportedOS:
iOS:
sharedipad:
@@ -81,10 +81,10 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: The identifier of the phone paired to the watch. Required by the `com.apple.watch.pairing`
service type.
content: The identifier of the phone paired to the watch. The `com.apple.watch.pairing`
service type requires this key.
- key: WatchUDID
title: Watch Identifier
title: Watch identifier
supportedOS:
iOS:
sharedipad:
@@ -97,8 +97,8 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: The identifier of the watch paired to the phone. Required by the `com.apple.watch.pairing`
service type.
content: The identifier of the watch paired to the phone. The `com.apple.watch.pairing`
service type requires this key.
- key: UDID
supportedOS:
iOS:
@@ -208,7 +208,7 @@ notes:
- `jti`: A `String`, per RFC 7519 section 4.1.7, that the server sets to a unique identifier (a random UUID) for the JWT. The Apple Identity Service uses this value to ensure that it only uses the token once.
- `service_type`: A `String` that the server sets to the value of the `TokenServiceType` key in the `CheckIn` request, which needs to be `com.apple.maid`.
Sign the JWT using the server's private key that corresponds to the RFC 3280 public key certificate that's registered with Apple Business Manager or Apple School Manager.
Sign the JWT using the server's private key that corresponds to the RFC 3280 public key certificate that's registered with Apple School Manager or Apple Business. The Apple Identity Service requires that the signing algorithm is "RS256" as defined in RFC 7518 section 3.1.
- title: Support Apple Watch pairing
content: For the service type `com.apple.watch.pairing`, the MDM server requests
this token to enroll an Apple Watch, with the request coming from the phone that's
mdm/checkin/returntoservice.yaml
+15 -4
View File
@@ -45,7 +45,7 @@ responsekeys:
presence: optional
default: false
content: If `true`, the device preserves the data plan on an iPhone or iPad with
eSIM functionality, if one exists. This value is available in iOS 26.4 and later.
eSIM functionality, if one exists.
- key: ReturnToService
type: <dictionary>
presence: required
@@ -60,21 +60,32 @@ responsekeys:
type: <data>
presence: optional
content: The Wi-Fi profile that installs after erasure when using return to service.
This is required when the device doesn't have Ethernet access.
The device requires this when it doesn't have Ethernet access.
- key: MDMProfileData
type: <data>
presence: optional
content: |-
The MDM profile that installs after erasure when using return to service. If provided, the device uses this profile directly instead of fetching it from the server. This key is required if the device's Automated Device Enrollment profile contains the `configuration-web-url` key.
The MDM profile that installs after erasure when using return to service. If provided, the device uses this profile directly instead of fetching it from the server. The device requires this key if its Automated Device Enrollment profile contains the `configuration-web-url` key.
The device always downloads the Automated Device Enrollment profile even when this key is present, so the supervision identity, MDM removability, and other settings still apply. However, the device doesn't use the specified URL in the Automated Device Enrollment profile to fetch the MDM profile.
- key: BootstrapToken
type: <data>
presence: optional
content: |-
The system uses the bootstrap token for return to service with app preservation. Required when Automated Device Enrollment enables return to service for the device.
The system uses the bootstrap token for return to service with app preservation. The device requires this key when Automated Device Enrollment enables return to service for the device.
If the bootstrap token isn't present, the device performs a full erasure and a regular return to service, and can't preserve any data for app preservation.
- key: ShouldRetryEnrollment
supportedOS:
iOS:
introduced: '27.0'
visionOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If `true`, the device retries service enrollment when the initial enrollment
fails after erasure.
notes:
- title: ''
content: The device sends the `ReturnToService` message when the user triggers a
mdm/checkin/tokenupdate.yaml
+6 -10
View File
@@ -93,10 +93,8 @@ payloadkeys:
introduced: n/a
type: <string>
presence: required
content: |-
The per-enrollment identifier for the device. The system requires this value if the enrollment type is a user enrollment.
Available in iOS 13 and later, macOS 10.15 and later, and visionOS 2 and later.
content: The per-enrollment identifier for the device. The system requires this
value if the enrollment type is a user enrollment.
- key: EnrollmentUserID
supportedOS:
iOS:
@@ -114,10 +112,8 @@ payloadkeys:
introduced: n/a
type: <string>
presence: required
content: |-
The per-enrollment identifier for the user. The system requires this value if the enrollment type is a user enrollment on the user channel.
Available in macOS 10.15 and later.
content: The per-enrollment identifier for the user. The system requires this value
if the enrollment type is a user enrollment on the user channel.
- key: UserShortName
supportedOS:
iOS:
@@ -224,11 +220,11 @@ notes:
In addition to sending the initial `TokenUpdate` message, the device may send additional `TokenUpdate` messages to the check-in server at any time while it has a valid MDM enrollment.
The use of `PushMagic` constrains the device to a unique MDM relationship. When a user removes the MDM profile, the device no longer listens to the former relationship, even if the user reestablishes a management relationship with the same server topic. Note that only the push topic is the same in this case; the server's address might change. This also helps when a user restores a device from backup that contains an older relationship. The use of `PushMagic` also ensures that the same organization owns both the server that receives the `CheckIn` message and the computer sending the push notifications. This is important because there's no way of knowing if the push topic belongs to the owner of the check-in server. It's conceivable that Apple might revoke a push token for one party, only to have that party reenroll people from some other topic that's actively pushing. The fact that all MDM push topics reside in the namespace `com.apple.mgmt.*` helps prevent this.
The use of `PushMagic` constrains the device to a unique MDM relationship. When a user removes the MDM profile, the device no longer listens to the former relationship, even if the user reestablishes a management relationship with the same server topic. Note that only the push topic is the same in this case; the server's address might change. This also helps when a user restores a device from backup that contains an older relationship. The use of `PushMagic` also ensures that the same organization owns both the server that receives the `CheckIn` message and the computer sending the push notifications. This is important because there's no way of knowing if the push topic belongs to the owner of the check-in server. It's conceivable that Apple might revoke a push token for one party, only to have that party reenroll people from some other topic that's actively pushing. The fact that all MDM push topics reside in the namespace `com.apple.mgmt.\*` helps prevent this.
The `PushMagic` or `UnlockToken` fields of subsequent `TokenUpdate` messages may be identical to those in previous messages, or may be different (and may differ in size from previous values). If different, the server needs to update its record for the device to the new values in the message. Failure to do so results in the server being unable to send push notifications or perform passcode resets.
Although a device can send the `TokenUpdate` message multiple times, it might send it only once if the values in the message never change. Ensure your implementation doesn't rely on repeated messages to update lost server-side data or to recover from a failure to process a previous `TokenUpdate` message. Also note that `UnlockToken` is optional. Don't treat the absence of an `UnlockToken` in a `TokenUpdate` message as an invalidation of a previously received `UnlockToken`.
> Note:
> The topic string for the MDM check-in protocol needs to start with `com.apple.mgmt.*` where `*` is a unique suffix.
> The topic string for the MDM check-in protocol needs to start with `com.apple.mgmt.\*` where `\*` is a unique suffix.
mdm/commands/account.configuration.yaml
+13 -12
View File
@@ -20,8 +20,8 @@ payload:
introduced: n/a
watchOS:
introduced: n/a
content: When a macOS (v10.11 and later) device is configured via DEP to enroll
in an MDM server and the DEP profile has the await_device_configuration flag set
content: When a macOS (v10.11 and later) device is configured via ADE to enroll
in an MDM server and the ADE profile has the await_device_configuration flag set
to true, the AccountConfiguration command can be sent to the device to have it
create the local administrator account (thereby skipping the page to create this
account in Setup Assistant). This command can only be sent to a macOS device that
@@ -47,8 +47,7 @@ payloadkeys:
presence: optional
content: The full name for the primary account. If present, Setup Assistant uses
this value to prefill the Full Name field. However, Setup Assistant ignores this
value if `DontAutoPopulatePrimaryAccountInfo` is `true`. This value is available
in macOS 10.15 and later.
value if `DontAutoPopulatePrimaryAccountInfo` is `true`.
- key: PrimaryAccountUserName
supportedOS:
macOS:
@@ -57,8 +56,7 @@ payloadkeys:
presence: optional
content: The account name for the primary account. If present, Setup Assistant uses
this value to prefill the User Name field. However, Setup Assistant ignores this
value if `DontAutoPopulatePrimaryAccountInfo` is `true`. This value is available
in macOS 10.15 and later.
value if `DontAutoPopulatePrimaryAccountInfo` is `true`.
- key: DontAutoPopulatePrimaryAccountInfo
supportedOS:
macOS:
@@ -69,7 +67,7 @@ payloadkeys:
content: If `true`, Setup Assistant ignores the primary account information and
requires the user to enter that information. If `false`, Setup Assistant prefills
the Full Name field with `PrimaryAccountFullName` and the User Name field with
`PrimaryAccountUserName`. This value is available in macOS 10.15 and later.
`PrimaryAccountUserName`.
- key: LockPrimaryAccountInfo
supportedOS:
macOS:
@@ -81,8 +79,6 @@ payloadkeys:
If `true`, and you provide values for `PrimaryAccountFullName` or `PrimaryAccountUserName`, Setup Assistant disables editing for the corresponding fields. `DontAutoPopulatePrimaryAccountInfo` must also be 0 (or missing).
If the user's password is also available from authentication through ConfigurationURL, Setup Assistant automatically creates the primary account with that information and skips showing the user interface to view or edit these fields.
This value is available in macOS 10.15 and later.
- key: AutoSetupAdminAccounts
type: <array>
presence: optional
@@ -108,10 +104,10 @@ payloadkeys:
title: passwordHash
type: <data>
presence: optional
content: Data that contains the pre-created salted PBKDF2 SHA512 password hash
content: Data that contains the pre-created salted PBKDF2 SHA512 `PasswordHash`
for the account.
- key: hidden
title: hidden
title: Hidden
type: <boolean>
presence: optional
default: false
@@ -126,8 +122,13 @@ payloadkeys:
content: If present, this is the short name of the local account to manage, which
can also be the account that results from setting `AutoSetupAdminAccounts` to
`true`. Otherwise, only the local account that Setup Assistant creates is a managed
account. This value is available in macOS 11 and later.
account.
notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/account.configuration/example1.plist
response-file: examples/mdm/commands/account.configuration/example2.plist
mdm/commands/application.extensions.listactive.yaml
+5
View File
@@ -89,3 +89,8 @@ notes:
Extensions restricted from executing by Application Launch Restrictions or the `NSExtensionManagement` configuration profile won't appear in the response.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/application.extensions.listactive/example1.plist
response-file: examples/mdm/commands/application.extensions.listactive/example2.plist
mdm/commands/application.extensions.mappings.yaml
+5
View File
@@ -55,3 +55,8 @@ notes:
This list is a superset of the list that `ActiveNSExtensionsCommand` returns. It may contain extensions that the system never enables due to various restrictions.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/application.extensions.mappings/example1.plist
response-file: examples/mdm/commands/application.extensions.mappings/example2.plist
mdm/commands/application.install.enterprise.yaml
+8 -9
View File
@@ -66,8 +66,6 @@ payloadkeys:
If `true`, install the app as a managed app. Otherwise, the system installs the app as unmanaged. If you reinstall a manged app and omit this value or set it to `false`, the app becomes unmanaged.
For manifest-based installs, if `true`, the system only considers apps installed in `/Applications` as managed. In macOS 11 through 13, the system requires that the `pkg` only contains a single signed app.
Available in macOS 11 and later.
- key: ManagementFlags
supportedOS:
macOS:
@@ -81,9 +79,7 @@ payloadkeys:
content: |-
The management flags. The possible values are:
- `1`: If `InstallAsManaged` is `true`, remove the app upon removal of the MDM profile.
Available in macOS 11 and later.
* `1`: If `InstallAsManaged` is `true`, remove the app upon removal of the MDM profile.
- key: Configuration
supportedOS:
macOS:
@@ -91,7 +87,7 @@ payloadkeys:
type: <dictionary>
presence: optional
content: A dictionary that contains the initial configuration of the app, if you
choose to provide it. Available in macOS 11 and later.
choose to provide it.
subkeys:
- key: ANY
type: <any>
@@ -110,9 +106,7 @@ payloadkeys:
content: |-
The change management state. This value doesn't work with the user enrollments. The only possible value is:
- `Managed`: Take management of the app if the user installed it already and `InstallAsManaged` is `true`.
Available in macOS 11 and later.
* `Managed`: Take management of the app if the user installed it already and `InstallAsManaged` is `true`.
- key: iOSApp
supportedOS:
iOS:
@@ -134,3 +128,8 @@ notes:
This command fails if Declarative Device Management is managing the app.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/application.install.enterprise/example1.plist
response-file: examples/mdm/commands/application.install.enterprise/example2.plist
mdm/commands/application.install.yaml
+32 -31
View File
@@ -53,7 +53,7 @@ payloadkeys:
The app's bundle identifier.
> Important:
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone to which the watch is paired. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting App and Book Information`.
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone the watch pairs with. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting app and book information (Legacy)`.
- key: Options
supportedOS:
iOS:
@@ -82,8 +82,8 @@ payloadkeys:
introduced: '7.0'
type: <string>
presence: optional
content: The URL of the app manifest, which needs to begin with `https:`. The manifest
is returned as a property list that uses the `ManifestURL` format.
content: The URL of the app manifest, which needs to begin with `https:`. The server
returns the manifest as a property list that uses the `ManifestURL` format.
- key: ManagementFlags
supportedOS:
macOS:
@@ -102,8 +102,6 @@ payloadkeys:
- `1`: If `InstallAsManaged` is `true`, remove the app upon removal of the MDM profile.
- `4`: Prevent backup of app data.
- `5`: Both `1` and `4`.
Available in iOS 5 and later, macOS 11 and later, and tvOS 10.2 and later.
- key: Configuration
supportedOS:
iOS:
@@ -113,8 +111,7 @@ payloadkeys:
type: <dictionary>
presence: optional
content: A dictionary that contains the initial configuration of the app, if you
choose to provide it. Available in iOS 7 and later, macOS 11 and later, and tvOS
10.2 and later.
choose to provide it.
subkeys:
- key: ANY
type: <any>
@@ -129,7 +126,7 @@ payloadkeys:
type: <dictionary>
presence: optional
content: A dictionary that contains the initial attributes of the app, if you choose
to provide it. Available in iOS 7 and later, and tvOS 10.2 and later.
to provide it.
subkeys:
- key: VPNUUID
supportedOS:
@@ -137,8 +134,7 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: A per-app VPN unique identifier for this app. Available in iOS 7 and
later.
content: A per-app VPN unique identifier for this app.
- key: ContentFilterUUID
supportedOS:
iOS:
@@ -149,7 +145,7 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: The content filter UUID for this app. Available in iOS 16 and later.
content: The content filter UUID for this app.
- key: DNSProxyUUID
supportedOS:
iOS:
@@ -160,7 +156,7 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: The DNS proxy UUID for this app. Available in iOS 16 and later.
content: The DNS proxy UUID for this app.
- key: RelayUUID
supportedOS:
iOS:
@@ -171,7 +167,7 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: The relay UUID for this app. Available in iOS 17 and later.
content: The relay UUID for this app.
- key: AssociatedDomains
supportedOS:
iOS:
@@ -180,8 +176,7 @@ payloadkeys:
introduced: n/a
type: <array>
presence: optional
content: An array that contains the associated domains to add to this app. Available
in iOS 13 and later.
content: An array that contains the associated domains to add to this app.
subkeys:
- key: AssociatedDomain
type: <string>
@@ -196,7 +191,7 @@ payloadkeys:
default: false
content: If `true`, perform claimed site association verification directly at
the domain instead of on Apple's servers. Only set this to `true` for domains
that can't access the internet. Available in iOS 14 and later.
that can't access the internet.
- key: Removable
supportedOS:
iOS:
@@ -206,8 +201,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: If `false`, this app isn't removable while it's a managed app. Available
in iOS 14 and later, and tvOS 14 and later.
content: If `false`, this app isn't removable while it's a managed app.
- key: TapToPayScreenLock
supportedOS:
iOS:
@@ -221,10 +215,9 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: |-
If `true`, Tap to Pay on iPhone requires users to use Face ID or a passcode to unlock their device after every transaction that requires a customer's card PIN. If `false`, the user can configure this setting on their device.
Available in iOS 16.4 and later.
content: If `true`, Tap to Pay on iPhone requires users to use Face ID or a passcode
to unlock their device after every transaction that requires a customer's card
PIN. If `false`, the user can configure this setting on their device.
- key: CellularSliceUUID
supportedOS:
iOS:
@@ -237,10 +230,9 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: |-
The data network name (DNN) or app category. For DNN, the value is `DNN:name`, where `name` is the carrier-provided DNN name. For app category, the value is `AppCategory:category`, where `category` is a carrier-provided string like "Enterprise1".
Available in iOS 17 and later.
content: The data network name (DNN) or app category. For DNN, the value is `DNN:name`,
where `name` is the carrier-provided DNN name. For app category, the value is
`AppCategory:category`, where `category` is a carrier-provided string like "Enterprise1".
- key: Hideable
supportedOS:
iOS:
@@ -290,9 +282,9 @@ payloadkeys:
rangelist:
- Managed
content: |-
The change management state. This value doesn't work with the user enrollment feature introduced in iOS 13, or any type of account driven enrollment. Available in iOS 9 and later, macOS 11 and later, and tvOS 10.2 and later. The only possible value is:
The change management state. This value doesn't work with the user enrollment feature introduced in iOS 13, or any type of account driven enrollment. The only possible value is:
- `Managed`: Take management of the app if the user installed it already and `InstallAsManaged` is `true`.
* `Managed`: Take management of the app if the user installed it already and `InstallAsManaged` is `true`.
- key: InstallAsManaged
supportedOS:
iOS:
@@ -314,8 +306,6 @@ payloadkeys:
If `true`, install the app as a managed app. Otherwise, the system installs the app as unmanaged. If you reinstall a manged app and omit this value or set it to `false`, the app becomes unmanaged.
For manifest-based installs, if `true`, the system only considers apps installed in `/Applications` as managed. In macOS 11 through 13, the system requires that the `pkg` only contains a single signed app.
Available in macOS 11 and later.
- key: iOSApp
supportedOS:
iOS:
@@ -341,7 +331,7 @@ responsekeys:
The app's bundle identifier, if the user accepted the request.
> Note:
> For a watchOS app, the identifier is the watch's bundle identifier, which differs from the main bundle identifier for the iPhone that the watch is paired to.
> For a watchOS app, the identifier is the watch's bundle identifier, which differs from the main bundle identifier for the iPhone the watch pairs with.
- key: State
type: <string>
presence: optional
@@ -402,3 +392,14 @@ notes:
Prior to iOS 16.0 and tvOS 16.0, this command would return `NotNow` when Setup Assistant was running. Starting in iOS 16.0 and tvOS 16.0, the command may be sent to supervised devices during Setup Assistant. However, you should only attempt to install device-based VPP apps or enterprise apps while in the awaiting configuration state, as it is unlikely the device would have an App Store account configured, and thus commands that depend on one will fail.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- tab: Enterprise
description: This command installs an enterprise app.
request-file: examples/mdm/commands/application.install/example1.plist
response-file: examples/mdm/commands/application.install/example2.plist
- tab: App Store
description: This command installs an App Store app.
request-file: examples/mdm/commands/application.install/example3.plist
response-file: examples/mdm/commands/application.install/example4.plist
mdm/commands/application.installed.list.yaml
+42 -26
View File
@@ -48,10 +48,10 @@ payloadkeys:
type: <array>
presence: optional
content: |-
An array of app identifiers. Provide this value to limit the response to only include these apps. This value is available in iOS 7 and later, macOS 10.15 and later, tvOS 10.2 and later, visionOS 1.1 and later, and watchOS 10 and later.
An array of app identifiers. Provide this value to limit the response to only include these apps.
> Important:
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone to which the watch is paired. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting App and Book Information`.
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone the watch pairs with. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting app and book information (Legacy)`.
subkeys:
- key: IdentifiersItem
type: <string>
@@ -65,7 +65,7 @@ payloadkeys:
presence: optional
default: false
content: |-
If `true`, only get a list of managed apps, excluding ones that Declarative Device Management is managing. This value is available in iOS 7 and later, macOS 10.15 and later, and tvOS 10.2 and later.
If `true`, only get a list of managed apps, excluding ones that Declarative Device Management is managing.
> Note:
> If the enrollment type is a user enrollment, the system always considers this key as set to `true` and only returns managed apps, excluding ones that Declarative Device Management is managing.
@@ -121,7 +121,7 @@ responsekeys:
The app's identifier. This key is always be present on iOS and tvOS, but may be missing on macOS.
> Note:
> For a watchOS app, the identifier is the watch's bundle identifier, which differs from the main bundle identifier for the iPhone to which the watch is paired.
> For a watchOS app, the identifier is the watch's bundle identifier, which differs from the main bundle identifier for the iPhone the watch pairs with.
- key: ExternalVersionIdentifier
supportedOS:
iOS:
@@ -133,7 +133,7 @@ responsekeys:
type: <integer>
presence: optional
content: |-
The app's external version identifier. You can also retrieve this value from the App Store. For more information, see `Apps and Books for Organizations`.
The app's external version identifier. You can also retrieve this value from the App Store. For more information, see `Apps and books metadata for organizations`.
If the current external version identifier of an app on the App Store doesn't match the external version identifier reported by the device, there may be an app update available for the device.
@@ -153,8 +153,7 @@ responsekeys:
introduced: n/a
type: <string>
presence: optional
content: The marketplace hosted application's distributor ID. This value is
available in iOS 17.4 and later.
content: The marketplace hosted application's distributor ID.
- key: Version
type: <string>
presence: optional
@@ -170,6 +169,19 @@ responsekeys:
type: <string>
presence: optional
content: The app's name.
- key: Path
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The app's path.
- key: BundleSize
supportedOS:
macOS:
@@ -178,9 +190,8 @@ responsekeys:
presence: optional
content: The app's static bundle size, in bytes. This value is expensive to
calculate. Starting in iOS 26, macOS 26, tvOS 26, watchOS 26, and visionOS
26 it isn't present in the response unless it is included in the `Items` request
key. This value is available in iOS 5 and later, and macOS 10.7 and later,
tvOS 10.2 and later, watchOS 10 and later, and visionOS 1.1 and later.
26 it isn't present in the response unless it's included in the `Items` request
key.
- key: DynamicSize
supportedOS:
iOS:
@@ -192,9 +203,7 @@ responsekeys:
content: The size of the app's file system in bytes, including the Documents,
Library, and other directories. This value is expensive to calculate. Starting
in iOS 26, tvOS 26, watchOS 26, and visionOS 26 it isn't present in the response
unless it is included in the `Items` request key. This value is available
in iOS 5 and later, tvOS 10.2 and later, watchOS 10 and later, and visionOS
1.1 and later.
unless it's included in the `Items` request key.
- key: IsValidated
supportedOS:
iOS:
@@ -205,8 +214,7 @@ responsekeys:
presence: optional
content: If `true`, the app is valid and can run on the device. If the app is
enterprise-distributed and unvalidated, it won't be able to run until validation
has occurred. This value is available in iOS 9.2 and later, and tvOS 10.2
and later.
has occurred.
- key: Installing
type: <boolean>
presence: optional
@@ -223,8 +231,7 @@ responsekeys:
presence: optional
content: If `true`, the app came from the App Store and can participate in store
features. For device-based Volume Purchase Program (VPP) apps, this value
is `false`. This value is available in iOS 11.3 and later, and tvOS 11.3 and
later.
is `false`.
- key: DeviceBasedVPP
supportedOS:
iOS:
@@ -235,8 +242,7 @@ responsekeys:
introduced: '11.3'
type: <boolean>
presence: optional
content: If `true`, installing the app didn't require an Apple Account. This
value is available in iOS 11.3 and later, and tvOS 11.3 and later.
content: If `true`, installing the app didn't require an Apple Account.
- key: BetaApp
supportedOS:
iOS:
@@ -247,8 +253,7 @@ responsekeys:
introduced: '11.3'
type: <boolean>
presence: optional
content: If `true`, the app is part of the Apple Beta Software Program. This
value is available in iOS 11.3 and later, and tvOS 11.3 and later.
content: If `true`, the app is part of the Apple Beta Software Program.
- key: AdHocCodeSigned
supportedOS:
iOS:
@@ -259,8 +264,7 @@ responsekeys:
introduced: '11.3'
type: <boolean>
presence: optional
content: If `true`, the app is ad-hoc code signed. This query is available in
iOS 11.3 and later, and tvOS 11.3 and later.
content: If `true`, the app is ad-hoc code signed.
- key: HasUpdateAvailable
supportedOS:
iOS:
@@ -306,7 +310,7 @@ responsekeys:
type: <boolean>
presence: optional
default: false
content: If `true`, the app is an App Clip. Available in iOS 16 and later.
content: If `true`, the app is an App Clip.
- key: Source
supportedOS:
iOS:
@@ -321,8 +325,8 @@ responsekeys:
introduced: n/a
type: <string>
presence: optional
content: The source of the application. When the app is managed by Declarative
Device Management this value is `Declarative Device Management`.
content: The source of the application. When Declarative Device Management manages
the app, this value is `Declarative Device Management`.
notes:
- title: ''
content: |-
@@ -331,3 +335,15 @@ notes:
This command doesn't return apps that Declarative Device Management is managing if the `ManagedAppsOnly` key is set to `true`, or if the enrollment type is a user enrollment.
Refer to the following sections to determine supported channels and requirements, and to see request and response examples for iOS and macOS.
examples:
- title: Example request and response
files:
- tab: Managed
description: This command lists only managed apps.
request-file: examples/mdm/commands/application.installed.list/example1.plist
response-file: examples/mdm/commands/application.installed.list/example2.plist
- tab: All
description: This command lists all apps. The example response shows a subset
of the full response.
request-file: examples/mdm/commands/application.installed.list/example3.plist
response-file: examples/mdm/commands/application.installed.list/example4.plist
mdm/commands/application.invitetoprogram.yaml
+5
View File
@@ -57,3 +57,8 @@ notes:
The command doesn't work with Account Driven enrollments.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/application.invitetoprogram/example1.plist
response-file: examples/mdm/commands/application.invitetoprogram/example2.plist
mdm/commands/application.managed.list.yaml
+13 -15
View File
@@ -49,7 +49,7 @@ payloadkeys:
The bundle identifiers of the managed apps to include in the response.
> Important:
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone to which the watch is paired. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting App and Book Information`.
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone the watch pairs with. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting app and book information (Legacy)`.
subkeys:
- key: IdentifiersItem
type: <string>
@@ -133,8 +133,7 @@ responsekeys:
type: <string>
presence: required
content: If the user already purchased a paid app, this code is available for
use by another user. This code reports only once. This value is available
in iOS 5 and later.
use by another user. This code reports only once.
- key: HasConfiguration
supportedOS:
iOS:
@@ -143,10 +142,7 @@ responsekeys:
introduced: '11.0'
type: <boolean>
presence: required
content: If 'true', the app has an update available. This key is present only
for App Store apps. In macOS, this key is present only for Volume Purchase
Program (VPP) apps. This status updates daily and isn't always up-to-date
when installing an app.
content: If 'true', the app has a server-provided managed configuration.
- key: HasFeedback
supportedOS:
iOS:
@@ -156,9 +152,9 @@ responsekeys:
devicechannel: false
type: <boolean>
presence: required
content: If 'true', the app has feedback for the server. This value is available
in iOS 7 and later, and tvOS 10.2 and later. On macOS 11.3 and later, this
value is available if the request was sent on the user channel.
content: If 'true', the app has feedback for the server. On macOS 11.3 and later,
this value is available if the device management server sent the request on
the user channel.
- key: IsValidated
supportedOS:
iOS:
@@ -169,8 +165,7 @@ responsekeys:
presence: required
content: If 'true', the app is valid and can run on the device. If the app is
enterprise-distributed and unvalidated, it won't be able to run until validation
has occurred. This value is available in iOS 9.2 and later, and tvOS 10.2
and later.
has occurred.
- key: ExternalVersionIdentifier
supportedOS:
iOS:
@@ -182,12 +177,10 @@ responsekeys:
type: <integer>
presence: required
content: |-
The app's external version identifier. You can also retrieve this value from the App Store. For more information, see `Apps and Books for Organizations`.
The app's external version identifier. You can also retrieve this value from the App Store. For more information, see `Apps and books metadata for organizations`.
If the current external version identifier of an app on the App Store doesn't match the external version identifier reported by the device, there may be an app update available for the device.
Available in iOS 10.3 and later, macOS 11.3 and later, and tvOS 10.2 and later.
> Note:
> A newer version of an app might not be available for installation on the device for a variety of reasons. A common reason is that the device's operating system version or hardware is incompatible with the available version of the app.
notes:
@@ -200,3 +193,8 @@ notes:
This command doesn't return apps that Declarative Device Management is managing.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/application.managed.list/example1.plist
response-file: examples/mdm/commands/application.managed.list/example2.plist
mdm/commands/application.redemptioncode.yaml
+5
View File
@@ -37,3 +37,8 @@ notes:
Sending a redemption code to an app that doesn't need it produces an error.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/application.redemptioncode/example1.plist
response-file: examples/mdm/commands/application.redemptioncode/example2.plist
mdm/commands/application.remove.yaml
+6 -1
View File
@@ -46,7 +46,7 @@ payloadkeys:
The bundle identifier of the managed app.
> Important:
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone to which the watch is paired. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting App and Book Information`.
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone the watch pairs with. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting app and book information (Legacy)`.
notes:
- title: ''
content: |-
@@ -55,3 +55,8 @@ notes:
This command fails for apps that Declarative Device Management is managing.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/application.remove/example1.plist
response-file: examples/mdm/commands/application.remove/example2.plist
mdm/commands/application.validate.yaml
+5
View File
@@ -45,3 +45,8 @@ notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/application.validate/example1.plist
response-file: examples/mdm/commands/application.validate/example2.plist
mdm/commands/cancel.enhanced.log.collection.yaml
+33
View File
@@ -0,0 +1,33 @@
title: Cancel Enhanced Log Collection Command
description: Cancel enhanced log collection on the device.
payload:
requesttype: CancelEnhancedLogCollection
supportedOS:
iOS:
introduced: '27.0'
supervised: true
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: '27.0'
devicechannel: false
userchannel: true
supervised: true
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: '27.0'
supervised: true
requiresdep: false
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command cancels any active enhanced log collection session on a supervised
device. If no session is in progress, the command does nothing and returns `Acknowledged`.
mdm/commands/certificate.list.yaml
+6 -2
View File
@@ -52,8 +52,7 @@ payloadkeys:
default: false
content: If `true`, only include certificates that MDM installed or that are in
the same profile as the MDM payload. User-enrolled devices ignore this value and
always only include managed certificates. This value is available in iOS 13 and
later, macOS 10.15 and later, and tvOS 13 and later.
always only include managed certificates.
responsekeys:
- key: CertificateList
type: <array>
@@ -86,3 +85,8 @@ notes:
Starting with iOS 15.4, this command returns a Not Now response before the passcode-protected device's first unlock after a device boots. Between iOS 15.0 and iOS 15.4, devices in that state didn't respond with Not Now, but the response might not contain all identity certificates.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/certificate.list/example1.plist
response-file: examples/mdm/commands/certificate.list/example2.plist
mdm/commands/declarativemanagement.yaml
+5
View File
@@ -48,3 +48,8 @@ notes:
content: The server uses this command to turn on the declarative management engine
on the device the first time the server sends it. Subsequent commands trigger
a declarative management synchronization operation.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/declarativemanagement/example1.plist
response-file: examples/mdm/commands/declarativemanagement/example2.plist
mdm/commands/device.activationlock.bypasscode.yaml
+6 -1
View File
@@ -44,10 +44,15 @@ notes:
content: |-
This command allows organizations to retrieve the device's bypass code. Organizations can use the bypass code to remove the Activation Lock from supervised devices prior to device activation without knowing the user's personal Apple Account and password.
Supervised devices generate a device-specific Activation Lock bypass code. The activation server verifies this code to bypass Activation Lock on the device. For more information, see `Creating and Using Bypass Codes`.
Supervised devices generate a device-specific Activation Lock bypass code. The activation server verifies this code to bypass Activation Lock on the device. For more information, see `Creating and using bypass codes`.
A device creates a new bypass code when:
- Setting up the device the first time.
- Erasing and not restoring the device from a backup.
- Erasing and restoring the device from a backup from a different device.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/device.activationlock.bypasscode/example1.plist
response-file: examples/mdm/commands/device.activationlock.bypasscode/example2.plist
mdm/commands/device.activationlock.clearbypasscode.yaml
+5
View File
@@ -37,3 +37,8 @@ notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/device.activationlock.clearbypasscode/example1.plist
response-file: examples/mdm/commands/device.activationlock.clearbypasscode/example2.plist
mdm/commands/device.configured.yaml
+8 -3
View File
@@ -36,11 +36,16 @@ payload:
mode: forbidden
watchOS:
introduced: n/a
content: Informs the device that it can continue past DEP enrollment. Only works
on devices in DEP that have their cloud configuration set to await configuration.
content: Informs the device that it can continue past ADE enrollment. Only works
on devices in ADE that have their cloud configuration set to await configuration.
notes:
- title: ''
content: |-
This command only works on Device Enrollment Program (DEP) devices that have their cloud configuration set to await configuration.
This command only works on Automated Device Enrollment (ADE) devices that have their cloud configuration set to await configuration.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/device.configured/example1.plist
response-file: examples/mdm/commands/device.configured/example2.plist
mdm/commands/device.erase.yaml
+26 -8
View File
@@ -55,7 +55,7 @@ payloadkeys:
presence: optional
default: false
content: If `true`, preserve the data plan on an iPhone or iPad with eSIM functionality,
if one exists. This value is available in iOS 11 and later.
if one exists.
- key: DisallowProximitySetup
supportedOS:
iOS:
@@ -74,8 +74,7 @@ payloadkeys:
presence: optional
default: false
content: If `true`, disable Proximity Setup on the next reboot and skip the pane
in Setup Assistant. This value is available in iOS 11 and later. Prior to iOS
14, don't use this option with any other option.
in Setup Assistant. Prior to iOS 14, don't use this option with any other option.
- key: PIN
supportedOS:
iOS:
@@ -90,8 +89,7 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: The six-character PIN for Find My. This value is available in macOS 10.8
and later.
content: The six-character PIN for Find My.
- key: ObliterationBehavior
supportedOS:
iOS:
@@ -141,9 +139,7 @@ payloadkeys:
introduced: n/a
type: <dictionary>
presence: optional
content: The configuration settings for return to service. This value is available
in iOS 17 and later, with Shared iPad, in tvOS 18 and later, and in visionOS 26
and later.
content: The configuration settings for return to service.
subkeys:
- key: Enabled
title: Use return to service
@@ -180,9 +176,31 @@ payloadkeys:
content: The bootstrap token the system uses to implement return to service with
app preservation. Required when enabling return to service through the cloud
configuration.
- key: ShouldRetryEnrollment
supportedOS:
iOS:
introduced: '27.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If `true`, the device retries service enrollment when the initial enrollment
fails after erasure.
notes:
- title: ''
content: |-
This command allows the server to immediately erase a device, even a locked device, without warning the user. The device sends a response to the server, but it doesn't retry if it isn't successful the first time.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/device.erase/example1.plist
response-file: examples/mdm/commands/device.erase/example2.plist
mdm/commands/device.esim.yaml
+5
View File
@@ -40,3 +40,8 @@ notes:
- `36001`: Unable to communicate with the cellular software stack.
- `36002`: The hardware doesn't support this command.
- `36003`: The cellular stack was unable to perform the request. This error can also occur if the cellular stack is busy, in which case, retrying the command later may resolve the issue.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/device.esim/example1.plist
response-file: examples/mdm/commands/device.esim/example2.plist
mdm/commands/device.lock.yaml
+9 -6
View File
@@ -52,8 +52,7 @@ payloadkeys:
type: <string>
presence: optional
content: The message to display on the Lock Screen of the device. This value doesn't
apply to a Shared iPad device. This value is available in iOS 4 and later, and
macOS 10.14 and later.
apply to a Shared iPad device.
- key: PhoneNumber
supportedOS:
iOS:
@@ -67,8 +66,8 @@ payloadkeys:
type: <string>
presence: optional
content: The phone number to display on the Lock Screen. This value doesn't apply
to a Shared iPad device. This value is available in iOS 7 and later and macOS
11.5 and later (for a Mac with Apple silicon only).
to a Shared iPad device. This value is available for a Mac with Apple silicon
only.
- key: PIN
supportedOS:
iOS:
@@ -81,8 +80,7 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: The six-character PIN for Find My. This value is available in macOS 10.8
and later.
content: The six-character PIN for Find My.
responsekeys:
- key: MessageResult
type: <string>
@@ -103,3 +101,8 @@ notes:
> Sending this command to a Mac with Apple silicon running a version of macOS before 11.5 deactivates the Mac. To reactivate that Mac, it needs a network connection and authentication by a local administrator with Secure Token enabled.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/device.lock/example1.plist
response-file: examples/mdm/commands/device.lock/example2.plist
mdm/commands/device.lostmode.disable.yaml
+5
View File
@@ -35,3 +35,8 @@ notes:
Erasing a device also disables Lost Mode. To reenable Lost Mode, the MDM server needs to store the device's Lost Mode state before erasing it, and restore that state if the device enrolls again.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/device.lostmode.disable/example1.plist
response-file: examples/mdm/commands/device.lostmode.disable/example2.plist
mdm/commands/device.lostmode.enable.yaml
+5
View File
@@ -47,3 +47,8 @@ notes:
While in Lost Mode, a device responds to invalid commands with error code `12078`.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/device.lostmode.enable/example1.plist
response-file: examples/mdm/commands/device.lostmode.enable/example2.plist
mdm/commands/device.lostmode.location.yaml
+5
View File
@@ -89,3 +89,8 @@ notes:
- `12078`: If the command is invalid while in Lost Mode.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/device.lostmode.location/example1.plist
response-file: examples/mdm/commands/device.lostmode.location/example2.plist
mdm/commands/device.lostmode.playsound.yaml
+5
View File
@@ -36,3 +36,8 @@ notes:
The sound plays until the server disables Lost Mode or the user disables the sound on the device.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/device.lostmode.playsound/example1.plist
response-file: examples/mdm/commands/device.lostmode.playsound/example2.plist
mdm/commands/device.restart.yaml
+10 -6
View File
@@ -48,7 +48,7 @@ payloadkeys:
content: If `true`, the system rebuilds the kernel cache during a device restart.
If `BootstrapTokenAllowedForAuthentication` is `true` in the `SecurityInfo` response,
the device requests the bootstrap token from the MDM server prior to executing
this command. This value is available in macOS 11 and later.
this command.
- key: KextPaths
supportedOS:
iOS:
@@ -62,7 +62,6 @@ payloadkeys:
content: If `RebuildKernelCache` is `true`, this value specifies the paths to kexts
to add to the auxiliary kernel cache since the last kernel cache rebuild. If not
present, the system only adds previously discovered kexts to the kernel cache.
This value is available in macOS 11 and later.
subkeys:
- key: KextPathsItem
type: <string>
@@ -77,13 +76,18 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: |-
If `true`, notifies the user to restart the device at their convenience. No forced restart occurs unless the device is at `loginwindow` with no logged-in users. The user can dismiss the notification and ignore the request. No further notifications display unless you resend the command.
This value is available in macOS 11.3 and later.
content: If `true`, notifies the user to restart the device at their convenience.
No forced restart occurs unless the device is at `loginwindow` with no logged-in
users. The user can dismiss the notification and ignore the request. No further
notifications display unless you resend the command.
notes:
- title: ''
content: |-
A passcode-locked iOS device doesn't rejoin a Wi-Fi network after restarting, so it may not be able to communicate with the server.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/device.restart/example1.plist
response-file: examples/mdm/commands/device.restart/example2.plist
mdm/commands/device.restrictions.clearpassword.yaml
+5
View File
@@ -28,3 +28,8 @@ notes:
In iOS 12.2 and later, if Screen Time uses iCloud to share its settings (Share Across Devices), this command disables Screen Time entirely and clears its restrictions. If the user is a child in an iCloud family, the command fails. Otherwise, if Screen Time isn't using iCloud, this command clears the passcode, but not the restrictions, and it leaves Screen Time enabled.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/device.restrictions.clearpassword/example1.plist
response-file: examples/mdm/commands/device.restrictions.clearpassword/example2.plist
mdm/commands/device.restrictions.list.yaml
+8 -6
View File
@@ -40,14 +40,12 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If `true`, the device reports restrictions from each profile. This value
is available in iOS 4 and later, and tvOS 6.1 and later.
content: If `true`, the device reports restrictions from each profile.
responsekeys:
- key: GlobalRestrictions
type: <dictionary>
presence: required
content: A dictionary that contains the global restrictions in effect. This value
is available in iOS 4 and later, and tvOS 6.1 and later.
content: A dictionary that contains the global restrictions in effect.
subkeytype: RestrictionsDictionary
subkeys: &id001
- key: restrictedBool
@@ -124,8 +122,7 @@ responsekeys:
presence: required
content: A dictionary that contains dictionaries of restrictions from each profile.
This value is only available when `ProfileRestrictions` is `true` in the command.
The keys are the identifiers of the profiles. This value is available in iOS 4
and later, and tvOS 6.1 and later.
The keys are the identifiers of the profiles.
subkeys:
- key: ANY profile identifier
type: <dictionary>
@@ -138,3 +135,8 @@ notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/device.restrictions.list/example1.plist
response-file: examples/mdm/commands/device.restrictions.list/example2.plist
mdm/commands/device.shutdown.yaml
+5
View File
@@ -37,3 +37,8 @@ notes:
A passcode-locked iOS device doesn't rejoin a Wi-Fi network after a user restarts it and before they unlock it for the first time, so it can't communicate with the server if it needs Wi-Fi to do so.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/device.shutdown/example1.plist
response-file: examples/mdm/commands/device.shutdown/example2.plist
mdm/commands/information.device.yaml
+157 -205
View File
File diff suppressed because it is too large Load Diff
mdm/commands/information.security.yaml
+26 -39
View File
@@ -60,8 +60,6 @@ responsekeys:
> Important:
> For a device to have data protection, `HardwareEncryptionCaps` must be `3` and `PasscodePresent` must `true`.
This value is available in iOS 4 and later, and tvOS 6 and later.
- key: PasscodePresent
supportedOS:
iOS:
@@ -74,15 +72,14 @@ responsekeys:
mode: forbidden
type: <boolean>
content: If `true`, the device has a passcode. This key doesn't apply to User-Enrolled
devices. This value is available in iOS 4 and later, and tvOS 6 and later.
devices.
- key: PasscodeCompliant
supportedOS:
macOS:
introduced: n/a
type: <boolean>
content: If `true`, the user's passcode is compliant with all requirements on
the device, including Exchange and other accounts. This value is available in
iOS 4 and later, and tvOS 6 and later.
the device, including Exchange and other accounts.
- key: PasscodeCompliantWithProfiles
supportedOS:
iOS:
@@ -95,8 +92,7 @@ responsekeys:
mode: forbidden
type: <boolean>
content: If `true`, the user's passcode is compliant with requirements from profiles.
This key doesn't apply to User-Enrolled devices. This value is available in
iOS 4 and later, and tvOS 6 and later.
This key doesn't apply to User-Enrolled devices.
- key: PasscodeLockGracePeriod
supportedOS:
iOS:
@@ -162,7 +158,6 @@ responsekeys:
introduced: n/a
type: <boolean>
content: If `true`, the device has enabled FileVault full disk encryption (FDE).
This value is available in macOS 10.9 and later.
- key: FDE_HasPersonalRecoveryKey
supportedOS:
iOS:
@@ -179,8 +174,7 @@ responsekeys:
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, FileVault FDE has a personal recovery key. This value is available
in macOS 10.9 and later.
content: If `true`, FileVault FDE has a personal recovery key.
- key: FDE_HasInstitutionalRecoveryKey
supportedOS:
iOS:
@@ -197,8 +191,7 @@ responsekeys:
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, FileVault FDE has an institutional recovery key. This value
is available in macOS 10.9 and later.
content: If `true`, FileVault FDE has an institutional recovery key.
- key: FDE_PersonalRecoveryKeyCMS
supportedOS:
iOS:
@@ -217,8 +210,7 @@ responsekeys:
type: <data>
content: If the FileVault personal recovery key has enabled escrow with a recovery
key, this value contains the key. The certificate from the `FDERecoveryKeyEscrow`
profile encrypts the key and wraps it as CMS data. This value is available in
macOS 10.13 and later.
profile encrypts the key and wraps it as CMS data.
- key: FDE_PersonalRecoveryKeyDeviceKey
supportedOS:
iOS:
@@ -240,8 +232,7 @@ responsekeys:
to the user at the EFI Login Window as part of the help message if they enter
their password incorrectly three times. The server also uses this value as an
index when saving the device personal recovery key. This replaces the `recordNumber`
that the server returned in the previous escrow mechanism. This value is available
in macOS 10.13 and later.
that the server returned in the previous escrow mechanism.
- key: SystemIntegrityProtectionEnabled
supportedOS:
iOS:
@@ -257,7 +248,6 @@ responsekeys:
introduced: n/a
type: <boolean>
content: If `true`, System Integrity Protection (SIP) is active on the device.
This value is available in macOS 10.12 and later.
- key: FirewallSettings
supportedOS:
iOS:
@@ -272,8 +262,7 @@ responsekeys:
watchOS:
introduced: n/a
type: <dictionary>
content: A dictionary that contains the firewall settings. This value is available
in macOS 10.12 and later.
content: A dictionary that contains the firewall settings.
subkeys:
- key: FirewallEnabled
type: <boolean>
@@ -336,8 +325,7 @@ responsekeys:
watchOS:
introduced: n/a
type: <dictionary>
content: A dictionary that contains the status of the EFI firmware password. This
value is available in macOS 10.13 and later.
content: A dictionary that contains the status of the EFI firmware password.
subkeys:
- key: PasswordExists
type: <boolean>
@@ -374,8 +362,8 @@ responsekeys:
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the device enrolled in MDM through the Device Enrollment
Program (DEP). This value is available in macOS 10.13.2 and later.
content: If `true`, the device enrolled in MDM through Automated Device Enrollment
(ADE).
- key: UserApprovedEnrollment
supportedOS:
iOS:
@@ -388,15 +376,13 @@ responsekeys:
introduced: n/a
type: <boolean>
content: If `true`, the enrollment was user-approved. If `false`, the device
may reject certain security-sensitive payloads or commands. This value is
available in macOS 10.13.2 and later.
may reject certain security-sensitive payloads or commands.
- key: IsUserEnrollment
supportedOS:
macOS:
introduced: '10.15'
type: <boolean>
content: If `true`, the device is user-enrolled. This value is available in
iOS 13 and later, and macOS 10.15 and later.
content: If `true`, the device is user-enrolled.
- key: IsActivationLockManageable
supportedOS:
iOS:
@@ -411,7 +397,7 @@ responsekeys:
introduced: n/a
type: <boolean>
content: If `true`, the type of enrollment allows the MDM to manage Activation
Lock for this device. This value is available in macOS 10.15 and later.
Lock for this device.
- key: SecureBoot
supportedOS:
iOS:
@@ -426,8 +412,7 @@ responsekeys:
watchOS:
introduced: n/a
type: <dictionary>
content: A dictionary that contains the device's Secure Boot settings. This value
is available in macOS 10.15 and later.
content: A dictionary that contains the device's Secure Boot settings.
subkeys:
- key: SecureBootLevel
type: <string>
@@ -450,10 +435,9 @@ responsekeys:
macOS:
introduced: '11.0'
type: <array>
content: |-
Reports which security features the user disables in `recoveryOS`. This property is only present for a Mac with Apple silicon when `SecureBootLevel` is `medium`.
Available in iOS 11 and later.
content: Reports which security features the user disables in `recoveryOS`.
This property is only present for a Mac with Apple silicon when `SecureBootLevel`
is `medium`.
subkeys:
- key: ReducedSecurityItems
type: <string>
@@ -485,8 +469,7 @@ responsekeys:
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, Remote Desktop is active on the device. This value is available
in macOS 10.14.4 and later.
content: If `true`, Remote Desktop is active on the device.
- key: AuthenticatedRootVolumeEnabled
supportedOS:
iOS:
@@ -501,8 +484,7 @@ responsekeys:
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the system booted using an Authenticated Root Volume. This
value is available in macOS 11 and later.
content: If `true`, the system booted using an Authenticated Root Volume.
- key: BootstrapTokenAllowedForAuthentication
supportedOS:
iOS:
@@ -524,7 +506,7 @@ responsekeys:
- disallowed
- not supported
content: |-
This value specifies whether the Secure Enclave Processor (SEP) supports and allows secure operations to use the Bootstrap Token. The value is automatically set for devices enrolled through the Device Enrollment Program (DEP). The user can also manually set this value in the RecoveryOS.
This value specifies whether the Secure Enclave Processor (SEP) supports and allows secure operations to use the Bootstrap Token. The device automatically sets this value if enrolled through Automated Device Enrollment (ADE). The user can also manually set this value in the RecoveryOS.
This value is available for a Mac with Apple silicon in macOS 11 and later. Not available for user enrollment.
- key: BootstrapTokenRequiredForSoftwareUpdate
@@ -589,3 +571,8 @@ notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/information.security/example1.plist
response-file: examples/mdm/commands/information.security/example2.plist
mdm/commands/lom.devicerequest.yaml
+5
View File
@@ -103,3 +103,8 @@ notes:
This command requires the `DeviceLockAndRemovePasscode` access right, `LightsOutManagementLOM` configuration and is available in macOS 11 and later on [supported macOS devices](https://support.apple.com/guide/deployment/lights-out-management-payload-settings-dep580cf25bc/web).
`DeviceDNSName` is the `CommonName` in the Identity issued on the client certificate from `LightsOutManagementLOM`. `LOMSetupRequestResponse` returns `PrimaryIPv6AddressList` and `SecondaryIPv6AddressList` after a successful deployment of Lights Out management configuration payload and subsequent `LOMSetupRequestCommand`.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/lom.devicerequest/example1.plist
response-file: examples/mdm/commands/lom.devicerequest/example2.plist
mdm/commands/lom.setuprequest.yaml
+5
View File
@@ -50,3 +50,8 @@ notes:
- title: ''
content: This command requires the `DeviceLockAndRemovePasscode` access right, `LightsOutManagementLOM`
configuration and is available in macOS 11 and later on [supported macOS devices](https://support.apple.com/guide/deployment/lights-out-management-payload-settings-dep580cf25bc/web).
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/lom.setuprequest/example1.plist
response-file: examples/mdm/commands/lom.setuprequest/example2.plist
mdm/commands/managed.application.attributes.yaml
+20 -24
View File
@@ -39,7 +39,7 @@ payloadkeys:
The bundle identifiers of the managed apps.
> Important:
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone to which the watch is paired. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting App and Book Information`.
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone the watch pairs with. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting app and book information (Legacy)`.
subkeys:
- key: IdentifiersItem
type: <string>
@@ -60,7 +60,7 @@ responsekeys:
The app's bundle identifier.
> Note:
> For a watchOS app, the identifier is the watch's bundle identifier, which differs from the main bundle identifier for the iPhone to which the watch is paired.
> For a watchOS app, the identifier is the watch's bundle identifier, which differs from the main bundle identifier for the iPhone the watch pairs with.
- key: Attributes
type: <dictionary>
presence: optional
@@ -83,10 +83,7 @@ responsekeys:
introduced: n/a
type: <string>
presence: optional
content: |-
The content Filter UUID assigned to this app.
Available in iOS 16 and later.
content: The content Filter UUID assigned to this app.
- key: DNSProxyUUID
supportedOS:
iOS:
@@ -97,10 +94,7 @@ responsekeys:
introduced: n/a
type: <string>
presence: optional
content: |-
The DNS Proxy UUID assigned to this app.
Available in iOS 16 and later.
content: The DNS Proxy UUID assigned to this app.
- key: RelayUUID
supportedOS:
iOS:
@@ -120,8 +114,7 @@ responsekeys:
introduced: n/a
type: <array>
presence: optional
content: This app's associated domains. This value is available in iOS 13
and later.
content: This app's associated domains.
subkeys:
- key: AssociatedDomain
type: <string>
@@ -136,8 +129,7 @@ responsekeys:
default: false
content: If `true`, perform claimed site association verification directly
at the domain instead of on Apple's servers. Only set this to `true` for
domains that can't access the internet. This value is available in iOS 14
and later.
domains that can't access the internet.
- key: Removable
supportedOS:
iOS:
@@ -147,8 +139,7 @@ responsekeys:
type: <boolean>
presence: optional
default: true
content: If `false`, this app isn't removable while it's a managed app. This
value is available in iOS 14 and later.
content: If `false`, this app isn't removable while it's a managed app.
- key: TapToPayScreenLock
supportedOS:
iOS:
@@ -162,10 +153,10 @@ responsekeys:
type: <boolean>
presence: optional
default: false
content: |-
If `true`, Tap to Pay on iPhone requires users to use Face ID or a passcode to unlock their device after every transaction that requires a customer's card PIN. If `false`, the user can configure this setting on their device.
Available in iOS 16.4 and later.
content: If `true`, Tap to Pay on iPhone requires users to use Face ID or
a passcode to unlock their device after every transaction that requires
a customer's card PIN. If `false`, the user can configure this setting on
their device.
- key: CellularSliceUUID
supportedOS:
iOS:
@@ -178,10 +169,10 @@ responsekeys:
introduced: n/a
type: <string>
presence: optional
content: |-
The data network name (DNN) or app category. For DNN, the value is `DNN:name`, where `name` is the carrier-provided DNN name. For app category, the value is `AppCategory:category`, where `category` is a carrier-provided string like "Enterprise1".
Available in iOS 17 and later.
content: The data network name (DNN) or app category. For DNN, the value is
`DNN:name`, where `name` is the carrier-provided DNN name. For app category,
the value is `AppCategory:category`, where `category` is a carrier-provided
string like "Enterprise1".
- key: Hideable
supportedOS:
iOS:
@@ -221,3 +212,8 @@ notes:
The response doesn't include apps that Declarative Device Management is managing.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/managed.application.attributes/example1.plist
response-file: examples/mdm/commands/managed.application.attributes/example2.plist
mdm/commands/managed.application.configuration.yaml
+7 -2
View File
@@ -46,7 +46,7 @@ payloadkeys:
The bundle identifiers of the managed apps.
> Important:
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone to which the watch is paired. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting App and Book Information`.
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone the watch pairs with. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting app and book information (Legacy)`.
subkeys:
- key: IdentifiersItem
type: <string>
@@ -67,7 +67,7 @@ responsekeys:
The app's bundle identifier.
> Note:
> For a watchOS app, the identifier is the watch's bundle identifier, which differs from the main bundle identifier for the iPhone to which the watch is paired.
> For a watchOS app, the identifier is the watch's bundle identifier, which differs from the main bundle identifier for the iPhone the watch pairs with.
- key: Configuration
type: <dictionary>
presence: optional
@@ -85,3 +85,8 @@ notes:
The response doesn't include apps that Declarative Device Management is managing.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/managed.application.configuration/example1.plist
response-file: examples/mdm/commands/managed.application.configuration/example2.plist
mdm/commands/managed.application.feedback.yaml
+5
View File
@@ -79,3 +79,8 @@ notes:
The response doesn't include apps that Declarative Device Management is managing.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/managed.application.feedback/example1.plist
response-file: examples/mdm/commands/managed.application.feedback/example2.plist
mdm/commands/media.install.yaml
+18 -10
View File
@@ -44,7 +44,7 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: The URL to retrieve the book. This value is available in iOS 8 and later.
content: The URL to retrieve the book.
- key: MediaType
type: <string>
presence: required
@@ -58,7 +58,6 @@ payloadkeys:
type: <string>
presence: optional
content: The book's persistent identifier in reverse-DNS form; for example, `com.acme.manuals.training`.
This value is available in iOS 8 and later.
- key: Kind
supportedOS:
macOS:
@@ -76,28 +75,28 @@ payloadkeys:
- `epub`: An EPUB file in `gzip` format.
- `ibooks`: An iBooks Author file in `gzip` format.
If you omit this value, its value is the file extension in the URL. This value is available in iOS 8 and later.
If you omit this value, its value is the file extension in the URL.
- key: Version
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: optional
content: The book's version number. This value is available in iOS 8 and later.
content: The book's version number.
- key: Author
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: optional
content: The name of the book's author. This value is available in iOS 8 and later.
content: The name of the book's author.
- key: Title
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: optional
content: The book's title. This value is available in iOS 8 and later.
content: The book's title.
responsekeys:
- key: iTunesStoreID
type: <integer>
@@ -109,16 +108,14 @@ responsekeys:
introduced: n/a
type: <string>
presence: optional
content: The URL to retrieve the book, if present in the command. This value is
available in iOS 8 and later.
content: The URL to retrieve the book, if present in the command.
- key: PersistentID
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: optional
content: The book's persistent identifier, if present in the command. This value
is available in iOS 8 and later.
content: The book's persistent identifier, if present in the command.
- key: MediaType
type: <string>
presence: optional
@@ -175,3 +172,14 @@ notes:
If you install a book that isn't from the Book Store with the same `PersistentID` as an existing book that also isn't from the Book Store, the new book replaces the existing one.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- tab: Enterprise
description: This command installs an enterprise book.
request-file: examples/mdm/commands/media.install/example1.plist
response-file: examples/mdm/commands/media.install/example2.plist
- tab: Book Store
description: This command installs a book from the Book Store.
request-file: examples/mdm/commands/media.install/example3.plist
response-file: examples/mdm/commands/media.install/example4.plist
mdm/commands/media.managed.list.yaml
+5 -2
View File
@@ -70,8 +70,6 @@ responsekeys:
- `epub`: An EPUB file in `gzip` format
- `ibooks`: An iBooks Author file in `gzip` format
- The file extension in the URL
This value is available in iOS 8 and later.
- key: Version
type: <string>
presence: optional
@@ -88,3 +86,8 @@ notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/media.managed.list/example1.plist
response-file: examples/mdm/commands/media.managed.list/example2.plist
mdm/commands/media.remove.yaml
+5
View File
@@ -43,3 +43,8 @@ notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/media.remove/example1.plist
response-file: examples/mdm/commands/media.remove/example2.plist
mdm/commands/mirroring.request.yaml
+5
View File
@@ -69,3 +69,8 @@ notes:
Provide either the `DestinationName` or the `DestinationDeviceID`. If you provide both values, MDM uses `DestinationDeviceID`.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/classroom.mirroring.request/example1.plist
response-file: examples/mdm/commands/classroom.mirroring.request/example2.plist
mdm/commands/mirroring.stop.yaml
+5
View File
@@ -34,3 +34,8 @@ notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/classroom.mirroring.stop/example1.plist
response-file: examples/mdm/commands/classroom.mirroring.stop/example2.plist
mdm/commands/passcode.clear.yaml
+5
View File
@@ -41,3 +41,8 @@ notes:
Clearing the passcode in iOS 16 no longer adds the passcode to the history of passcodes. Therefore, the user can reuse the cleared passcode even when the `Passcode` payload has the `pinHistory` key set.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/passcode.clear/example1.plist
response-file: examples/mdm/commands/passcode.clear/example2.plist
mdm/commands/passcode.firmware.set.yaml
+5
View File
@@ -62,3 +62,8 @@ notes:
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
This command isn't supported on a Mac with Apple silicon.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/passcode.firmware.set/example1.plist
response-file: examples/mdm/commands/passcode.firmware.set/example2.plist
mdm/commands/passcode.firmware.verify.yaml
+5
View File
@@ -46,3 +46,8 @@ notes:
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
This command isn't supported on a Mac with Apple silicon.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/passcode.firmware.verify/example1.plist
response-file: examples/mdm/commands/passcode.firmware.verify/example2.plist
mdm/commands/passcode.recovery.set.yaml
+6 -1
View File
@@ -20,7 +20,7 @@ payload:
introduced: n/a
watchOS:
introduced: n/a
content: Sets or clears the recovery lock password (Apple Silicon devices only).
content: Sets or clears the recovery lock password (Apple silicon devices only).
Requires the "Device lock and passcode removal right".
payloadkeys:
- key: CurrentPassword
@@ -39,3 +39,8 @@ notes:
This command sets, or clears, a password on booting to recoveryOS. When the device unenrolls MDM the system removes the recovery password.
This command is only available on a Mac with Apple silicon.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/passcode.recovery.set/example1.plist
response-file: examples/mdm/commands/passcode.recovery.set/example2.plist
mdm/commands/passcode.recovery.verify.yaml
+5
View File
@@ -34,3 +34,8 @@ responsekeys:
notes:
- title: ''
content: This command is only available on a Mac with Apple silicon.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/passcode.recovery.verify/example1.plist
response-file: examples/mdm/commands/passcode.recovery.verify/example2.plist
mdm/commands/profile.install.yaml
+5
View File
@@ -52,3 +52,8 @@ notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/profile.install/example1.plist
response-file: examples/mdm/commands/profile.install/example2.plist
mdm/commands/profile.list.yaml
+7 -5
View File
@@ -55,8 +55,6 @@ payloadkeys:
default: false
content: If `true`, only include profiles that MDM has installed. For user enrollments,
the device ignores this key and always limits the results to managed profiles.
This value is available in iOS 13 and later, macOS 10.5 and later, and tvOS 13
and later.
responsekeys:
- key: ProfileList
type: <array>
@@ -125,9 +123,8 @@ responsekeys:
type: <boolean>
presence: optional
default: false
content: If `true`, the current MDM service installed the profile. MDM doesn't
return this value for supervised devices, and can remove or replace all profiles
on supervised devices.
content: If `true`, the current MDM service installed the profile. MDM can remove
or replace all profiles on supervised devices.
- key: Source
supportedOS:
iOS:
@@ -195,3 +192,8 @@ notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/profile.list/example1.plist
response-file: examples/mdm/commands/profile.list/example2.plist
mdm/commands/profile.provisioning.install.yaml
+5
View File
@@ -53,3 +53,8 @@ notes:
No error occurs if the provisioning profile is already present.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/profile.provisioning.install/example1.plist
response-file: examples/mdm/commands/profile.provisioning.install/example2.plist
mdm/commands/profile.provisioning.list.yaml
+5 -1
View File
@@ -54,7 +54,6 @@ payloadkeys:
default: false
content: If `true`, only include profiles that MDM has installed. For user enrollments,
the device ignores this key and always limits the results to managed profiles.
This value is available in iOS 13 and later, and tvOS 13 and later.
responsekeys:
- key: ProvisioningProfileList
type: <array>
@@ -81,3 +80,8 @@ notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/profile.provisioning.list/example1.plist
response-file: examples/mdm/commands/profile.provisioning.list/example2.plist
mdm/commands/profile.provisioning.remove.yaml
+5
View File
@@ -53,3 +53,8 @@ notes:
> Note:
> Don't remove a provisioning profile to revoke access to an enterprise app. An app continues to be usable until the device restarts, even with no provisioning profile. Provisioning profiles also synchronize with iTunes and the system reinstalls them when users sync devices. For more information on removing apps, see `Remove-Application-Command`.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/profile.provisioning.remove/example1.plist
response-file: examples/mdm/commands/profile.provisioning.remove/example2.plist
mdm/commands/profile.remove.yaml
+5
View File
@@ -49,3 +49,8 @@ notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/profile.remove/example1.plist
response-file: examples/mdm/commands/profile.remove/example2.plist
mdm/commands/remotedesktop.disable.yaml
+5
View File
@@ -26,3 +26,8 @@ notes:
This command disables Remote Desktop on the device, and prevents any further remote event processing. It removes any `PostEvent` Transparency Consent and Control (TCC) ability, unless the device already has an installed TCC configuration profile with that ability enabled.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/remotedesktop.disable/example1.plist
response-file: examples/mdm/commands/remotedesktop.disable/example2.plist
mdm/commands/remotedesktop.enable.yaml
+5
View File
@@ -32,3 +32,8 @@ notes:
All other options remain unchanged.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/remotedesktop.enable/example1.plist
response-file: examples/mdm/commands/remotedesktop.enable/example2.plist
mdm/commands/rotate.file.vault.key.yaml
+12 -1
View File
@@ -84,7 +84,7 @@ responsekeys:
- key: EncryptedNewRecoveryKey
type: <data>
presence: optional
content: A new personal recovery key that is encrypted using a `ReplyEncryptionCertificate`
content: A new personal recovery key that's encrypted using a `ReplyEncryptionCertificate`
as a CMS-compliant envelope.
notes:
- title: ''
@@ -92,3 +92,14 @@ notes:
Change the FileVault password periodically to mitigate the security risk of deployed devices.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- tab: Personal
description: This command changes the File Vault personal password.
request-file: examples/mdm/commands/rotate.file.vault.key/example1.plist
response-file: examples/mdm/commands/rotate.file.vault.key/example2.plist
- tab: Institutional
description: This command changes the File Vault institutional recovery key.
request-file: examples/mdm/commands/rotate.file.vault.key/example3.plist
response-file: examples/mdm/commands/rotate.file.vault.key/example4.plist
mdm/commands/set.auto.admin.password.yaml
+8 -3
View File
@@ -21,14 +21,14 @@ payload:
watchOS:
introduced: n/a
content: Allows changing the password of a local admin account that was created
by Setup Assistant during DEP enrollment via the AccountConfiguration command.
by Setup Assistant during ADE enrollment via the AccountConfiguration command.
payloadkeys:
- key: GUID
type: <string>
presence: required
content: The unique identifier of the local administrator account. If this value
doesn't match the GUID of an administrator account that MDM created during Device
Enrollment Program (DEP) enrollment, the command returns an error.
doesn't match the GUID of an administrator account that MDM created during Automated
Device Enrollment (ADE) enrollment, the command returns an error.
- key: passwordHash
type: <data>
presence: required
@@ -46,3 +46,8 @@ notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/set.auto.admin.password/example1.plist
response-file: examples/mdm/commands/set.auto.admin.password/example2.plist
mdm/commands/settings.yaml
+68 -87
View File
@@ -69,9 +69,9 @@ payloadkeys:
type: <dictionary>
presence: optional
content: A dictionary that contains wallpaper settings. This setting doesn't support
user enrollment. Available in iOS 8 and later. Starting in iOS 16 and iPadOS
17, when setting the wallpaper for the first time, both locations update. After
that, you can set either location separately.
user enrollment. Starting in iOS 16 and iPadOS 17, when setting the wallpaper
for the first time, both locations update. After that, you can set either location
separately.
subkeys:
- key: Item
type: <string>
@@ -118,8 +118,7 @@ payloadkeys:
type: <dictionary>
presence: optional
content: A dictionary that contains data roaming settings. This setting requires
the Network Information access right, and doesn't support user enrollment. Available
in iOS 5 and later.
the Network Information access right, and doesn't support user enrollment.
subkeys:
- key: Item
type: <string>
@@ -131,7 +130,8 @@ payloadkeys:
type: <boolean>
presence: required
content: If `true`, enable data roaming, which also enables voice roaming. If
`false`, disable data roaming.
`false`, disable data roaming. The device only applies this setting to the
primary SIM.
- key: VoiceRoaming
supportedOS:
iOS:
@@ -153,8 +153,7 @@ payloadkeys:
type: <dictionary>
presence: optional
content: A dictionary that contains voice roaming settings. This setting requires
the Network Information access right, and doesn't support user enrollment. Available
in iOS 5 and later.
the Network Information access right, and doesn't support user enrollment.
subkeys:
- key: Item
type: <string>
@@ -189,8 +188,7 @@ payloadkeys:
type: <dictionary>
presence: optional
content: A dictionary that contains Personal Hotspot settings. This setting requires
the Network Information access right, and doesn't support user enrollment. Available
in iOS 5 and later.
the Network Information access right, and doesn't support user enrollment.
subkeys:
- key: Item
type: <string>
@@ -228,8 +226,7 @@ payloadkeys:
presence: optional
content: A dictionary that contains Bluetooth settings. This setting requires
the Network Information access right, doesn't support user enrollment, and is
available only on supervised devices. Available in iOS 11.3 and later, and macOS
10.13.4 and later.
available only on supervised devices.
subkeys:
- key: Item
type: <string>
@@ -266,9 +263,8 @@ payloadkeys:
presence: optional
content: A dictionary that contains the configurations to apply to the app. Omit
this setting to remove existing configurations. This setting requires the App
Management access right, supports user enrollment, and is available in iOS 7
and later, macOS 10.15 and later, and tvOS 10.2 and later. This setting fails
for apps that Declarative Device Management manages.
Management access right, supports user enrollment. This setting fails for apps
that Declarative Device Management manages.
subkeys:
- key: Item
type: <string>
@@ -283,7 +279,7 @@ payloadkeys:
The bundle identifier of the managed app.
> Important:
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone to which the watch is paired. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting App and Book Information`.
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone the watch pairs with. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting app and book information (Legacy)`.
- key: Configuration
type: <dictionary>
presence: optional
@@ -315,9 +311,8 @@ payloadkeys:
type: <dictionary>
presence: optional
content: A dictionary that contains the attributes to apply to the app. Omit this
setting to remove existing attributes. This setting supports user enrollment,
is available in iOS 7 and later, and tvOS 10.2 and later. This setting fails
for apps that Declarative Device Management manages.
setting to remove existing attributes. This setting supports user enrollment.
This setting fails for apps that Declarative Device Management manages.
subkeys:
- key: Item
type: <string>
@@ -332,13 +327,12 @@ payloadkeys:
The bundle identifier of the app.
> Important:
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone to which the watch is paired. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting App and Book Information`.
> For a watchOS app, the identifier needs to be the watch's bundle identifier, which differs from the main bundle identifier for the iPhone the watch pairs with. Obtain the watch's bundle identifier for an app with a watch bundle, in the `watchBundleId` key that's part of the Content Metadata query. For more information on this query, see `Getting app and book information (Legacy)`.
- key: Attributes
type: <dictionary>
presence: optional
content: A dictionary that contains the attributes to apply to the app. Omit
this setting to remove existing attributes. This setting is available in iOS
7 and later, and tvOS 10.2 and later.
this setting to remove existing attributes.
subkeys:
- key: VPNUUID
supportedOS:
@@ -346,8 +340,7 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: A per-app VPN unique identifier for this app. Available in iOS 7
and later.
content: A per-app VPN unique identifier for this app.
- key: ContentFilterUUID
supportedOS:
iOS:
@@ -358,7 +351,7 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: The content filter UUID for this app. Available in iOS 16 and later.
content: The content filter UUID for this app.
- key: DNSProxyUUID
supportedOS:
iOS:
@@ -369,7 +362,7 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: The DNS proxy UUID for this app. Available in iOS 16 and later.
content: The DNS proxy UUID for this app.
- key: RelayUUID
supportedOS:
iOS:
@@ -380,7 +373,7 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: The relay UUID for this app. Available in iOS 17 and later.
content: The relay UUID for this app.
- key: AssociatedDomains
supportedOS:
iOS:
@@ -390,7 +383,6 @@ payloadkeys:
type: <array>
presence: optional
content: An array that contains the associated domains to add to this app.
Available in iOS 13 and later.
subkeys:
- key: AssociatedDomain
type: <string>
@@ -405,7 +397,7 @@ payloadkeys:
default: false
content: If `true`, perform claimed site association verification directly
at the domain, instead of on Apple's servers. Only set this to `true` for
domains that can't access the internet. Available in iOS 14 and later.
domains that can't access the internet.
- key: Removable
supportedOS:
iOS:
@@ -415,8 +407,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: If `false`, this app isn't removable while it's managed. Available
in iOS 14 and later, and tvOS 14 and later.
content: If `false`, this app isn't removable while it's managed.
- key: TapToPayScreenLock
supportedOS:
iOS:
@@ -430,10 +421,10 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: |-
If true, the system require Tap to Pay on iPhone users to use Face ID or a passcode to unlock their device after every transaction that requires a customer's card PIN. If `false`, the user can configure this setting on their device.
Available in iOS 16.4 and later.
content: If true, the system require Tap to Pay on iPhone users to use Face
ID or a passcode to unlock their device after every transaction that requires
a customer's card PIN. If `false`, the user can configure this setting on
their device.
- key: CellularSliceUUID
supportedOS:
iOS:
@@ -446,10 +437,10 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: |-
The data network name (DNN) or app category. For DNN, the value is `DNN:name`, where `name` is the carrier-provided DNN name. For app category, the value is `AppCategory:category`, where `category` is a carrier-provided string like "Enterprise1"`.`
Available in iOS 17 and later.
content: The data network name (DNN) or app category. For DNN, the value is
`DNN:name`, where `name` is the carrier-provided DNN name. For app category,
the value is `AppCategory:category`, where `category` is a carrier-provided
string like "Enterprise1"`.`
- key: Hideable
supportedOS:
iOS:
@@ -506,8 +497,7 @@ payloadkeys:
type: <dictionary>
presence: optional
content: A dictionary that contains device name settings. This setting doesn't
support user enrollment, and is available only on supervised devices. Available
in iOS 5 and later, macOS 10.10 and later, and visionOS 2 and later.
support user enrollment, and is available only on supervised devices.
subkeys:
- key: Item
type: <string>
@@ -537,7 +527,7 @@ payloadkeys:
type: <dictionary>
presence: optional
content: A dictionary that contains hostname settings. This setting doesn't support
user enrollment, and is available in macOS 10.11 and later.
user enrollment.
subkeys:
- key: Item
type: <string>
@@ -562,8 +552,7 @@ payloadkeys:
type: <dictionary>
presence: optional
content: A dictionary that contains settings about the organization operating
the MDM server. This setting supports user enrollment. Available in iOS 5 and
later.
the MDM server. This setting supports user enrollment.
subkeys:
- key: Item
type: <string>
@@ -619,7 +608,9 @@ payloadkeys:
iOS:
introduced: '18.2'
sharedipad:
mode: forbidden
mode: allowed
devicechannel: false
userchannel: true
userenrollment:
mode: forbidden
macOS:
@@ -646,10 +637,6 @@ payloadkeys:
supportedOS:
iOS:
introduced: '26.0'
sharedipad:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
@@ -666,10 +653,6 @@ payloadkeys:
supportedOS:
iOS:
introduced: '26.0'
sharedipad:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
@@ -704,8 +687,7 @@ payloadkeys:
type: <dictionary>
presence: optional
content: A dictionary that contains settings related to the MDM protocol. This
setting doesn't support user enrollment. Available in iOS 7 and later, macOS
10.15 and later, and visionOS 2 and later.
setting doesn't support user enrollment.
subkeys:
- key: Item
type: <string>
@@ -783,8 +765,10 @@ payloadkeys:
presence: optional
default: false
content: If `true`, the device automatically reboots while locked after several
days of inactivity. This is set to `false` by default when a supervised
device enrolls.
days of inactivity. The device sets this to `false` by default for a supervised
enrollment. Starting in iOS 26.6 and iPadOS 26.6, changing the effective
value from reboot allowed to reboot disallowed requires a reboot or a device
unlock before the change takes effect.
- key: MaximumResidentUsers
supportedOS:
iOS:
@@ -876,10 +860,9 @@ payloadkeys:
introduced: '14.5'
type: <integer>
presence: optional
content: |-
The timeout, in seconds, for the user session. The user session logs out automatically after the specified period of inactivity. The minimum value is 30 seconds. Setting this value to `0` removes the timeout.
Available in iOS 14.5 and later.
content: The timeout, in seconds, for the user session. The user session logs
out automatically after the specified period of inactivity. The minimum value
is 30 seconds. Setting this value to `0` removes the timeout.
- key: TemporarySessionTimeout
supportedOS:
iOS:
@@ -889,10 +872,9 @@ payloadkeys:
supervised: true
type: <integer>
presence: optional
content: |-
The timeout, in seconds, for the temporary session. The temporary session logs out automatically after the specified period of inactivity. The minimum value is 30 seconds. Setting this value to `0` removes the timeout.
Available in iOS 14.5 and later.
content: The timeout, in seconds, for the temporary session. The temporary session
logs out automatically after the specified period of inactivity. The minimum
value is 30 seconds. Setting this value to `0` removes the timeout.
- key: TemporarySessionOnly
supportedOS:
iOS:
@@ -904,8 +886,6 @@ payloadkeys:
If `true`, the user only sees the Guest Welcome pane and can only log in as a guest user.
If `false`, the user can sign in with a Managed Apple Account (the existing behavior).
Available in iOS 14.5 and later.
- key: ManagedAppleIDDefaultDomains
supportedOS:
iOS:
@@ -915,7 +895,7 @@ payloadkeys:
content: |-
A list of domains that the Shared iPad login screen displays. The user can pick a domain from the list to complete their Managed Apple Account.
If this list contains more than 3 domains, the system picks 3 at random for display. Available in iOS 16 and later.
If this list contains more than 3 domains, the system picks 3 at random for display.
subkeys:
- key: AppleID domain
type: <string>
@@ -929,8 +909,6 @@ payloadkeys:
A grace period (in days) for Shared iPad online authentication. The Shared iPad only verifies the user's passcode locally during login for users that already exist on the device. However, the system requires an online authentication (against Apple's identity server) after the number of days specified by this setting.
Setting this value to 0 enforces online authentication every time.
Available in iOS 16 and later.
- key: SkipLanguageAndLocaleSetupForNewUsers
supportedOS:
iOS:
@@ -938,20 +916,19 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: |-
If `true`, the system picks the system language and locale automatically for the new Shared iPad user.
Available in iOS 16.2 and later.
content: If `true`, the system picks the system language and locale automatically
for the new Shared iPad user.
- key: AwaitUserConfiguration
supportedOS:
iOS:
introduced: '17.0'
type: <dictionary>
presence: optional
content: |-
If enabled, the Shared iPad device enters Setup Assistant after the user triggers a login. The MDM server has a chance to configure the device and user. After configuration, the server needs to send a `User-Configured-Command` command to the user channel to unblock the login. This feature requires the device to have network access during the login process.
Available in iOS 17 and later.
content: If enabled, the Shared iPad device enters Setup Assistant after the
user triggers a login. The MDM server has a chance to configure the device
and user. After configuration, the server needs to send a `User-Configured-Command`
command to the user channel to unblock the login. This feature requires the
device to have network access during the login process.
subkeys:
- key: Enabled
type: <boolean>
@@ -1133,8 +1110,7 @@ payloadkeys:
type: <dictionary>
presence: optional
content: A dictionary that contains time zone settings. This setting is available
only on supervised devices and doesn't support user enrollment. Available in
iOS 14 and later, tvOS 14 and later, and visionOS 2 and later.
only on supervised devices and doesn't support user enrollment.
subkeys:
- key: Item
type: <string>
@@ -1154,6 +1130,7 @@ payloadkeys:
iOS:
introduced: '14.5'
deprecated: '26.0'
removed: '27.0'
supervised: true
sharedipad:
mode: allowed
@@ -1171,8 +1148,10 @@ payloadkeys:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains software update settings. This setting doesn't
support user enrollment. Available in iOS 14.5 and later.
content: |-
A dictionary that contains software update settings. This setting doesn't support user enrollment.
Removed: use the declarative management `com.apple.configuration.softwareupdate.settings` configuration.
subkeys:
- key: Item
type: <string>
@@ -1196,8 +1175,6 @@ payloadkeys:
- `2`: Presents only the highest numbered (most recent) release available for the device.
This value has no effect when there's only one available update; the system shows the single available update to the user regardless of the value of this setting.
Available in iOS 14.5 and later.
- key: AccessibilitySettings
supportedOS:
iOS:
@@ -1218,8 +1195,7 @@ payloadkeys:
supervised: true
type: <dictionary>
presence: optional
content: A dictionary that contains accessibility settings. Available in iOS 16
and later.
content: A dictionary that contains accessibility settings.
subkeys:
- key: Item
type: <string>
@@ -1336,10 +1312,15 @@ responsekeys:
The app identifier to which this error applies.
> Note:
> For a watchOS app, the identifier is the watch's bundle identifier, which differs from the main bundle identifier for the iPhone to which the watch is paired.
> For a watchOS app, the identifier is the watch's bundle identifier, which differs from the main bundle identifier for the iPhone the watch pairs with.
notes:
- title: ''
content: |-
Users may be able to change the settings later if a profile isn't set to restrict such changes.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response (DeviceName)
files:
- request-file: examples/mdm/commands/settings/example1.plist
response-file: examples/mdm/commands/settings/example2.plist
mdm/commands/system.update.available.yaml
+21 -18
View File
@@ -1,11 +1,14 @@
title: Available OS Updates Command
description: Get a list of available operating-system updates for a device.
description: 'Get a list of available operating-system updates for a device. Removed:
use the declarative management `com.apple.configuration.softwareupdate.enforcement.specific`
configuration.'
payload:
requesttype: AvailableOSUpdates
supportedOS:
iOS:
introduced: '9.0'
deprecated: '26.0'
removed: '27.0'
accessrights: AllowAppInstallation
supervised: true
requiresdep: false
@@ -18,6 +21,7 @@ payload:
macOS:
introduced: '10.11'
deprecated: '26.0'
removed: '27.0'
accessrights: None
devicechannel: true
userchannel: false
@@ -28,6 +32,7 @@ payload:
tvOS:
introduced: '12.0'
deprecated: '26.0'
removed: '27.0'
accessrights: AllowAppInstallation
devicechannel: true
supervised: true
@@ -36,7 +41,7 @@ payload:
introduced: n/a
watchOS:
introduced: n/a
content: Queries the device for a list of available OS updates. On OS X, a ScheduleOSUpdateScan
content: Queries the device for a list of available OS updates. On macOS, a ScheduleOSUpdateScan
must be performed to update the results returned by this query.
responsekeys:
- key: AvailableOSUpdates
@@ -73,7 +78,7 @@ responsekeys:
type: <string>
presence: required
content: The locale, in IOS639-1 Alpha-2 code format, of the `HumanReadableName`
value. This value is available in macOS 10.11 and later.
value.
- key: MetadataURL
supportedOS:
iOS:
@@ -84,16 +89,14 @@ responsekeys:
presence: required
content: A URL where the MDM server can request additional localized names for
this update. This key isn't present for certain updates, such as mobile software
updates (MSUs) or major OS updates. This value is available in macOS 10.11
and later.
updates (MSUs) or major OS updates.
- key: ProductName
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: required
content: The product name; for example, _iOS_. This value is available in iOS
9.0 and later, and tvOS 12.0 and later.
content: The product name; for example, _iOS_.
- key: Version
type: <string>
presence: required
@@ -117,8 +120,7 @@ responsekeys:
introduced: n/a
type: <integer>
presence: required
content: The storage size necessary to install the update. This value is available
in iOS 9.0 and later, and tvOS 12.0 and later.
content: The storage size necessary to install the update.
- key: AppIdentifiersToClose
supportedOS:
iOS:
@@ -128,7 +130,7 @@ responsekeys:
type: <array>
presence: required
content: An array that contains app identifiers of apps to close so you can
install the update. This value is available in macOS 10.11 and later.
install the update.
subkeys:
- key: AppIdentifiersToCloseItem
type: <string>
@@ -146,8 +148,7 @@ responsekeys:
type: <boolean>
presence: optional
default: false
content: If `true`, this is an update to a configuration file. This value is
available in macOS 10.11 and later.
content: If `true`, this is an update to a configuration file.
- key: IsFirmwareUpdate
supportedOS:
iOS:
@@ -157,8 +158,7 @@ responsekeys:
type: <boolean>
presence: optional
default: false
content: If `true`, this is an update to firmware. This value is available in
macOS 10.11 and later.
content: If `true`, this is an update to firmware.
- key: IsMajorOSUpdate
supportedOS:
iOS:
@@ -170,8 +170,7 @@ responsekeys:
type: <boolean>
presence: optional
default: false
content: If `true`, this is a major update; for example, 10.15.x to 11. This
value is available in macOS 10.11 and later.
content: If `true`, this is a major update; for example, 10.15.x to 11.
- key: RestartRequired
type: <boolean>
presence: optional
@@ -192,8 +191,7 @@ responsekeys:
introduced: n/a
type: <date>
presence: optional
content: If present, the date when you want the update to install. This value
is available in macOS 10.12.4 and later.
content: If present, the date when you want the update to install.
- key: RequiresBootstrapToken
supportedOS:
iOS:
@@ -251,3 +249,8 @@ notes:
A device must have a total of `DownloadSize` + `InstallSize` bytes available to successfully install a software update. In macOS, execute the `ScheduleOSUpdateScan` command to update the results that this command returns. In iOS and tvOS, the list only contains the latest available updates.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/system.update.available/example1.plist
response-file: examples/mdm/commands/system.update.available/example2.plist
mdm/commands/system.update.scan.yaml
+9 -1
View File
@@ -1,5 +1,7 @@
title: Schedule OS Update Scan Command
description: Schedule a background scan for operating-system updates on a device.
description: 'Schedule a background scan for operating-system updates on a device.
Removed: use the declarative management `com.apple.configuration.softwareupdate.enforcement.specific`
configuration.'
payload:
requesttype: ScheduleOSUpdateScan
supportedOS:
@@ -8,6 +10,7 @@ payload:
macOS:
introduced: '10.11'
deprecated: '26.0'
removed: '27.0'
accessrights: None
devicechannel: true
userchannel: false
@@ -38,3 +41,8 @@ notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/system.update.scan/example1.plist
response-file: examples/mdm/commands/system.update.scan/example2.plist
mdm/commands/system.update.schedule.yaml
+20 -10
View File
@@ -1,11 +1,14 @@
title: Schedule OS Update Command
description: Schedule an update of the operating system on a device.
description: 'Schedule an update of the operating system on a device. Removed: use
the declarative management `com.apple.configuration.softwareupdate.enforcement.specific`
configuration.'
payload:
requesttype: ScheduleOSUpdate
supportedOS:
iOS:
introduced: '9.0'
deprecated: '26.0'
removed: '27.0'
accessrights: AllowAppInstallation
supervised: true
requiresdep: false
@@ -18,6 +21,7 @@ payload:
macOS:
introduced: '10.11'
deprecated: '26.0'
removed: '27.0'
accessrights: None
devicechannel: true
userchannel: false
@@ -28,6 +32,7 @@ payload:
tvOS:
introduced: '12.0'
deprecated: '26.0'
removed: '27.0'
accessrights: AllowAppInstallation
devicechannel: true
supervised: true
@@ -43,7 +48,7 @@ payloadkeys:
presence: required
content: |-
An array of dictionaries specifying the updates to download or install. If this value is missing, the device applies the default behavior for handling updates.
The device ignores this command and an informational error is returned, if a software update is managed by a Declarative Device Management `SoftwareUpdateEnforcementSpecific` configuration, as the configuration takes precedence.
The device ignores this command and returns an informational error if a Declarative Device Management `SoftwareUpdateEnforcementSpecific` configuration manages the software update, as the configuration takes precedence.
subkeys:
- key: UpdatesItem
type: <dictionary>
@@ -65,7 +70,7 @@ payloadkeys:
type: <string>
presence: optional
content: |-
The version of the update, which the system requires if `ProductKey` isn't present. This value is available in iOS 11.3 and later, macOS 12 and later, and tvOS 12.2 and later.
The version of the update, which the system requires if `ProductKey` isn't present.
> Note:
> This value isn't available for use with Background Security Improvement updates.
@@ -82,12 +87,12 @@ payloadkeys:
content: |-
The install action, which is one of the following values:
- `Default`: Download or install the update, depending on the current state. You can check the `UpdateResults` dictionary to review scheduled updates. This value is available in iOS 9 and later, macOS 10.11 and later, and tvOS 12 and later.
- `DownloadOnly`: Download the software update without installing it. This value is available in iOS 9 and later, macOS 11 and later, and tvOS 12 and later.
- `InstallASAP`: In iOS and tvOS, install a previously downloaded software update. In macOS, download the software update and trigger the restart countdown notification. This value is available in iOS 9 and later, macOS 10.11 and later, and tvOS 12 and later.
- `NotifyOnly`: Download the software update and notify the user through the App Store. This value is available in macOS 10.11 and later.
- `InstallLater`: Download the software update and install it at a later time. This value is available in macOS 10.11 and later.
- `InstallForceRestart`: Perform the `Default` action, and then force a restart if the update requires it. This value is available in macOS 11 and later.
* `Default`: Download or install the update, depending on the current state. You can check the `UpdateResults` dictionary to review scheduled updates. This value is available in iOS 9 and later, macOS 10.11 and later, and tvOS 12 and later.
* `DownloadOnly`: Download the software update without installing it. This value is available in iOS 9 and later, macOS 11 and later, and tvOS 12 and later.
* `InstallASAP`: In iOS and tvOS, install a previously downloaded software update. In macOS, download the software update and trigger the restart countdown notification. This value is available in iOS 9 and later, macOS 10.11 and later, and tvOS 12 and later.
* `NotifyOnly`: Download the software update and notify the user through the App Store. This value is available in macOS 10.11 and later.
* `InstallLater`: Download the software update and install it at a later time. This value is available in macOS 10.11 and later.
* `InstallForceRestart`: Perform the `Default` action, and then force a restart if the update requires it. This value is available in macOS 11 and later.
> Warning:
@@ -123,7 +128,7 @@ payloadkeys:
content: |-
The scheduling priority for downloading and preparing the requested update. This is only supported for minor OS updates (macOS 12.x to 12.y).
Available in macOS 12.3 and later. Prior versions of macOS used a priority of `Low`.
Prior versions of macOS used a priority of `Low`.
responsekeys:
- key: UpdateResults
type: <array>
@@ -218,3 +223,8 @@ notes:
A device may return a different `InstallAction` than requested.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/system.update.schedule/example1.plist
response-file: examples/mdm/commands/system.update.schedule/example2.plist
mdm/commands/system.update.status.yaml
+17 -19
View File
@@ -1,11 +1,13 @@
title: OS Update Status Command
description: Get the status of operating-system updates on a device.
description: 'Get the status of operating-system updates on a device. Removed: subscribe
to the declarative management `softwareupdate.install-state` status item.'
payload:
requesttype: OSUpdateStatus
supportedOS:
iOS:
introduced: '9.0'
deprecated: '26.0'
removed: '27.0'
accessrights: AllowAppInstallation
supervised: true
requiresdep: false
@@ -18,6 +20,7 @@ payload:
macOS:
introduced: 10.11.5
deprecated: '26.0'
removed: '27.0'
accessrights: None
devicechannel: true
userchannel: false
@@ -28,6 +31,7 @@ payload:
tvOS:
introduced: '12.0'
deprecated: '26.0'
removed: '27.0'
accessrights: AllowAppInstallation
devicechannel: true
supervised: true
@@ -43,7 +47,7 @@ responsekeys:
presence: required
content: |-
An array of dictionaries that describes the statuses of software updates. The array is empty if there are no software updates currently in progress.
This command only returns the status for System Applications and Configuration Data updates when a software update is managed by a Declarative Device Management `SoftwareUpdateEnforcementSpecific` configuration.
This command only returns the status for System Applications and Configuration Data updates when a Declarative Device Management `SoftwareUpdateEnforcementSpecific` configuration manages a software update.
subkeys:
- key: OSUpdateStatusItem
type: <dictionary>
@@ -82,10 +86,7 @@ responsekeys:
introduced: n/a
type: <integer>
presence: optional
content: |-
The number of times a user can defer this OS update.
Available in macOS 12.3 and later.
content: The number of times a user can defer this OS update.
- key: DeferralsRemaining
supportedOS:
iOS:
@@ -96,10 +97,7 @@ responsekeys:
introduced: n/a
type: <integer>
presence: optional
content: |-
The number of remaining user deferrals for this OS update.
Available in macOS 12.3 and later.
content: The number of remaining user deferrals for this OS update.
- key: NextScheduledInstall
supportedOS:
iOS:
@@ -110,10 +108,7 @@ responsekeys:
introduced: n/a
type: <date>
presence: optional
content: |-
The date of the next attempt at installing this OS update.
Available in macOS 12.3 and later.
content: The date of the next attempt at installing this OS update.
- key: PastNotifications
supportedOS:
iOS:
@@ -124,15 +119,18 @@ responsekeys:
introduced: n/a
type: <array>
presence: optional
content: |-
The dates/times when the OS notified the user about installing this OS update.
Available in macOS 12.3 and later.
content: The dates/times when the OS notified the user about installing this
OS update.
subkeys:
- key: PastNotificationDate
title: Past Notification Date
title: Past notification date
type: <date>
notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/system.update.status/example1.plist
response-file: examples/mdm/commands/system.update.status/example2.plist
mdm/commands/trigger.enhanced.log.collection.yaml
+68
View File
@@ -0,0 +1,68 @@
title: Trigger Enhanced Log Collection Command
description: Trigger enhanced log collection on the device.
payload:
requesttype: TriggerEnhancedLogCollection
supportedOS:
iOS:
introduced: '27.0'
supervised: true
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: '27.0'
devicechannel: false
userchannel: true
supervised: true
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: '27.0'
supervised: true
requiresdep: false
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows supervised devices to collect enhanced log and upload
it to a remote server.
payloadkeys:
- key: AppleCareToken
type: <string>
presence: required
content: The AppleCare token the device uses for authorizing the enhanced log collection
session.
notes:
- title: ''
content: |-
When the organization's IT support reports a problem to AppleCare, AppleCare may request that the device runs enhanced log collection. AppleCare provides a token to IT support, and they send the `TriggerEnhancedLogCollection` command to the device, with the token, to initiate the enhanced log collection procedure.
When the device processes the command it starts the enhanced log collection operation. There are two modes:
* `interactive`: the device shows the user a notification that allows the user to initiate the enhanced log collection. The device prompts the user to consent to both log collection and log upload at the appropriate times. The user can decline to proceed with enhanced log collection or upload. This mode is required for macOS devices. This mode isn't available on tvOS devices or Shared iPad.
* `non-interactive`: the device shows a notification that enhanced log collection is in progress. The device collects and uploads the logs in the background without any user intervention. This mode is always available for tvOS devices and Shared iPad. This mode is only available for iOS devices when all these conditions are met:
* There's no passcode on the device.
* There are no accounts on the device. For example, iCloud, App Store, mail, calendar, or contacts accounts.
AppleCare, in conjunction with IT support, determines the mode and the token encodes the mode.
You can cancel an active enhanced log collection session by sending the `Cancel-Enhanced-Log-Collection-Command` to the device.
- title: Declarative status
content: |-
The enhanced log collection process reports declarative status to the device management service using the following status items:
* `enhanced-logging.status`: Reports the device's enhanced log collection session state. See `StatusEnhancedLoggingStatus`.
* `enhanced-logging.applecare-token`: Reports the device's enhanced log collection session AppleCare token. See `StatusEnhancedLoggingAppleCareToken`.
* `enhanced-logging.timestamp`: Reports the device's enhanced log collection session timestamp. See `StatusEnhancedLoggingTimestamp`.
- title: Tokens for testing
content: |-
You can use a set of test tokens to verify correct operation of your device management service product. The set of tokens are:
* `test-token-normal`: This token activates an interactive enhanced log collection session that results in the device reporting the `finished` declarative state if all parts of the flow succeed. Any failure, cancellation, or decline, result in the device reporting the corresponding state.
* `test-token-normal-headless`: This token activates a non-interactive enhanced log collection session that results in the device reporting the `finished` declarative state if all parts of the flow succeed. Any failure, cancellation, or decline, result in the device reporting the corresponding state.
* `test-token-failed`: This token activates an interactive enhanced log collection session that results in the device reporting the `failed` declarative state if all parts of the flow succeed. Any failure, cancellation, or decline, result in the device reporting the corresponding state.
mdm/commands/user.configured.yaml
+2 -2
View File
@@ -24,8 +24,8 @@ payload:
watchOS:
introduced: n/a
content: Inform the device that it can continue past Setup Assistant and finish
login. Only works on Shared iPads that have the AwaitUserConfiguration feature
enabled.
login. Only works on Shared iPad devices that have the AwaitUserConfiguration
feature enabled.
notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements.
mdm/commands/user.delete.yaml
+9 -5
View File
@@ -35,8 +35,8 @@ payloadkeys:
- key: UserName
type: <string>
presence: optional
content: The user name of the account to delete. This key is required when the value
for `DeleteAllUsers` is absent or `false`.
content: The user name of the account to delete. The device requires this key when
the value for `DeleteAllUsers` is absent or `false`.
- key: ForceDeletion
supportedOS:
macOS:
@@ -45,7 +45,7 @@ payloadkeys:
presence: optional
default: false
content: If `true`, the system deletes the account even if the user has data that's
pending sync to the cloud. This value is available on iOS 9.3 and later.
pending sync to the cloud.
- key: DeleteAllUsers
supportedOS:
iOS:
@@ -57,8 +57,7 @@ payloadkeys:
default: false
content: If `true`, the system attempts to delete all users from the device. If
`ForceDeletion` is `false`, the system generates an error instead and doesn't
delete users who have data that's pending sync. This value is available in iOS
14 and later.
delete users who have data that's pending sync.
notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
@@ -71,3 +70,8 @@ notes:
- `12072`: The user is currently logged in.
- `12073`: The user has data to sync and ForceDeletion is false or unspecified.
- `12074`: Unable to delete the user. In macOS, this error code also returns for an attempt to delete the last administrator account.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/classroom.user.delete/example1.plist
response-file: examples/mdm/commands/classroom.user.delete/example2.plist
mdm/commands/user.list.yaml
+15 -18
View File
@@ -47,44 +47,39 @@ responsekeys:
type: <string>
presence: required
content: The user name for the account. In macOS, this is the short name of
the user account. This value is available in iOS 9.3 and later, and macOS
10.13 and later.
the user account.
- key: FullName
supportedOS:
iOS:
introduced: n/a
type: <string>
presence: required
content: The user's full name. This value is available in macOS 10.13 and later.
content: The user's full name.
- key: UID
supportedOS:
iOS:
introduced: n/a
type: <integer>
presence: required
content: The user's unique identifier. This value is available in macOS 10.13
and later.
content: The user's unique identifier.
- key: UserGUID
supportedOS:
iOS:
introduced: n/a
type: <string>
presence: required
content: The user's `GeneratedUID`. This value is available in macOS 10.13 and
later.
content: The user's `GeneratedUID`.
- key: IsLoggedIn
type: <boolean>
presence: required
content: If `true`, the user is currently logged in on the device. This value
is available in iOS 9.3 and later, and macOS 10.13 and later.
content: If `true`, the user is currently logged in on the device.
- key: HasDataToSync
supportedOS:
macOS:
introduced: n/a
type: <boolean>
presence: required
content: If `true`, the user has data to sync to the cloud. This value is available
in iOS 9.3 and later.
content: If `true`, the user has data to sync to the cloud.
- key: DataQuota
supportedOS:
macOS:
@@ -92,23 +87,21 @@ responsekeys:
type: <integer>
presence: required
content: If present, the user's data quota in bytes. This isn't present if the
account doesn't enforce a quota. This value is available in iOS 9.3 and later.
account doesn't enforce a quota.
- key: DataUsed
supportedOS:
macOS:
introduced: n/a
type: <integer>
presence: required
content: The amount of data, in bytes, that the user has used. This value is
available in iOS 9.3 and later.
content: The amount of data, in bytes, that the user has used.
- key: MobileAccount
supportedOS:
iOS:
introduced: n/a
type: <boolean>
presence: required
content: If `true`, the account is a mobile account. This value is available
in macOS 10.13 and later.
content: If `true`, the account is a mobile account.
- key: HasSecureToken
supportedOS:
iOS:
@@ -117,9 +110,13 @@ responsekeys:
introduced: '11.0'
type: <boolean>
presence: required
content: If `true`, the user currently has a secure token set. This value is
available in macOS 11 and later.
content: If `true`, the user currently has a secure token set.
notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/classroom.user.list/example1.plist
response-file: examples/mdm/commands/classroom.user.list/example2.plist
mdm/commands/user.logout.yaml
+5
View File
@@ -29,3 +29,8 @@ notes:
After logging out the user, MDM commands aren't available on the device for up to 2 minutes.
Refer to the following sections to determine supported channels and requirements, and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/classroom.user.logout/example1.plist
response-file: examples/mdm/commands/classroom.user.logout/example2.plist
mdm/commands/user.unlock.yaml
+5
View File
@@ -34,3 +34,8 @@ notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/classroom.user.unlock/example1.plist
response-file: examples/mdm/commands/classroom.user.unlock/example2.plist
mdm/errors/unrecognized.device.yaml
+2 -2
View File
@@ -18,8 +18,8 @@ payloadkeys:
presence: required
rangelist:
- com.apple.unrecognized.device
content: Indicates that the device is not recognized by the server. This causes
the device to unenroll from MDM.
content: Indicates that the device isn't recognized by the server. This causes the
device to unenroll from MDM.
- key: description
type: <string>
presence: optional
mdm/profiles/GlobalPreferences.yaml
+4
View File
@@ -35,3 +35,7 @@ payloadkeys:
content: The `autologout` delay, in seconds. A value of `0` means `autologout` is
off. In some cases, this delay may be restricted to values between 5 minutes and
24 hours.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/GlobalPreferences/example1.plist
mdm/profiles/TopLevel.yaml
+2 -3
View File
@@ -70,8 +70,7 @@ payloadkeys:
- key: PayloadContent
type: <array>
presence: required
content: The array of payload dictionaries. If `IsEncrypted` is `true`, this array
isn't needed.
content: The array of payload dictionaries. Not present for encrypted payloads.
subkeys:
- key: PayloadContentItem
type: <dictionary>
@@ -84,7 +83,7 @@ payloadkeys:
- key: EncryptedPayloadContent
type: <data>
presence: optional
content: Enabled if `IsEncrypted` is `true`.
content: The encrypted payload content. Only present for encrypted payloads.
- key: PayloadDescription
type: <string>
presence: optional
mdm/profiles/com.apple.ADCertificate.managed.yaml
+20 -22
View File
@@ -27,36 +27,36 @@ payload:
detailed at support.apple.com/kb/HT5357.
payloadkeys:
- key: CertServer
title: Certificate Server
title: Certificate server
type: <string>
presence: required
content: The fully qualified host name of the CA.
- key: CertTemplate
title: Certificate Template
title: Certificate template
type: <string>
presence: required
content: The certificate template for your environment. The default user certificate
value is \`User\`. The default computer certificate value is \`Machine\`.
value is `User`. The default computer certificate value is `Machine`.
- key: Description
title: Description
type: <string>
presence: optional
content: A user-friendly description of the certification identity.
- key: CertificateRenewalTimeInterval
title: Certificate Renewal Time Interval
title: Certificate renewal time interval
type: <integer>
presence: optional
content: The number of days in advance of certificate expiration that the notification
center notifies the user.
- key: CertificateAuthority
title: Certificate Authority
title: Certificate authority
supportedOS:
macOS:
introduced: '10.8'
type: <string>
presence: optional
content: |-
The name of the certificate authority (CA), which is determined from the common name (CN) of the Active Directory entry. Available in macOS 10.8 and later. Valid values:
The name of the certificate authority (CA), which the device determines from the common name (CN) of the Active Directory entry. Valid values:
- CN=<your CA Name>
- CN=`Certification Authorities`
@@ -65,26 +65,24 @@ payloadkeys:
- CN=`Configuration`
- CN=<your base Domain Name>
- key: CertificateAcquisitionMechanism
title: Certificate Acquisition Mechanism
title: Certificate acquisition mechanism
supportedOS:
macOS:
introduced: '10.8'
type: <string>
presence: optional
content: This value is most commonly `RPC`; if using web enrollment, use `HTTP`.
Available in macOS 10.8 and later.
- key: AllowAllAppsAccess
title: Allow All Apps Access
title: Allow all apps access
supportedOS:
macOS:
introduced: '10.10'
type: <boolean>
presence: optional
default: false
content: If `true`, gives apps access to the private key. Available in macOS 10.10
and later.
content: If `true`, gives apps access to the private key.
- key: PromptForCredentials
title: Prompt for Credentials
title: Prompt for credentials
supportedOS:
macOS:
introduced: '10.8'
@@ -93,30 +91,27 @@ payloadkeys:
default: false
content: If `true`, the system prompts the user for credentials when is installs
the profile. This key applies only to user certificates with the Manual Download
profile delivery method. Omit this key for computer certificates. Available in
macOS 10.8 and later.
profile delivery method. Omit this key for computer certificates.
- key: KeyIsExtractable
title: Key Is Extractable
title: Key is extractable
supportedOS:
macOS:
introduced: '10.10'
type: <boolean>
presence: optional
default: false
content: If `true`, the system allows exporting the private key. Available in macOS
10.10 and later.
content: If `true`, the system allows exporting the private key.
- key: Keysize
title: Key Size
title: Key size
supportedOS:
macOS:
introduced: '10.11'
type: <integer>
presence: optional
default: 2048
content: The RSA key size for the certificate signing request (CSR). Available in
macOS 10.11 and later.
content: The RSA key size for the certificate signing request (CSR).
- key: EnableAutoRenewal
title: Enable Auto Renewal
title: Enable auto renewal
supportedOS:
macOS:
introduced: 10.13.4
@@ -125,8 +120,11 @@ payloadkeys:
default: false
content: If `true`, the certificate obtained with this payload attempts auto-renewal.
Auto-renewal can only be used with device Active Directory certificate payloads.
Available in macOS 10.13.4 and later.
notes:
- title: ''
content: To get a certificate from a Microsoft CA, follow the instructions at [Request
a certificate from a Microsoft Certificate Authority](https://support.apple.com/en-us/HT204602).
examples:
- title: Example profile
files:
- file: examples/mdm/profiles/com.apple.ADCertificate.managed/example1.plist
mdm/profiles/com.apple.AIM.account.yaml
+6 -6
View File
@@ -27,24 +27,24 @@ payload:
content: An AIM payload creates an AIM account on the device.
payloadkeys:
- key: AIMAccountDescription
title: Account Description
title: Account description
type: <string>
presence: optional
content: The description of the account.
- key: AIMHostName
title: Account Hostname
title: Account hostname
type: <string>
presence: required
rangelist:
- slogin.oscar.aol.com
content: The server address.
- key: AIMUserName
title: Account Username
title: Account username
type: <string>
presence: optional
content: The user's login name.
- key: AIMPassword
title: Account Password
title: Account password
type: <string>
presence: optional
content: The user's password.
@@ -55,7 +55,7 @@ payloadkeys:
default: true
content: If `true`, enables SSL.
- key: AIMPort
title: Port Number
title: Port number
type: <integer>
presence: optional
range:
@@ -64,7 +64,7 @@ payloadkeys:
default: 5190
content: The connection port for the server.
- key: AIMAuthentication
title: AIM Authentication
title: AIM authentication
type: <string>
presence: required
rangelist:
mdm/profiles/com.apple.AssetCache.managed.yaml
+19 -16
View File
@@ -1,4 +1,4 @@
title: Content Caching
title: Content Caching Service
description: The payload that configures the Content Caching service.
payload:
payloadtype: com.apple.AssetCache.managed
@@ -7,6 +7,7 @@ payload:
introduced: n/a
macOS:
introduced: 10.13.4
deprecated: '27.0'
multiple: false
devicechannel: true
userchannel: false
@@ -32,8 +33,7 @@ payloadkeys:
default: true
content: If true, the system purges content from the cache automatically when it
needs disk space for other apps when free disk space runs low on the computer.
Set to `false` to maximize effectiveness of Content Caching. Available in macOS
10.15 and later.
Set to `false` to maximize effectiveness of Content Caching.
- key: AllowPersonalCaching
supportedOS:
macOS:
@@ -76,10 +76,9 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: |-
If `true`, the system automatically enables Internet connection sharing when possible and prevent disabling Internet connection sharing. `DenyTetheredCaching` overrides `AutoEnableTetheredCaching`. Tethered caching requires Content Caching.
Available in macOS 10.15.4 and later.
content: If `true`, the system automatically enables Internet connection sharing
when possible and prevent disabling Internet connection sharing. `DenyTetheredCaching`
overrides `AutoEnableTetheredCaching`. Tethered caching requires Content Caching.
- key: CacheLimit
supportedOS:
macOS:
@@ -116,9 +115,9 @@ payloadkeys:
presence: optional
default: false
content: If `true`, Content Caching displays exceptional conditions (alerts) as
system notifications in the upper corner of the screen. Alerts were automatically
displayed starting in macOS 10.13. In macOS 10.15 the alerts are off by default,
but still available through this setting. Available in macOS 10.15 and later.
system notifications in the upper corner of the screen. The device automatically
displayed alerts starting in macOS 10.13. In macOS 10.15 the alerts are off by
default, but still available through this setting.
- key: KeepAwake
supportedOS:
macOS:
@@ -129,7 +128,7 @@ payloadkeys:
content: If `true`, the system prevents the computer from sleeping as long as Content
Caching is on (System Preferences > Sharing > Content Caching is on). Customers
who want Content Caching to be as available as much as possible should turn this
setting on. Available in macOS 10.15 and later.
setting on.
- key: ListenRanges
supportedOS:
macOS:
@@ -239,11 +238,11 @@ payloadkeys:
content: |-
The policy to implement when choosing among more than one configured parent content cache. With every policy, the system skips parent caches that are temporarily unavailable. Allowed values:
- `first-available`: Always use the first available parent in the Parents list. Use this policy to designate permanent primary, secondary, and subsequent parents.
- `url-path-hash`: Hash the path part of the requested URL so that the same parent is always used for the same URL. This is useful for maximizing the size of the combined caches of the parents.
- `random`: Choose a parent at random. Use this policy for load balancing.
- `round-robin`: Rotate through the parents in order. Use this policy for load balancing.
- `sticky-available`: Use the first available parent in the Parents list until it becomes unavailable, then advance to the next one. Use this policy for designating floating primary, secondary, and subsequent parents.
* `first-available`: Always use the first available parent in the Parents list. Use this policy to designate permanent primary, secondary, and subsequent parents.
* `url-path-hash`: Hash the path part of the requested URL so that the same parent is always used for the same URL. This is useful for maximizing the size of the combined caches of the parents.
* `random`: Choose a parent at random. Use this policy for load balancing.
* `round-robin`: Rotate through the parents in order. Use this policy for load balancing.
* `sticky-available`: Use the first available parent in the Parents list until it becomes unavailable, then advance to the next one. Use this policy for designating floating primary, secondary, and subsequent parents.
- key: PeerFilterRanges
supportedOS:
macOS:
@@ -300,3 +299,7 @@ payloadkeys:
the cloud servers should use for matching clients to content caches.
subkeytype: Ranges
subkeys: *id001
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.AssetCache.managed/example1.plist
mdm/profiles/com.apple.Dictionary.yaml
+4
View File
@@ -28,3 +28,7 @@ payloadkeys:
type: <boolean>
presence: required
content: If `true`, enables parental controls dictionary restrictions.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.Dictionary/example1.plist
mdm/profiles/com.apple.DirectoryService.managed.yaml
+4
View File
@@ -272,3 +272,7 @@ payloadkeys:
presence: optional
content: The number of days before requiring a change of the computer trust account
password. Set to `0` to disable the feature.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.DirectoryService.managed/example1.plist
mdm/profiles/com.apple.DiscRecording.yaml
+7 -3
View File
@@ -32,6 +32,10 @@ payloadkeys:
- 'on'
content: |-
Configure disc-burn. Allowed values:
- `off`: The system disables disc burning.
- `on`: The system allows normal default operation. Setting this key to `on` doesn't enable disc burn support if other mechanisms or preferences disabled it. Needs to be enabled with the `Finder` profile.
- `authenticate`: The system requires authentication.
* `off`: The system disables disc burning.
* `on`: The system allows normal default operation. Setting this key to `on` doesn't enable disc burn support if other mechanisms or preferences disabled it. Needs to be enabled with the `Finder` profile.
* `authenticate`: The system requires authentication.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.DiscRecording/example1.plist
mdm/profiles/com.apple.MCX(Accounts).yaml
+4
View File
@@ -39,3 +39,7 @@ payloadkeys:
default: false
content: If `true`, the system disables the guest account. This property has no
effect if `EnableGuestAccount` is `true`.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.MCX(Accounts)/example1.plist
mdm/profiles/com.apple.MCX(EnergySaver).yaml
+4
View File
@@ -147,3 +147,7 @@ payloadkeys:
presence: optional
default: false
content: If `true`, disables sleep.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.MCX(EnergySaver)/example1.plist
mdm/profiles/com.apple.MCX(FileVault2).yaml
+4
View File
@@ -41,3 +41,7 @@ payloadkeys:
presence: optional
default: false
content: If `true`, the system won't store th FileVault key across restarts.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.MCX(FileVault2)/example1.plist
mdm/profiles/com.apple.MCX(Mobililty).yaml → mdm/profiles/com.apple.MCX(Mobility).yaml
+4
View File
@@ -56,3 +56,7 @@ payloadkeys:
default: false
content: If `true`, the system bypasses the secure token authorization dialog. This
dialog only appears on APFS volumes.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.MCX(Mobility)/example1.plist
mdm/profiles/com.apple.MCX(TimeServer).yaml
+4
View File
@@ -41,3 +41,7 @@ notes:
content: If multiple profiles with this payload are sent, the system sets the device's
time server to the value in the last payload installed. Removing the payload won't
change the settings back to the prior settings.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.MCX(TimeServer)/example1.plist
mdm/profiles/com.apple.MCX(WiFi).yaml
+4
View File
@@ -46,3 +46,7 @@ payloadkeys:
presence: optional
default: false
content: If `true`, requires administrator authorization to turn Wi-Fi on or off.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.MCX(WiFi)/example1.plist
mdm/profiles/com.apple.MCX.FileVault2.yaml
+6 -2
View File
@@ -122,12 +122,16 @@ payloadkeys:
content: |-
If `true`, and installation of this payload occurs after enrolling with MDM in Setup Assistant, the system requests Setup Assistant to enable FileVault at setup time.
To use this, enable the Await Device Configured DEP configuration option and send this profile with this key set, before sending the `DeviceConfiguredCommand`.
To use this, enable the Await Device Configured ADE configuration option and send this profile with this key set, before sending the `DeviceConfiguredCommand`.
An admin SecureToken user is required, otherwise the FileVault pane does not appear.
An admin SecureToken user is required, otherwise the FileVault pane doesn't appear.
notes:
- title: ''
content: |-
FileVault 2 performs full XTS-AES 128 encryption on the contents of a volume. Removing the FileVault payload doesn't disable FileVault.
As of macOS 10.15, FileVault settings require supervision or user approval when installed manually.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.MCX.FileVault2/example1.plist
mdm/profiles/com.apple.MCX.TimeMachine.yaml
+4
View File
@@ -67,3 +67,7 @@ payloadkeys:
- key: SkipPathItem
type: <string>
presence: required
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.MCX.TimeMachine/example1.plist
mdm/profiles/com.apple.ManagedClient.preferences.yaml
+4
View File
@@ -60,3 +60,7 @@ payloadkeys:
presence: optional
content: The dictionary of one-time settings.
subkeys: *id001
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.ManagedClient.preferences/example1.plist
mdm/profiles/com.apple.NSExtension.yaml
+4
View File
@@ -62,3 +62,7 @@ notes:
You can manage extensions by bundle identifiers in allow and deny lists, or by a deny list of extension points.
You can also start with all public extensions disallowed. To do so, include `AllPublicExtensionPoints` in `DeniedExtensionPoints`. This causes the system to expand the list to include all extensions that belong to any public extension points. This expansion occurs at evaluation time. The list of extension points can change from release to release. The expanded list disallows Apple and third-party extensions, but still allows extensions that belong to system-critcial extension points to execute.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.NSExtension/example1.plist
mdm/profiles/com.apple.SetupAssistant.managed.yaml
+5 -2
View File
@@ -140,8 +140,7 @@ payloadkeys:
type: <array>
presence: optional
content: An array of strings that describe the setup items to skip. `SkipKeys` provides
a list of valid strings and their meanings. Available in iOS 14 and later, and
macOS 15 and later.
a list of valid strings and their meanings.
subkeys:
- key: SkipSetupItems
type: <string>
@@ -167,3 +166,7 @@ payloadkeys:
presence: optional
default: false
content: If 'true', the system skips the Wallpaper selection window.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.SetupAssistant.managed/example1.plist
mdm/profiles/com.apple.ShareKitHelper.yaml
+1 -1
View File
@@ -40,7 +40,7 @@ payloadkeys:
type: <array>
presence: optional
content: The list of plugin IDs that won't show up in the user's Share menu. This
key is used only if there is no `SHKAllowedShareServices` key.
key is used only if there's no `SHKAllowedShareServices` key.
subkeys:
- key: SHKDeniedShareServicesItem
type: <string>
mdm/profiles/com.apple.SoftwareUpdate.yaml
+10 -4
View File
@@ -1,5 +1,6 @@
title: Software Update
description: The payload that configures the software update policy.
description: 'The payload that configures the software update policy. Removed: use
the declarative management `com.apple.configuration.softwareupdate.settings` configuration.'
payload:
payloadtype: com.apple.SoftwareUpdate
supportedOS:
@@ -8,6 +9,7 @@ payload:
macOS:
introduced: '10.7'
deprecated: '26.0'
removed: '27.0'
multiple: false
devicechannel: true
userchannel: false
@@ -33,10 +35,10 @@ payloadkeys:
mode: forbidden
type: <string>
presence: optional
content: The URL of the software update catalog. This property is not supported
in macOS 11 and later.
content: The URL of the software update catalog. This property isn't supported in
macOS 11 and later.
- key: AllowPreReleaseInstallation
title: Allow Pre-Release Update Installation
title: Allow pre-release update installation
supportedOS:
macOS:
introduced: '10.9'
@@ -108,3 +110,7 @@ payloadkeys:
presence: optional
default: true
content: If `false`, restricts the automatic installation of configuration data.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.SoftwareUpdate/example1.plist
mdm/profiles/com.apple.SystemConfiguration.yaml
+4
View File
@@ -134,3 +134,7 @@ payloadkeys:
type: <string>
presence: required
content: Bypass proxy settings for these Hosts & Domains
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.SystemConfiguration/example1.plist
mdm/profiles/com.apple.TCC.configuration-profile-policy.yaml
+36 -18
View File
@@ -60,7 +60,7 @@ payloadkeys:
- key: CodeRequirement
type: <string>
presence: required
content: Obtained via the command `codesign -display -r -`.
content: Obtain this value by running `codesign -display -r -`.
- key: StaticCode
type: <boolean>
presence: optional
@@ -94,8 +94,6 @@ payloadkeys:
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both.
Available in macOS 11 and later.
- key: Comment
type: <string>
presence: optional
@@ -139,25 +137,35 @@ payloadkeys:
subkeytype: Identity
subkeys: *id001
- key: Camera
supportedOS:
macOS:
deprecated: '27.0'
type: <array>
presence: optional
content: A system camera. Access to the camera can't be given in a profile; it
can only be denied.
content: A system camera. A profile can't grant access to the camera; it can only
deny it.
subkeytype: Identity
subkeys: *id001
- key: Microphone
supportedOS:
macOS:
deprecated: '27.0'
type: <array>
presence: optional
content: A system microphone. Access to the microphone can't be given in a profile;
it can only be denied.
content: A system microphone. A profile can't grant access to the microphone;
it can only deny it.
subkeytype: Identity
subkeys: *id001
- key: Accessibility
supportedOS:
macOS:
deprecated: '27.0'
type: <array>
presence: optional
content: Specifies the policies for the app via the Accessibility subsystem. The
ability to grant access by this profile is deprecated as of macOS 26.2, and
will be removed in macOS 27.0.
content: |-
Specifies the policies for the app via the Accessibility subsystem. In macOS 27.0, the device shows a non-blocking notification for each application when this setting is applied, and it allows the user to make changes to the setting in the System Settings app.
Deprecated: use the `Privacy` key in the declarative management `com.apple.configuration.app.settings` configuration.
subkeytype: Identity
subkeys: *id001
- key: PostEvent
@@ -214,8 +222,8 @@ payloadkeys:
type: <array>
presence: optional
content: Allows the application to use CoreGraphics and HID APIs to listen to
(receive) CGEvents and HID events from all processes. Access to these events
can't be given in a profile; it can only be denied.
(receive) CGEvents and HID events from all processes. A profile can't grant
access to these events; it can only deny it.
subkeytype: Identity
subkeys: *id001
- key: ScreenCapture
@@ -225,17 +233,20 @@ payloadkeys:
type: <array>
presence: optional
content: Allows the application to capture (read) the contents of the system display.
Access to the contents can't be given in a profile; it can only be denied.
A profile can't grant access to the contents; it can only deny it.
subkeytype: Identity
subkeys: *id001
- key: SpeechRecognition
supportedOS:
macOS:
introduced: '10.15'
deprecated: '27.0'
type: <array>
presence: optional
content: Allows the application to use the system Speech Recognition facility
and to send speech data to Apple.
content: |-
Allows the application to use the system Speech Recognition facility and to send speech data to Apple.
Deprecated: use the `Privacy` key in the declarative management `com.apple.configuration.app.settings` configuration.
subkeytype: Identity
subkeys: *id001
- key: SystemPolicyDesktopFolder
@@ -289,8 +300,7 @@ payloadkeys:
introduced: '13.0'
type: <array>
presence: optional
content: Allows the application to update or delete other apps. Available in macOS
13 and later.
content: Allows the application to update or delete other apps.
subkeytype: Identity
subkeys: *id001
- key: SystemPolicyAppData
@@ -306,8 +316,16 @@ payloadkeys:
supportedOS:
macOS:
introduced: '11.0'
deprecated: '27.0'
type: <array>
presence: optional
content: Specifies the policies for the app to access Bluetooth devices.
content: |-
Specifies the policies for the app to access Bluetooth devices.
Deprecated: use the `Privacy` key in the declarative management `com.apple.configuration.app.settings` configuration.
subkeytype: Identity
subkeys: *id001
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.TCC.configuration-profile-policy/example1.plist
mdm/profiles/com.apple.airplay.security.yaml
+9 -5
View File
@@ -23,7 +23,7 @@ payload:
password phrase.
payloadkeys:
- key: SecurityType
title: Security Type
title: Security type
type: <string>
presence: required
rangelist:
@@ -33,14 +33,14 @@ payloadkeys:
content: |-
The security policy for AirPlay. Allowed values:
- `PASSCODE_ONCE`: Requires an onscreen passcode on first connection from a device. Subsequent connections from the same device aren't prompted.
- `PASSCODE_ALWAYS`: Requires an onscreen passcode for every AirPlay connection. After an AirPlay connection ends, the system allows reconnecting within 30 seconds without a password.
- `PASSWORD`: Requires the passphrase set for `Password`.
* `PASSCODE_ONCE`: Requires an onscreen passcode on first connection from a device. Subsequent connections from the same device aren't prompted.
* `PASSCODE_ALWAYS`: Requires an onscreen passcode for every AirPlay connection. After an AirPlay connection ends, the system allows reconnecting within 30 seconds without a password.
* `PASSWORD`: Requires the passphrase set for `Password`.
> Note:
> `NONE` was deprecated in tvOS 11.3. Existing profiles that use `NONE` get the `PASSWORD_ONCE` behavior.
- key: AccessType
title: Access Type
title: Access type
type: <string>
presence: required
rangelist:
@@ -57,3 +57,7 @@ payloadkeys:
type: <string>
presence: optional
content: The AirPlay password; required if `SecurityType` is `PASSWORD`.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.airplay.security/example1.plist
mdm/profiles/com.apple.airplay.yaml
+9 -6
View File
@@ -52,7 +52,7 @@ payloadkeys:
device. This allow list applies to supervised devices.
subkeys: &id001
- key: AllowListItem
title: AllowList Content Item
title: AllowList content item
supportedOS:
iOS:
introduced: '7.0'
@@ -85,7 +85,7 @@ payloadkeys:
As of tvOS 18, `DeviceID` isn't supported.
- key: DeviceName
title: Device Name
title: Device name
supportedOS:
iOS:
introduced: '18.0'
@@ -106,19 +106,18 @@ payloadkeys:
installed payloads, is an error and results in undefined behavior.
subkeys:
- key: PasswordsItem
title: Password Content Item
title: Password content item
type: <dictionary>
presence: required
subkeys:
- key: DeviceName
title: Device Name
title: Device name
supportedOS:
macOS:
introduced: '15.0'
type: <string>
presence: optional
content: The name of the AirPlay destination; used in iOS, and available in
macOS 15 and later.
content: The name of the AirPlay destination.
- key: Password
title: Password
type: <string>
@@ -152,3 +151,7 @@ payloadkeys:
presence: optional
content: Use `AllowList` instead. This key is deprecated in iOS 14.5 and macOS 11.3.
subkeys: *id001
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.airplay/example1.plist
mdm/profiles/com.apple.airprint.yaml
+9 -5
View File
@@ -49,7 +49,7 @@ payloadkeys:
type: <dictionary>
subkeys:
- key: IPAddress
title: IP Address
title: IP address
supportedOS:
iOS:
introduced: '7.0'
@@ -57,7 +57,7 @@ payloadkeys:
presence: required
content: The IP address or hostname of the AirPrint destination.
- key: ResourcePath
title: Resource Path
title: Resource path
supportedOS:
iOS:
introduced: '7.0'
@@ -71,7 +71,7 @@ payloadkeys:
- `ipp/print`
- `Epson_IPP_Printer`
- key: Port
title: Port Number
title: Port number
supportedOS:
iOS:
introduced: '11.0'
@@ -94,5 +94,9 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If `true`, AirPrint connections are secured by Transport Layer Security
(TLS). Available only in iOS 11 and later.
content: If `true`, Transport Layer Security (TLS) secures AirPrint connections.
Available only in iOS 11 and later.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.airprint/example1.plist
mdm/profiles/com.apple.apn.managed.yaml
+1 -1
View File
@@ -37,7 +37,7 @@ payloadkeys:
- key: apns
type: <array>
presence: required
content: An array of APN dictionaries (\`APN.DefaultsData.Apns\`).
content: An array of APN dictionaries.
subkeys:
- key: apnsItem
type: <dictionary>

Some files were not shown because too many files have changed in this diff Show More