Release_iOS-18-2_macOS-15-2

mdm/checkin/authenticate.yaml

@@ -17,6 +17,7 @@ payload:
       introduced: '10.7'
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed
@@ -96,8 +97,8 @@ payloadkeys:
         mode: forbidden
   type: <string>
   presence: optional
-  content: The device's UDID (Unique Device ID). This is required if the enrollment
-    type is not user enrollment.
+  content: The device's UDID (Unique Device ID). The system requires this value if
+    the enrollment type isn't user enrollment.
 - key: EnrollmentID
   supportedOS:
     iOS:
@@ -117,8 +118,9 @@ payloadkeys:
       introduced: n/a
   type: <string>
   presence: optional
-  content: The per-enrollment identifier for the device. Available in macOS 10.15
-    and iOS 13.0 and later. This is required if the enrollment type is user enrollment.
+  content: |-
+    The per-enrollment identifier for the device. The system requires this value if the enrollment type is user enrollment.
+    Available in macOS 10.15 and iOS 13.0 and later.
 - key: OSVersion
   supportedOS:
     iOS:

mdm/checkin/checkout.yaml

@@ -17,6 +17,7 @@ payload:
       introduced: '10.7'
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed

mdm/checkin/tokenupdate.yaml

@@ -17,6 +17,7 @@ payload:
       introduced: '10.7'
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed

mdm/checkin/userauthenticate.yaml

@@ -9,6 +9,7 @@ payload:
       introduced: '10.7'
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/account.configuration.yaml

@@ -11,6 +11,7 @@ payload:
       accessrights: None
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: true
       userenrollment:
         mode: forbidden

mdm/commands/application.extensions.listactive.yaml

@@ -10,6 +10,7 @@ payload:
       accessrights: QueryInstalledApps
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/application.extensions.mappings.yaml

@@ -10,6 +10,7 @@ payload:
       accessrights: QueryInstalledApps
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/application.install.enterprise.yaml

@@ -12,6 +12,7 @@ payload:
       accessrights: AllowAppInstallation
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed

mdm/commands/application.install.yaml

@@ -26,6 +26,7 @@ payload:
       accessrights: AllowAppInstallation
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed

mdm/commands/application.installed.list.yaml

@@ -19,6 +19,7 @@ payload:
       accessrights: AllowQueryApplications
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/application.invitetoprogram.yaml

@@ -19,6 +19,7 @@ payload:
       accessrights: None
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/application.managed.list.yaml

@@ -22,6 +22,8 @@ payload:
       accessrights: AllowAppInstallation
       devicechannel: true
       userchannel: true
+      supervised: false
+      requiresdep: false
       userenrollment:
         mode: allowed
     tvOS:

mdm/commands/application.remove.yaml

@@ -19,6 +19,8 @@ payload:
       accessrights: AllowAppInstallation
       devicechannel: true
       userchannel: false
+      supervised: false
+      requiresdep: false
       userenrollment:
         mode: forbidden
     tvOS:

mdm/commands/certificate.list.yaml

@@ -25,6 +25,7 @@ payload:
       accessrights: AllowInspection
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed

mdm/commands/device.configured.yaml

@@ -20,6 +20,7 @@ payload:
       accessrights: None
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: true
       userenrollment:
         mode: forbidden

mdm/commands/device.erase.yaml

@@ -20,6 +20,7 @@ payload:
       accessrights: AllowDeviceErase
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/device.lock.yaml

@@ -20,6 +20,7 @@ payload:
       accessrights: AllowPasscodeRemovalAndLock
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/device.restart.yaml

@@ -20,6 +20,7 @@ payload:
       accessrights: AllowPasscodeRemovalAndLock
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/device.shutdown.yaml

@@ -20,6 +20,7 @@ payload:
       accessrights: AllowPasscodeRemovalAndLock
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/information.contentcaching.yaml

@@ -11,6 +11,7 @@ payload:
       accessrights: AllowQueryNetworkInformation
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/information.device.yaml

@@ -20,6 +20,7 @@ payload:
       accessrights: Special Case
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed

mdm/commands/information.security.yaml

@@ -20,6 +20,7 @@ payload:
       accessrights: AllowQuerySecurity
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed
@@ -69,8 +70,8 @@ responsekeys:
         userenrollment:
           mode: forbidden
     type: <boolean>
-    content: If 'true', the device has a passcode. This value is available in iOS
-      4 and later, and tvOS 6 and later.
+    content: If 'true', the device has a passcode. This key doesn't apply to User-Enrolled
+      devices. This value is available in iOS 4 and later, and tvOS 6 and later.
   - key: PasscodeCompliant
     supportedOS:
       macOS:

mdm/commands/lom.devicerequest.yaml

@@ -10,6 +10,7 @@ payload:
       accessrights: DeviceLockAndRemovePasscode
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/lom.setuprequest.yaml

@@ -11,6 +11,7 @@ payload:
       accessrights: DeviceLockAndRemovePasscode
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/managed.application.configuration.yaml

@@ -23,6 +23,7 @@ payload:
       accessrights: AllowAppInstallation
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed

mdm/commands/media.install.yaml

@@ -20,6 +20,7 @@ payload:
       accessrights: AllowAppInstallation
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/mirroring.request.yaml

@@ -19,6 +19,7 @@ payload:
       accessrights: None
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed

mdm/commands/mirroring.stop.yaml

@@ -19,6 +19,7 @@ payload:
       accessrights: None
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/passcode.firmware.set.yaml

@@ -10,6 +10,7 @@ payload:
       accessrights: DeviceLockAndRemovePasscode
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/passcode.firmware.verify.yaml

@@ -10,6 +10,7 @@ payload:
       accessrights: None
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/passcode.recovery.set.yaml

@@ -10,6 +10,7 @@ payload:
       accessrights: DeviceLockAndRemovePasscode
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/passcode.recovery.verify.yaml

@@ -10,6 +10,7 @@ payload:
       accessrights: DeviceLockAndRemovePasscode
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/profile.install.yaml

@@ -22,6 +22,7 @@ payload:
       accessrights: AllowInstallationRemoval
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed

mdm/commands/profile.list.yaml

@@ -21,6 +21,7 @@ payload:
       accessrights: AllowInspection
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed

mdm/commands/profile.provisioning.install.yaml

@@ -22,6 +22,7 @@ payload:
       accessrights: None
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed

mdm/commands/profile.provisioning.list.yaml

@@ -22,6 +22,7 @@ payload:
       accessrights: None
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed

mdm/commands/profile.provisioning.remove.yaml

@@ -21,6 +21,7 @@ payload:
       accessrights: None
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed

mdm/commands/profile.remove.yaml

@@ -20,6 +20,7 @@ payload:
       accessrights: AllowInstallationRemoval
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed

mdm/commands/rotate.file.vault.key.yaml

@@ -10,6 +10,7 @@ payload:
       accessrights: DeviceLockAndRemovePasscode
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/set.auto.admin.password.yaml

@@ -11,6 +11,7 @@ payload:
       accessrights: None
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: true
       userenrollment:
         mode: forbidden

mdm/commands/settings.yaml

@@ -19,6 +19,7 @@ payload:
       accessrights: AllowSettings
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: allowed
@@ -604,6 +605,40 @@ payloadkeys:
         presence: optional
         content: A unique identifier for the various services a single organization
           manages.
+  - key: DefaultApplications
+    supportedOS:
+      iOS:
+        introduced: '18.2'
+        sharedipad:
+          mode: forbidden
+        userenrollment:
+          mode: forbidden
+      macOS:
+        introduced: n/a
+      tvOS:
+        introduced: n/a
+      visionOS:
+        introduced: '2.2'
+        userenrollment:
+          mode: forbidden
+      watchOS:
+        introduced: n/a
+    type: <dictionary>
+    presence: optional
+    content: A dictionary that contains default application bundle identifiers. Currently
+      it supports a default web browser app.
+    subkeys:
+    - key: Item
+      type: <string>
+      presence: required
+      rangelist:
+      - DefaultApplications
+      content: Sets information about default applications.
+    - key: WebBrowser
+      type: <string>
+      presence: optional
+      content: The bundle identifier of the app that will be set as the default web
+        browser. This app must be an eligible web browser in the region of the device.
   - key: MDMOptions
     supportedOS:
       iOS:
@@ -761,7 +796,8 @@ payloadkeys:
       type: <integer>
       presence: optional
       content: The quota size, in megabytes (MB), for each user on the shared device,
-        or if the quota size is too small, the minimum quota size.
+        or if the quota size is too small, the minimum quota size. Available to Temporary
+        Sessions Only guest users on iOS 17+.
     - key: ResidentUsers
       type: <integer>
       presence: optional

mdm/commands/system.update.available.yaml

@@ -20,6 +20,7 @@ payload:
       accessrights: None
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/commands/user.unlock.yaml

@@ -10,6 +10,7 @@ payload:
       accessrights: DeviceLockAndRemovePasscode
       devicechannel: true
       userchannel: false
+      supervised: false
       requiresdep: false
       userenrollment:
         mode: forbidden

mdm/profiles/CommonPayloadKeys.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/GlobalPreferences.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/TopLevel.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.ADCertificate.managed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.AIM.account.yaml

@@ -12,6 +12,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.Dictionary.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.DiscRecording.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.MCX(Mobililty).yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.MCX.FileVault2.yaml

@@ -68,8 +68,8 @@ payloadkeys:
 - key: Certificate
   type: <data>
   presence: optional
-  content: DER-encoded certificate data if an institutional recovery key will be added.
-    This key is not supported on Macs with Apple silicon.
+  content: The DER-encoded certificate data if the system creates an institutional
+    recovery key. This key isn't supported on Macs with Apple silicon.
 - key: PayloadCertificateUUID
   type: <string>
   presence: optional

mdm/profiles/com.apple.ManagedClient.preferences.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.NSExtension.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.SetupAssistant.managed.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.ShareKitHelper.yaml

@@ -11,6 +11,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.airplay.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true
@@ -77,9 +78,9 @@ payloadkeys:
       format: ^([0-9A-Fa-f]{2}:){5}([0-9A-Fa-f]{2})$
       content: |-
         The device ID of the AirPlay destination in the format 'xx:xx:xx:xx:xx:xx'. This field isn't case-sensitive.
-        The list of visible AirPlay destinations will be limited to devices that are present in the `AllowList` field of all installed AirPlay payloads.
-        Specifying the same MACAddress more than once, whether in the same payload across different payloads, will result in undefined behavior.
-        As of iOS 18 and macOS 15, `DeviceID` isn't supported, as tvOS 18 AirPlay destinations do not support it.
+        The system limits the list of visible AirPlay destinations to devices that are present in the 'AllowList' field of all installed AirPlay payloads.
+        Specifying the same MACAddress more than once, whether in the same payload across different payloads, results in undefined behavior.
+        As of tvOS 18, 'DeviceID' isn't supported.
     - key: DeviceName
       title: Device Name
       supportedOS:
@@ -91,7 +92,7 @@ payloadkeys:
       presence: optional
       content: |-
         The name of the AirPlay device.
-        The list of visible AirPlay destinations will be limited to devices that are present in the AllowList field of all installed AirPlay payloads.
+        The system limits the list of visible AirPlay destinations to devices that are present in the 'AllowList' field of all installed AirPlay payloads.
 - key: Passwords
   title: Passwords
   type: <array>

mdm/profiles/com.apple.airprint.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.applicationaccess.new.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.applicationaccess.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true
@@ -362,9 +363,9 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: true
-  content: If false, disables the ability for the user to hide apps. It does not affect
-    the user's ability to leave it in the App Library, while removing it from the
-    home screen.
+  content: If 'false', disables the ability for the user to hide apps. It doesn't
+    affect the user's ability to leave it in the App Library, while removing it from
+    the home screen. Available in iOS 18 and later.
 - key: allowAppsToBeLocked
   title: Allow Locking Apps
   supportedOS:
@@ -384,8 +385,9 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: true
-  content: If false, disables the ability for the user to lock apps. Because hiding
-    apps also requires locking them, disallowing locking also disallows hiding.
+  content: If 'false', disables the ability for the user to lock apps. Because hiding
+    apps also requires locking them, disallowing locking also disallows hiding. Available
+    in iOS 18 and later.
 - key: allowARDRemoteManagementModification
   title: Allow modifying Remote Management Sharing setting
   supportedOS:
@@ -491,6 +493,8 @@ payloadkeys:
     iOS:
       introduced: '17.4'
       supervised: true
+      sharedipad:
+        mode: forbidden
       userenrollment:
         mode: forbidden
     macOS:
@@ -620,7 +624,9 @@ payloadkeys:
       userenrollment:
         mode: forbidden
     macOS:
-      introduced: n/a
+      introduced: '15.0'
+      userenrollment:
+        mode: forbidden
     tvOS:
       introduced: n/a
     visionOS:
@@ -631,7 +637,7 @@ payloadkeys:
   presence: optional
   default: true
   content: If 'false', the system removes the Book Store tab from the Books app. Requires
-    a supervised device. Available in iOS 6 and later.
+    a supervised device. Available in iOS 6 and later and macOS 15 and later.
 - key: allowBookstoreErotica
   title: Allow Bookstore Erotica
   supportedOS:
@@ -640,7 +646,9 @@ payloadkeys:
       userenrollment:
         mode: forbidden
     macOS:
-      introduced: n/a
+      introduced: '15.0'
+      userenrollment:
+        mode: forbidden
     tvOS:
       introduced: '11.3'
       deprecated: '17.0'
@@ -652,8 +660,9 @@ payloadkeys:
   presence: optional
   default: true
   content: If 'false', the system prevents the user from downloading Apple Books media
-    that's tagged as erotica. Available in iOS 6 and later, and tvOS 11.3 and later.
-    Support for this restriction on unsupervised devices is deprecated.
+    that's tagged as erotica. Available in iOS 4.0 and later, macOS 15 and later,
+    and tvOS 17 and later. Support for this restriction on unsupervised devices is
+    deprecated.
 - key: allowCallRecording
   title: Allow Call Recording
   supportedOS:
@@ -675,7 +684,7 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: true
-  content: If false, call recording is disabled.
+  content: If 'false', disables call recording. Available in iOS 18 and later.
 - key: allowCamera
   title: Allow Camera Use
   supportedOS:
@@ -996,6 +1005,8 @@ payloadkeys:
     visionOS:
       introduced: '2.0'
       supervised: true
+      userenrollment:
+        mode: forbidden
     watchOS:
       introduced: n/a
   type: <boolean>
@@ -1065,6 +1076,31 @@ payloadkeys:
   default: true
   content: If 'false', the system disables QuickPath keyboard. Requires a supervised
     device. Available in iOS 13 and later.
+- key: allowDefaultBrowserModification
+  title: Allow default browser modification
+  supportedOS:
+    iOS:
+      introduced: '18.2'
+      supervised: true
+      userenrollment:
+        mode: forbidden
+    macOS:
+      introduced: n/a
+    tvOS:
+      introduced: n/a
+    visionOS:
+      introduced: '2.2'
+      supervised: true
+      userenrollment:
+        mode: forbidden
+    watchOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: true
+  content: If 'false', disables default browser preference modification. The MDM Settings
+    command to set the default browser preference will still work when this is applied.
+    Available in iOS 18.2 and later, and visionOS 2.2 and later.
 - key: allowDefinitionLookup
   title: Allow Define
   supportedOS:
@@ -1366,7 +1402,9 @@ payloadkeys:
       userenrollment:
         mode: forbidden
     macOS:
-      introduced: n/a
+      introduced: '15.0'
+      userenrollment:
+        mode: forbidden
     tvOS:
       introduced: '11.3'
       supervised: true
@@ -1377,11 +1415,64 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: true
-  content: If 'false', the system hides explicit music or video content purchased
-    from the iTunes Store. The system marks explicit content as such by content providers,
-    such as record labels, when sold through the iTunes Store. Available in iOS 4
-    and later, and tvOS 11.3 and later. Requires a supervised device in iOS 13 and
-    later. Support for this restriction on unsupervised devices is deprecated.
+  content: |-
+    If 'false', the system hides explicit music or video content purchased from the iTunes Store. The system marks explicit content as such by content providers, such as record labels, when sold through the iTunes Store. Explicit content in the News and Podcast apps is also hidden.
+    Available in iOS 4.0 and later, macOS 15 and later, and tvOS 11.3 and later. Requires a supervised device in iOS 13 and later. Support for this restriction on unsupervised devices is deprecated.
+- key: allowExternalIntelligenceIntegrations
+  title: Allow external intelligence integrations
+  supportedOS:
+    iOS:
+      introduced: '18.2'
+      supervised: false
+      sharedipad:
+        mode: forbidden
+      userenrollment:
+        mode: allowed
+    macOS:
+      introduced: '15.2'
+      userenrollment:
+        mode: forbidden
+    tvOS:
+      introduced: n/a
+    visionOS:
+      introduced: n/a
+    watchOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: true
+  content: If 'false', disables the use of external, cloud-based intelligence services
+    with Siri. On iOS, this restriction is temporarily allowed on unsupervised and
+    user enrollments. In a future release, this restriction will require supervision,
+    and will be ignored on non-supervised devices. Available in iOS 18.2 and later,
+    and macOS 15.2 and later.
+- key: allowExternalIntelligenceIntegrationsSignIn
+  title: Allow external intelligence integrations sign-in
+  supportedOS:
+    iOS:
+      introduced: '18.2'
+      supervised: true
+      sharedipad:
+        mode: forbidden
+      userenrollment:
+        mode: forbidden
+    macOS:
+      introduced: '15.2'
+      userenrollment:
+        mode: forbidden
+    tvOS:
+      introduced: n/a
+    visionOS:
+      introduced: n/a
+    watchOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: true
+  content: If 'false', forces external intelligence providers into anonymous mode.
+    If a user is already signed in to an external intelligence provider, applying
+    this restriction will cause them to be signed out when the next request is attempted.
+    Available in iOS 18.2 and later, and macOS 15.2 and later.
 - key: allowFileSharingModification
   title: Allow modifying File Sharing setting
   supportedOS:
@@ -1998,6 +2089,8 @@ payloadkeys:
     iOS:
       introduced: '18.1'
       supervised: true
+      sharedipad:
+        mode: forbidden
       userenrollment:
         mode: forbidden
     macOS:
@@ -2013,8 +2106,9 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: true
-  content: If false, disables the ability to create summaries of email messages manually.
-    This does not affect automatic summary generation.
+  content: If 'false', disables the ability to create summaries of email messages
+    manually. This doesn't affect automatic summary generation. Available in iOS 18.1
+    and later.
 - key: allowManagedAppsCloudSync
   title: Allow iCloud Sync for Managed Apps
   supportedOS:
@@ -2098,7 +2192,8 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: true
-  content: If false, prevents modification of Media Sharing settings.
+  content: If 'false', prevents modification of Media Sharing settings. Available
+    in macOS 15.1 and later.
 - key: allowMultiplayerGaming
   title: Allow Multiplayer Gaming
   supportedOS:
@@ -2649,7 +2744,8 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: true
-  content: If false, prevents the use of RCS messaging.
+  content: If 'false', prevents the use of RCS messaging. Available in iOS 18.1 and
+    later.
 - key: allowRemoteAppleEventsModification
   title: Allow modifying Remote Apple Events Sharing setting
   supportedOS:
@@ -2732,6 +2828,28 @@ payloadkeys:
     removes its icon from the Home screen. This setting also prevents users from opening
     web clips. As of iOS 13, requires a supervised device. Available in iOS 4 and
     later.
+- key: allowSatelliteConnection
+  title: Allow use of satellite connectivity
+  supportedOS:
+    iOS:
+      introduced: '18.2'
+      supervised: true
+      sharedipad:
+        mode: forbidden
+      userenrollment:
+        mode: forbidden
+    macOS:
+      introduced: n/a
+    tvOS:
+      introduced: n/a
+    visionOS:
+      introduced: n/a
+    watchOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: true
+  content: If false, the connection to and use of satellite services is prohibited.
 - key: allowScreenShot
   title: Allow Screenshots and Screen Recording
   supportedOS:
@@ -3023,6 +3141,8 @@ payloadkeys:
       introduced: n/a
     visionOS:
       introduced: '1.1'
+      userenrollment:
+        mode: forbidden
     watchOS:
       introduced: n/a
   type: <boolean>
@@ -3559,8 +3679,8 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: false
-  content: If set to true, then the presentation of a screen capture alert will be
-    bypassed.
+  content: If 'true', then the system bypasses the presentation of a screen capture
+    alert. Available in macOS 15.1 and later.
 - key: forceClassroomAutomaticallyJoinClasses
   supportedOS:
     iOS:
@@ -3571,6 +3691,7 @@ payloadkeys:
     macOS:
       introduced: 10.14.4
       supervised: true
+      allowmanualinstall: false
       userenrollment:
         mode: forbidden
     tvOS:
@@ -3595,6 +3716,7 @@ payloadkeys:
     macOS:
       introduced: 10.14.4
       supervised: true
+      allowmanualinstall: false
       userenrollment:
         mode: forbidden
     tvOS:
@@ -3619,6 +3741,7 @@ payloadkeys:
     macOS:
       introduced: 10.14.4
       supervised: true
+      allowmanualinstall: false
       userenrollment:
         mode: forbidden
     tvOS:
@@ -3643,6 +3766,7 @@ payloadkeys:
     macOS:
       introduced: 10.14.4
       supervised: true
+      allowmanualinstall: false
       userenrollment:
         mode: forbidden
     tvOS:
@@ -3833,7 +3957,7 @@ payloadkeys:
   presence: optional
   default: false
   content: |-
-    If 'true', the system preserves eSIM when it erases the device due to too many failed password attempts or the Erase All Content and Settings option in Settings > General > Reset. Available in iOS 17.2 and later.
+    If 'true', the system preserves eSIM when it erases the device due to too many failed password attempts or the Erase All Content and Settings option in Settings > General > Reset. Requires a supervised device. Available in iOS 17.2 and later.
     The system doesn't preserve eSIM if Find My initiates erasing the device.
 - key: forceWatchWristDetection
   title: Force Apple Watch Wrist Detection
@@ -3926,7 +4050,9 @@ payloadkeys:
       userenrollment:
         mode: forbidden
     macOS:
-      introduced: n/a
+      introduced: '15.0'
+      userenrollment:
+        mode: forbidden
     tvOS:
       introduced: '11.3'
     visionOS:
@@ -3940,7 +4066,7 @@ payloadkeys:
     max: 1000
   default: 1000
   content: |-
-    The maximum level of app content allowed on the device. Preinstalled (first party) apps ignore this restriction. Available in iOS 4 and later, and tvOS 11.3 and later. Support for this restriction on unsupervised devices is deprecated.
+    The maximum level of app content allowed on the device. Preinstalled (first party) apps ignore this restriction. Available in iOS 4.0 and later, macOS 15 and later, and tvOS 11.3 and later.  Support for this restriction on unsupervised devices is deprecated.
     Possible values, with the US description of the rating level:
 
     * '1000': All
@@ -3956,7 +4082,9 @@ payloadkeys:
       userenrollment:
         mode: forbidden
     macOS:
-      introduced: n/a
+      introduced: '15.0'
+      userenrollment:
+        mode: forbidden
     tvOS:
       introduced: '11.3'
     visionOS:
@@ -3970,7 +4098,7 @@ payloadkeys:
     max: 1000
   default: 1000
   content: |-
-    The maximum level of movie content allowed on the device. Available in iOS 4 and later, and tvOS 11.3 and later. Support for this restriction on unsupervised devices is deprecated.
+    The maximum level of movie content allowed on the device. Available in iOS 4.0 and later, macOS 15 and later, and tvOS 11.3 and later.  Support for this restriction on unsupervised devices is deprecated.
     Possible values, with the US description of the rating level:
 
     * '1000': All
@@ -4000,7 +4128,8 @@ payloadkeys:
   - nz
   - gb
   content: The two-letter key that profile tools use to display the proper ratings
-    for the given region. The client doesn't recognize or report this data.
+    for the given region. The client doesn't recognize or report this data. Available
+    in iOS 4.0 and later, macOS 10.7 and later, and tvOS 9 and later.
 - key: ratingTVShows
   title: TV Shows Ranking Number
   supportedOS:
@@ -4008,7 +4137,9 @@ payloadkeys:
       userenrollment:
         mode: forbidden
     macOS:
-      introduced: n/a
+      introduced: '15.0'
+      userenrollment:
+        mode: forbidden
     tvOS:
       introduced: '11.3'
     visionOS:
@@ -4022,7 +4153,7 @@ payloadkeys:
     max: 1000
   default: 1000
   content: |-
-    The maximum level of TV content allowed on the device. Available in iOS 4 and later, and tvOS 11.3 and later. Support for this restriction on unsupervised devices is deprecated.
+    The maximum level of TV content allowed on the device. Available in iOS 4.0 and later, macOS 15 and later, and tvOS 11.3 and later. Support for this restriction on unsupervised devices is deprecated.
     Possible values, with the US description of the rating level:
 
     * '1000': All

mdm/profiles/com.apple.appstore.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.associated-domains.yaml

@@ -11,6 +11,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: true
       allowmanualinstall: true

mdm/profiles/com.apple.caldav.account.yaml

@@ -20,6 +20,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.carddav.account.yaml

@@ -20,6 +20,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.configurationprofile.identification.yaml

@@ -9,6 +9,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.dashboard.yaml

@@ -12,6 +12,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.declarations.yaml

@@ -17,6 +17,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.desktop.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.dock.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.domains.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true
@@ -104,3 +105,24 @@ payloadkeys:
   subkeys:
   - key: CrossSiteTrackingPreventionRelaxedDomainItem
     type: <string>
+- key: CrossSiteTrackingPreventionRelaxedApps
+  title: Cross-Site Tracking Prevention Relaxed Apps
+  supportedOS:
+    iOS:
+      introduced: '18.0'
+      supervised: true
+      allowmanualinstall: false
+      userenrollment:
+        mode: forbidden
+    macOS:
+      introduced: '15.0'
+      allowmanualinstall: false
+  type: <array>
+  presence: optional
+  content: An array of up to 10 strings representing app bundle-ids. Apps matching
+    the bundle-ids listed here will have relaxed enforcement of cross-site tracking
+    prevention for the domains listed in the 'CrossSiteTrackingPreventionRelaxedDomains'
+    key.
+  subkeys:
+  - key: CrossSiteTrackingPreventionRelaxedAppsItem
+    type: <string>

mdm/profiles/com.apple.education.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: false
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.ews.account.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.extensiblesso(kerberos).yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: true
       allowmanualinstall: false

mdm/profiles/com.apple.extensiblesso.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: true
       allowmanualinstall: false

mdm/profiles/com.apple.familycontrols.contentfilter.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.familycontrols.timelimits.v2.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.fileproviderd.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: true
       allowmanualinstall: false
@@ -28,3 +29,41 @@ payloadkeys:
   default: false
   content: If 'true', enables file providers access to the path of the requesting
     process.
+- key: ManagementAllowsKnownFolderSyncing
+  supportedOS:
+    macOS:
+      introduced: '15.2'
+      devicechannel: true
+      userchannel: false
+      userenrollment:
+        mode: forbidden
+  type: <boolean>
+  presence: optional
+  default: true
+  content: If 'false', the device prevents the File Provider extension using desktop
+    and documents synchronization in any app. If 'true', the device allows File Provider
+    extension desktop and documents synchronization. This does not impact the ability
+    for apps to utilize the File Provider extension for file and folder syncing with
+    remote storage.
+- key: ManagementKnownFolderSyncingAllowList
+  supportedOS:
+    macOS:
+      introduced: '15.2'
+      devicechannel: true
+      userchannel: false
+      userenrollment:
+        mode: forbidden
+  type: <array>
+  presence: optional
+  content: An array of app identifiers for apps that are allowed to utilize File Provider
+    extension desktop and documents synchronization. If present, and `ManagementAllowsKnownFolderSyncing`
+    is set to `true`, the device allows only the apps in this list to use desktop
+    and documents synchronization. This key is ignored if `ManagementAllowsKnownFolderSyncing`
+    is set to `false`. This setting does not impact the ability for apps to utilize
+    File Provider extension for volume access. The format of the app identifiers is
+    "Bundle.Identifier (TeamIdentifier)".
+  subkeys:
+  - key: AllowListItem
+    type: <string>
+    presence: required
+    content: A composed app identifier. The format is "Bundle.Identifier (TeamIdentifier)".

mdm/profiles/com.apple.finder.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.firstactiveethernet.managed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.firstethernet.managed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.font.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.gamed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.globalethernet.managed.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.ironwood.support.yaml

@@ -11,6 +11,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.jabber.account.yaml

@@ -13,6 +13,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.ldap.account.yaml

@@ -20,6 +20,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.loginitems.managed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.mail.managed.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.mcxMenuExtras.yaml

@@ -9,6 +9,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.mcxprinting.yaml

@@ -9,6 +9,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.mobiledevice.passwordpolicy.yaml

@@ -17,6 +17,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.notificationsettings.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       allowmanualinstall: true
       userenrollment:

mdm/profiles/com.apple.preference.security.yaml

@@ -9,6 +9,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.preferences.users.yaml

@@ -9,6 +9,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.profileRemovalPassword.yaml

@@ -17,6 +17,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.relay.managed.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.screensaver.user.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.secondactiveethernet.managed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.secondethernet.managed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.security.acme.yaml

@@ -20,6 +20,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true