Release_iOS-18-2_macOS-15-2

mdm/profiles/CommonPayloadKeys.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/GlobalPreferences.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/TopLevel.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.ADCertificate.managed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.AIM.account.yaml

@@ -12,6 +12,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.Dictionary.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.DiscRecording.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.MCX(Mobililty).yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.MCX.FileVault2.yaml

@@ -68,8 +68,8 @@ payloadkeys:
 - key: Certificate
   type: <data>
   presence: optional
-  content: DER-encoded certificate data if an institutional recovery key will be added.
-    This key is not supported on Macs with Apple silicon.
+  content: The DER-encoded certificate data if the system creates an institutional
+    recovery key. This key isn't supported on Macs with Apple silicon.
 - key: PayloadCertificateUUID
   type: <string>
   presence: optional

mdm/profiles/com.apple.ManagedClient.preferences.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.NSExtension.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.SetupAssistant.managed.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.ShareKitHelper.yaml

@@ -11,6 +11,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.airplay.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true
@@ -77,9 +78,9 @@ payloadkeys:
       format: ^([0-9A-Fa-f]{2}:){5}([0-9A-Fa-f]{2})$
       content: |-
         The device ID of the AirPlay destination in the format 'xx:xx:xx:xx:xx:xx'. This field isn't case-sensitive.
-        The list of visible AirPlay destinations will be limited to devices that are present in the `AllowList` field of all installed AirPlay payloads.
-        Specifying the same MACAddress more than once, whether in the same payload across different payloads, will result in undefined behavior.
-        As of iOS 18 and macOS 15, `DeviceID` isn't supported, as tvOS 18 AirPlay destinations do not support it.
+        The system limits the list of visible AirPlay destinations to devices that are present in the 'AllowList' field of all installed AirPlay payloads.
+        Specifying the same MACAddress more than once, whether in the same payload across different payloads, results in undefined behavior.
+        As of tvOS 18, 'DeviceID' isn't supported.
     - key: DeviceName
       title: Device Name
       supportedOS:
@@ -91,7 +92,7 @@ payloadkeys:
       presence: optional
       content: |-
         The name of the AirPlay device.
-        The list of visible AirPlay destinations will be limited to devices that are present in the AllowList field of all installed AirPlay payloads.
+        The system limits the list of visible AirPlay destinations to devices that are present in the 'AllowList' field of all installed AirPlay payloads.
 - key: Passwords
   title: Passwords
   type: <array>

mdm/profiles/com.apple.airprint.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.applicationaccess.new.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.applicationaccess.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true
@@ -362,9 +363,9 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: true
-  content: If false, disables the ability for the user to hide apps. It does not affect
-    the user's ability to leave it in the App Library, while removing it from the
-    home screen.
+  content: If 'false', disables the ability for the user to hide apps. It doesn't
+    affect the user's ability to leave it in the App Library, while removing it from
+    the home screen. Available in iOS 18 and later.
 - key: allowAppsToBeLocked
   title: Allow Locking Apps
   supportedOS:
@@ -384,8 +385,9 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: true
-  content: If false, disables the ability for the user to lock apps. Because hiding
-    apps also requires locking them, disallowing locking also disallows hiding.
+  content: If 'false', disables the ability for the user to lock apps. Because hiding
+    apps also requires locking them, disallowing locking also disallows hiding. Available
+    in iOS 18 and later.
 - key: allowARDRemoteManagementModification
   title: Allow modifying Remote Management Sharing setting
   supportedOS:
@@ -491,6 +493,8 @@ payloadkeys:
     iOS:
       introduced: '17.4'
       supervised: true
+      sharedipad:
+        mode: forbidden
       userenrollment:
         mode: forbidden
     macOS:
@@ -620,7 +624,9 @@ payloadkeys:
       userenrollment:
         mode: forbidden
     macOS:
-      introduced: n/a
+      introduced: '15.0'
+      userenrollment:
+        mode: forbidden
     tvOS:
       introduced: n/a
     visionOS:
@@ -631,7 +637,7 @@ payloadkeys:
   presence: optional
   default: true
   content: If 'false', the system removes the Book Store tab from the Books app. Requires
-    a supervised device. Available in iOS 6 and later.
+    a supervised device. Available in iOS 6 and later and macOS 15 and later.
 - key: allowBookstoreErotica
   title: Allow Bookstore Erotica
   supportedOS:
@@ -640,7 +646,9 @@ payloadkeys:
       userenrollment:
         mode: forbidden
     macOS:
-      introduced: n/a
+      introduced: '15.0'
+      userenrollment:
+        mode: forbidden
     tvOS:
       introduced: '11.3'
       deprecated: '17.0'
@@ -652,8 +660,9 @@ payloadkeys:
   presence: optional
   default: true
   content: If 'false', the system prevents the user from downloading Apple Books media
-    that's tagged as erotica. Available in iOS 6 and later, and tvOS 11.3 and later.
-    Support for this restriction on unsupervised devices is deprecated.
+    that's tagged as erotica. Available in iOS 4.0 and later, macOS 15 and later,
+    and tvOS 17 and later. Support for this restriction on unsupervised devices is
+    deprecated.
 - key: allowCallRecording
   title: Allow Call Recording
   supportedOS:
@@ -675,7 +684,7 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: true
-  content: If false, call recording is disabled.
+  content: If 'false', disables call recording. Available in iOS 18 and later.
 - key: allowCamera
   title: Allow Camera Use
   supportedOS:
@@ -996,6 +1005,8 @@ payloadkeys:
     visionOS:
       introduced: '2.0'
       supervised: true
+      userenrollment:
+        mode: forbidden
     watchOS:
       introduced: n/a
   type: <boolean>
@@ -1065,6 +1076,31 @@ payloadkeys:
   default: true
   content: If 'false', the system disables QuickPath keyboard. Requires a supervised
     device. Available in iOS 13 and later.
+- key: allowDefaultBrowserModification
+  title: Allow default browser modification
+  supportedOS:
+    iOS:
+      introduced: '18.2'
+      supervised: true
+      userenrollment:
+        mode: forbidden
+    macOS:
+      introduced: n/a
+    tvOS:
+      introduced: n/a
+    visionOS:
+      introduced: '2.2'
+      supervised: true
+      userenrollment:
+        mode: forbidden
+    watchOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: true
+  content: If 'false', disables default browser preference modification. The MDM Settings
+    command to set the default browser preference will still work when this is applied.
+    Available in iOS 18.2 and later, and visionOS 2.2 and later.
 - key: allowDefinitionLookup
   title: Allow Define
   supportedOS:
@@ -1366,7 +1402,9 @@ payloadkeys:
       userenrollment:
         mode: forbidden
     macOS:
-      introduced: n/a
+      introduced: '15.0'
+      userenrollment:
+        mode: forbidden
     tvOS:
       introduced: '11.3'
       supervised: true
@@ -1377,11 +1415,64 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: true
-  content: If 'false', the system hides explicit music or video content purchased
-    from the iTunes Store. The system marks explicit content as such by content providers,
-    such as record labels, when sold through the iTunes Store. Available in iOS 4
-    and later, and tvOS 11.3 and later. Requires a supervised device in iOS 13 and
-    later. Support for this restriction on unsupervised devices is deprecated.
+  content: |-
+    If 'false', the system hides explicit music or video content purchased from the iTunes Store. The system marks explicit content as such by content providers, such as record labels, when sold through the iTunes Store. Explicit content in the News and Podcast apps is also hidden.
+    Available in iOS 4.0 and later, macOS 15 and later, and tvOS 11.3 and later. Requires a supervised device in iOS 13 and later. Support for this restriction on unsupervised devices is deprecated.
+- key: allowExternalIntelligenceIntegrations
+  title: Allow external intelligence integrations
+  supportedOS:
+    iOS:
+      introduced: '18.2'
+      supervised: false
+      sharedipad:
+        mode: forbidden
+      userenrollment:
+        mode: allowed
+    macOS:
+      introduced: '15.2'
+      userenrollment:
+        mode: forbidden
+    tvOS:
+      introduced: n/a
+    visionOS:
+      introduced: n/a
+    watchOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: true
+  content: If 'false', disables the use of external, cloud-based intelligence services
+    with Siri. On iOS, this restriction is temporarily allowed on unsupervised and
+    user enrollments. In a future release, this restriction will require supervision,
+    and will be ignored on non-supervised devices. Available in iOS 18.2 and later,
+    and macOS 15.2 and later.
+- key: allowExternalIntelligenceIntegrationsSignIn
+  title: Allow external intelligence integrations sign-in
+  supportedOS:
+    iOS:
+      introduced: '18.2'
+      supervised: true
+      sharedipad:
+        mode: forbidden
+      userenrollment:
+        mode: forbidden
+    macOS:
+      introduced: '15.2'
+      userenrollment:
+        mode: forbidden
+    tvOS:
+      introduced: n/a
+    visionOS:
+      introduced: n/a
+    watchOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: true
+  content: If 'false', forces external intelligence providers into anonymous mode.
+    If a user is already signed in to an external intelligence provider, applying
+    this restriction will cause them to be signed out when the next request is attempted.
+    Available in iOS 18.2 and later, and macOS 15.2 and later.
 - key: allowFileSharingModification
   title: Allow modifying File Sharing setting
   supportedOS:
@@ -1998,6 +2089,8 @@ payloadkeys:
     iOS:
       introduced: '18.1'
       supervised: true
+      sharedipad:
+        mode: forbidden
       userenrollment:
         mode: forbidden
     macOS:
@@ -2013,8 +2106,9 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: true
-  content: If false, disables the ability to create summaries of email messages manually.
-    This does not affect automatic summary generation.
+  content: If 'false', disables the ability to create summaries of email messages
+    manually. This doesn't affect automatic summary generation. Available in iOS 18.1
+    and later.
 - key: allowManagedAppsCloudSync
   title: Allow iCloud Sync for Managed Apps
   supportedOS:
@@ -2098,7 +2192,8 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: true
-  content: If false, prevents modification of Media Sharing settings.
+  content: If 'false', prevents modification of Media Sharing settings. Available
+    in macOS 15.1 and later.
 - key: allowMultiplayerGaming
   title: Allow Multiplayer Gaming
   supportedOS:
@@ -2649,7 +2744,8 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: true
-  content: If false, prevents the use of RCS messaging.
+  content: If 'false', prevents the use of RCS messaging. Available in iOS 18.1 and
+    later.
 - key: allowRemoteAppleEventsModification
   title: Allow modifying Remote Apple Events Sharing setting
   supportedOS:
@@ -2732,6 +2828,28 @@ payloadkeys:
     removes its icon from the Home screen. This setting also prevents users from opening
     web clips. As of iOS 13, requires a supervised device. Available in iOS 4 and
     later.
+- key: allowSatelliteConnection
+  title: Allow use of satellite connectivity
+  supportedOS:
+    iOS:
+      introduced: '18.2'
+      supervised: true
+      sharedipad:
+        mode: forbidden
+      userenrollment:
+        mode: forbidden
+    macOS:
+      introduced: n/a
+    tvOS:
+      introduced: n/a
+    visionOS:
+      introduced: n/a
+    watchOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: true
+  content: If false, the connection to and use of satellite services is prohibited.
 - key: allowScreenShot
   title: Allow Screenshots and Screen Recording
   supportedOS:
@@ -3023,6 +3141,8 @@ payloadkeys:
       introduced: n/a
     visionOS:
       introduced: '1.1'
+      userenrollment:
+        mode: forbidden
     watchOS:
       introduced: n/a
   type: <boolean>
@@ -3559,8 +3679,8 @@ payloadkeys:
   type: <boolean>
   presence: optional
   default: false
-  content: If set to true, then the presentation of a screen capture alert will be
-    bypassed.
+  content: If 'true', then the system bypasses the presentation of a screen capture
+    alert. Available in macOS 15.1 and later.
 - key: forceClassroomAutomaticallyJoinClasses
   supportedOS:
     iOS:
@@ -3571,6 +3691,7 @@ payloadkeys:
     macOS:
       introduced: 10.14.4
       supervised: true
+      allowmanualinstall: false
       userenrollment:
         mode: forbidden
     tvOS:
@@ -3595,6 +3716,7 @@ payloadkeys:
     macOS:
       introduced: 10.14.4
       supervised: true
+      allowmanualinstall: false
       userenrollment:
         mode: forbidden
     tvOS:
@@ -3619,6 +3741,7 @@ payloadkeys:
     macOS:
       introduced: 10.14.4
       supervised: true
+      allowmanualinstall: false
       userenrollment:
         mode: forbidden
     tvOS:
@@ -3643,6 +3766,7 @@ payloadkeys:
     macOS:
       introduced: 10.14.4
       supervised: true
+      allowmanualinstall: false
       userenrollment:
         mode: forbidden
     tvOS:
@@ -3833,7 +3957,7 @@ payloadkeys:
   presence: optional
   default: false
   content: |-
-    If 'true', the system preserves eSIM when it erases the device due to too many failed password attempts or the Erase All Content and Settings option in Settings > General > Reset. Available in iOS 17.2 and later.
+    If 'true', the system preserves eSIM when it erases the device due to too many failed password attempts or the Erase All Content and Settings option in Settings > General > Reset. Requires a supervised device. Available in iOS 17.2 and later.
     The system doesn't preserve eSIM if Find My initiates erasing the device.
 - key: forceWatchWristDetection
   title: Force Apple Watch Wrist Detection
@@ -3926,7 +4050,9 @@ payloadkeys:
       userenrollment:
         mode: forbidden
     macOS:
-      introduced: n/a
+      introduced: '15.0'
+      userenrollment:
+        mode: forbidden
     tvOS:
       introduced: '11.3'
     visionOS:
@@ -3940,7 +4066,7 @@ payloadkeys:
     max: 1000
   default: 1000
   content: |-
-    The maximum level of app content allowed on the device. Preinstalled (first party) apps ignore this restriction. Available in iOS 4 and later, and tvOS 11.3 and later. Support for this restriction on unsupervised devices is deprecated.
+    The maximum level of app content allowed on the device. Preinstalled (first party) apps ignore this restriction. Available in iOS 4.0 and later, macOS 15 and later, and tvOS 11.3 and later.  Support for this restriction on unsupervised devices is deprecated.
     Possible values, with the US description of the rating level:
 
     * '1000': All
@@ -3956,7 +4082,9 @@ payloadkeys:
       userenrollment:
         mode: forbidden
     macOS:
-      introduced: n/a
+      introduced: '15.0'
+      userenrollment:
+        mode: forbidden
     tvOS:
       introduced: '11.3'
     visionOS:
@@ -3970,7 +4098,7 @@ payloadkeys:
     max: 1000
   default: 1000
   content: |-
-    The maximum level of movie content allowed on the device. Available in iOS 4 and later, and tvOS 11.3 and later. Support for this restriction on unsupervised devices is deprecated.
+    The maximum level of movie content allowed on the device. Available in iOS 4.0 and later, macOS 15 and later, and tvOS 11.3 and later.  Support for this restriction on unsupervised devices is deprecated.
     Possible values, with the US description of the rating level:
 
     * '1000': All
@@ -4000,7 +4128,8 @@ payloadkeys:
   - nz
   - gb
   content: The two-letter key that profile tools use to display the proper ratings
-    for the given region. The client doesn't recognize or report this data.
+    for the given region. The client doesn't recognize or report this data. Available
+    in iOS 4.0 and later, macOS 10.7 and later, and tvOS 9 and later.
 - key: ratingTVShows
   title: TV Shows Ranking Number
   supportedOS:
@@ -4008,7 +4137,9 @@ payloadkeys:
       userenrollment:
         mode: forbidden
     macOS:
-      introduced: n/a
+      introduced: '15.0'
+      userenrollment:
+        mode: forbidden
     tvOS:
       introduced: '11.3'
     visionOS:
@@ -4022,7 +4153,7 @@ payloadkeys:
     max: 1000
   default: 1000
   content: |-
-    The maximum level of TV content allowed on the device. Available in iOS 4 and later, and tvOS 11.3 and later. Support for this restriction on unsupervised devices is deprecated.
+    The maximum level of TV content allowed on the device. Available in iOS 4.0 and later, macOS 15 and later, and tvOS 11.3 and later. Support for this restriction on unsupervised devices is deprecated.
     Possible values, with the US description of the rating level:
 
     * '1000': All

mdm/profiles/com.apple.appstore.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.associated-domains.yaml

@@ -11,6 +11,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: true
       allowmanualinstall: true

mdm/profiles/com.apple.caldav.account.yaml

@@ -20,6 +20,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.carddav.account.yaml

@@ -20,6 +20,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.configurationprofile.identification.yaml

@@ -9,6 +9,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.dashboard.yaml

@@ -12,6 +12,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.declarations.yaml

@@ -17,6 +17,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.desktop.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.dock.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.domains.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true
@@ -104,3 +105,24 @@ payloadkeys:
   subkeys:
   - key: CrossSiteTrackingPreventionRelaxedDomainItem
     type: <string>
+- key: CrossSiteTrackingPreventionRelaxedApps
+  title: Cross-Site Tracking Prevention Relaxed Apps
+  supportedOS:
+    iOS:
+      introduced: '18.0'
+      supervised: true
+      allowmanualinstall: false
+      userenrollment:
+        mode: forbidden
+    macOS:
+      introduced: '15.0'
+      allowmanualinstall: false
+  type: <array>
+  presence: optional
+  content: An array of up to 10 strings representing app bundle-ids. Apps matching
+    the bundle-ids listed here will have relaxed enforcement of cross-site tracking
+    prevention for the domains listed in the 'CrossSiteTrackingPreventionRelaxedDomains'
+    key.
+  subkeys:
+  - key: CrossSiteTrackingPreventionRelaxedAppsItem
+    type: <string>

mdm/profiles/com.apple.education.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: false
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.ews.account.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.extensiblesso(kerberos).yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: true
       allowmanualinstall: false

mdm/profiles/com.apple.extensiblesso.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: true
       allowmanualinstall: false

mdm/profiles/com.apple.familycontrols.contentfilter.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.familycontrols.timelimits.v2.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.fileproviderd.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: true
       allowmanualinstall: false
@@ -28,3 +29,41 @@ payloadkeys:
   default: false
   content: If 'true', enables file providers access to the path of the requesting
     process.
+- key: ManagementAllowsKnownFolderSyncing
+  supportedOS:
+    macOS:
+      introduced: '15.2'
+      devicechannel: true
+      userchannel: false
+      userenrollment:
+        mode: forbidden
+  type: <boolean>
+  presence: optional
+  default: true
+  content: If 'false', the device prevents the File Provider extension using desktop
+    and documents synchronization in any app. If 'true', the device allows File Provider
+    extension desktop and documents synchronization. This does not impact the ability
+    for apps to utilize the File Provider extension for file and folder syncing with
+    remote storage.
+- key: ManagementKnownFolderSyncingAllowList
+  supportedOS:
+    macOS:
+      introduced: '15.2'
+      devicechannel: true
+      userchannel: false
+      userenrollment:
+        mode: forbidden
+  type: <array>
+  presence: optional
+  content: An array of app identifiers for apps that are allowed to utilize File Provider
+    extension desktop and documents synchronization. If present, and `ManagementAllowsKnownFolderSyncing`
+    is set to `true`, the device allows only the apps in this list to use desktop
+    and documents synchronization. This key is ignored if `ManagementAllowsKnownFolderSyncing`
+    is set to `false`. This setting does not impact the ability for apps to utilize
+    File Provider extension for volume access. The format of the app identifiers is
+    "Bundle.Identifier (TeamIdentifier)".
+  subkeys:
+  - key: AllowListItem
+    type: <string>
+    presence: required
+    content: A composed app identifier. The format is "Bundle.Identifier (TeamIdentifier)".

mdm/profiles/com.apple.finder.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.firstactiveethernet.managed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.firstethernet.managed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.font.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.gamed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.globalethernet.managed.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.ironwood.support.yaml

@@ -11,6 +11,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.jabber.account.yaml

@@ -13,6 +13,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.ldap.account.yaml

@@ -20,6 +20,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.loginitems.managed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.mail.managed.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.mcxMenuExtras.yaml

@@ -9,6 +9,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.mcxprinting.yaml

@@ -9,6 +9,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.mobiledevice.passwordpolicy.yaml

@@ -17,6 +17,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.notificationsettings.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       allowmanualinstall: true
       userenrollment:

mdm/profiles/com.apple.preference.security.yaml

@@ -9,6 +9,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.preferences.users.yaml

@@ -9,6 +9,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.profileRemovalPassword.yaml

@@ -17,6 +17,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.relay.managed.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.screensaver.user.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.secondactiveethernet.managed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.secondethernet.managed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.security.acme.yaml

@@ -20,6 +20,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.security.certificatepreference.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.security.firewall.yaml

@@ -66,8 +66,8 @@ payloadkeys:
       removed: '15.0'
   type: <boolean>
   presence: optional
-  content: If 'true', the system enables logging. Available in macOS 12 and later.
-    Removed in macOS 15.
+  content: If 'true', the system enables logging. Available in macOS 12 through macOS
+    14.6.
 - key: LoggingOption
   supportedOS:
     macOS:
@@ -80,8 +80,7 @@ payloadkeys:
   - throttled
   - brief
   - detail
-  content: The type of logging. Available in macOS 12 and later. Removed in macOS
-    15.
+  content: The type of logging. Available in macOS 12 and through macOS 14.6.
 - key: AllowSigned
   supportedOS:
     macOS:

mdm/profiles/com.apple.security.identitypreference.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.security.pem.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.security.pkcs1.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.security.pkcs12.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.security.root.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.security.scep.yaml

@@ -20,6 +20,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.system-extension-policy.yaml

@@ -111,7 +111,7 @@ payloadkeys:
   presence: optional
   content: A dictionary of system extensions on the computer. The dictionary maps
     the team identifiers (keys) to arrays of bundle identifiers, where the bundle
-    identifier defines the system extension which cannot be disabled or uninstalled
+    identifier defines the system extension which can't be disabled or uninstalled
     when SIP is enabled. It's an error for the same mapping to appear in the dictionary
     values corresponding to 'RemovableSystemExtensions' and 'NonRemovableSystemExtensions'
     keys.
@@ -133,9 +133,9 @@ payloadkeys:
   presence: optional
   content: A dictionary of system extensions on the computer. The dictionary maps
     the team identifiers (keys) to arrays of bundle identifiers, where the bundle
-    identifier defines the system extension which cannot be disabled or uninstalled
+    identifier defines the system extension which can't be disabled or uninstalled
     from System Settings or Finder. The set of system extensions between 'RemovableSystemExtensions'
-    and 'NonRemovableFromUISystemExtensions' are allowed to overlap.
+    and 'NonRemovableFromUISystemExtensions' can to overlap.
   subkeys:
   - key: ANY
     type: <array>

mdm/profiles/com.apple.system.logging.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.systempolicy.control.yaml

@@ -27,13 +27,13 @@ payloadkeys:
 - key: EnableAssessment
   type: <boolean>
   presence: optional
-  content: If 'true', enables Gatekeeper.
+  content: If 'true', enables Gatekeeper. If 'false', disables Gatekeeper.
 - key: AllowIdentifiedDevelopers
   type: <boolean>
   presence: optional
   content: |-
-    If 'true', enables Gatekeeper's 'Mac App Store and identified developers' option.
-    If 'false', enables Gatekeeper's 'Mac App Store' option.
+    If 'true', enables Gatekeeper's “Mac App Store and identified developers” option.
+    If 'false', enables Gatekeeper's “Mac App Store” option.
     If the value of 'EnableAssessment' isn't set to 'true', this key has no effect.
 - key: EnableXProtectMalwareUpload
   supportedOS:

mdm/profiles/com.apple.systempolicy.managed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.systempreferences.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.systemuiserver.yaml

@@ -11,6 +11,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.thirdactiveethernet.managed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.thirdethernet.managed.yaml

@@ -10,6 +10,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.universalaccess.yaml

@@ -9,6 +9,7 @@ payload:
       multiple: false
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.vpn.managed.applayer.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.vpn.managed.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.webClip.managed.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: false
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true

mdm/profiles/com.apple.wifi.managed.yaml

@@ -19,6 +19,7 @@ payload:
       multiple: true
       devicechannel: true
       userchannel: true
+      supervised: false
       requiresdep: false
       userapprovedmdm: false
       allowmanualinstall: true