CalvinBackup/apple_device-management
1
0
Fork 0
mirror of https://github.com/apple/device-management.git synced 2026-07-10 21:13:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Release_iOS-17-4_macOS-14-4

Browse Source
This commit is contained in:
Cyrus Daboo
2024-03-05 17:52:42 -05:00
parent 1cb86e0e35
commit 39e2a82234
298 changed files with 4811 additions and 1280 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mdm/checkin/authenticate.yaml
+36
View File
@@ -23,6 +23,12 @@ payload:
tvOS:
introduced: '10.2'
supervised: false
visionOS:
introduced: '1.1'
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
supervised: false
@@ -34,6 +40,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -45,6 +53,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -56,6 +66,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -79,6 +91,9 @@ payloadkeys:
macOS:
userenrollment:
mode: forbidden
visionOS:
userenrollment:
mode: forbidden
type: <string>
presence: required
content: The device's UDID (Unique Device ID).
@@ -94,6 +109,9 @@ payloadkeys:
mode: required
tvOS:
introduced: n/a
visionOS:
userenrollment:
mode: required
watchOS:
introduced: n/a
type: <string>
@@ -105,6 +123,8 @@ payloadkeys:
iOS:
introduced: '9.0'
accessrights: AllowQueryDeviceInformation
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
introduced: '10.0'
accessrights: AllowQueryDeviceInformation
@@ -116,6 +136,8 @@ payloadkeys:
iOS:
introduced: '9.0'
accessrights: AllowQueryDeviceInformation
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
introduced: '10.0'
accessrights: AllowQueryDeviceInformation
@@ -127,6 +149,8 @@ payloadkeys:
iOS:
introduced: '9.0'
accessrights: AllowQueryDeviceInformation
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
introduced: '10.0'
accessrights: AllowQueryDeviceInformation
@@ -144,6 +168,10 @@ payloadkeys:
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
visionOS:
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
watchOS:
introduced: '10.0'
accessrights: AllowQueryDeviceInformation
@@ -161,6 +189,10 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
watchOS:
introduced: '10.0'
accessrights: AllowQueryDeviceInformation
@@ -178,6 +210,10 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
watchOS:
introduced: '10.0'
accessrights: AllowQueryDeviceInformation
mdm/checkin/checkout.yaml
+12
View File
@@ -23,6 +23,12 @@ payload:
tvOS:
introduced: '10.2'
supervised: false
visionOS:
introduced: '1.1'
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
supervised: false
@@ -43,6 +49,9 @@ payloadkeys:
iOS:
userenrollment:
mode: forbidden
visionOS:
userenrollment:
mode: forbidden
type: <string>
presence: required
content: The device's UDID (Unique Device ID).
@@ -58,6 +67,9 @@ payloadkeys:
mode: required
tvOS:
introduced: n/a
visionOS:
userenrollment:
mode: required
watchOS:
introduced: n/a
type: <string>
mdm/checkin/declarativemanagement.yaml
+20
View File
@@ -25,6 +25,12 @@ payload:
introduced: '16.0'
supervised: false
requiresdep: false
visionOS:
introduced: '1.1'
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
supervised: false
@@ -58,6 +64,9 @@ payloadkeys:
macOS:
userenrollment:
mode: forbidden
visionOS:
userenrollment:
mode: forbidden
type: <string>
presence: required
content: The device's UDID.
@@ -71,6 +80,9 @@ payloadkeys:
mode: required
tvOS:
introduced: n/a
visionOS:
userenrollment:
mode: required
watchOS:
introduced: n/a
type: <string>
@@ -86,6 +98,8 @@ payloadkeys:
mode: required
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -100,6 +114,8 @@ payloadkeys:
devicechannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -116,6 +132,8 @@ payloadkeys:
devicechannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -131,6 +149,8 @@ payloadkeys:
devicechannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
mdm/checkin/getbootstraptoken.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Check-in protocol get bootstrap token data.
payload:
requesttype: GetBootstrapToken
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.15'
devicechannel: true
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Check-in protocol get bootstrap token data request and response.
payloadkeys:
- key: MessageType
mdm/checkin/gettoken.yaml
+26
View File
@@ -23,6 +23,12 @@ payload:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: '1.1'
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: n/a
content: Check-in protocol get token data request and response.
@@ -55,6 +61,8 @@ payloadkeys:
mode: forbidden
macOS:
introduced: n/a
visionOS:
introduced: n/a
type: <string>
presence: optional
content: A security token to generate the server token. Required by the 'com.apple.watch.pairing'
@@ -69,6 +77,8 @@ payloadkeys:
mode: forbidden
macOS:
introduced: n/a
visionOS:
introduced: n/a
type: <string>
presence: optional
content: The identifier of the phone paired to the watch. Required by the 'com.apple.watch.pairing'
@@ -83,6 +93,8 @@ payloadkeys:
mode: forbidden
macOS:
introduced: n/a
visionOS:
introduced: n/a
type: <string>
presence: optional
content: The identifier of the watch paired to the phone. Required by the 'com.apple.watch.pairing'
@@ -95,6 +107,9 @@ payloadkeys:
macOS:
userenrollment:
mode: forbidden
visionOS:
userenrollment:
mode: forbidden
type: <string>
presence: required
content: The device's UDID.
@@ -106,6 +121,9 @@ payloadkeys:
macOS:
userenrollment:
mode: required
visionOS:
userenrollment:
mode: required
type: <string>
presence: required
content: A per-enrollment identifier that identifies the device for user enrollments.
@@ -117,6 +135,8 @@ payloadkeys:
devicechannel: false
userenrollment:
mode: required
visionOS:
introduced: n/a
type: <string>
presence: required
content: A per-enrollment identifier that identifies the user for user enrollments.
@@ -127,6 +147,8 @@ payloadkeys:
mode: required
macOS:
devicechannel: false
visionOS:
introduced: n/a
type: <string>
presence: optional
content: On Shared iPad, this value returns the Managed Apple ID of the user. When
@@ -139,6 +161,8 @@ payloadkeys:
mode: required
macOS:
devicechannel: false
visionOS:
introduced: n/a
type: <string>
presence: optional
content: In macOS, this value returns the ID of the user. On Shared iPad, this value
@@ -149,6 +173,8 @@ payloadkeys:
introduced: n/a
macOS:
devicechannel: false
visionOS:
introduced: n/a
type: <string>
presence: required
content: The full name of the user.
mdm/checkin/setbootstraptoken.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Check-in protocol set bootstrap token data.
payload:
requesttype: SetBootstrapToken
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.15'
devicechannel: true
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Check-in protocol set bootstrap token data request and response.
payloadkeys:
- key: MessageType
mdm/checkin/tokenupdate.yaml
+26
View File
@@ -23,6 +23,12 @@ payload:
tvOS:
introduced: '10.2'
supervised: false
visionOS:
introduced: '1.1'
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
supervised: false
@@ -35,6 +41,8 @@ payloadkeys:
macOS:
introduced: '10.11'
devicechannel: false
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -58,6 +66,9 @@ payloadkeys:
macOS:
userenrollment:
mode: forbidden
visionOS:
userenrollment:
mode: forbidden
type: <string>
presence: required
content: The device's UDID.
@@ -73,6 +84,9 @@ payloadkeys:
mode: required
tvOS:
introduced: n/a
visionOS:
userenrollment:
mode: required
watchOS:
introduced: n/a
type: <string>
@@ -90,6 +104,8 @@ payloadkeys:
mode: required
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -106,6 +122,8 @@ payloadkeys:
devicechannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -123,6 +141,8 @@ payloadkeys:
devicechannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -138,6 +158,8 @@ payloadkeys:
devicechannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -161,6 +183,10 @@ payloadkeys:
mode: forbidden
macOS:
introduced: n/a
visionOS:
accessrights: AllowPasscodeRemovalAndLock
userenrollment:
mode: forbidden
watchOS:
accessrights: AllowPasscodeRemovalAndLock
type: <data>
mdm/checkin/userauthenticate.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Authenticate network or mobile users with MDM.
payload:
requesttype: UserAuthenticate
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
devicechannel: false
@@ -10,6 +12,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Authenticate network or mobile users with MDM.
payloadkeys:
- key: MessageType
mdm/commands/account.configuration.yaml
+8
View File
@@ -4,6 +4,8 @@ description: This command can be sent to the device to have it create the local
payload:
requesttype: AccountConfiguration
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
accessrights: None
@@ -12,6 +14,12 @@ payload:
requiresdep: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: When a macOS (v10.11 and later) device is configured via DEP to enroll
in an MDM server and the DEP profile has the await_device_configuration flag set
to true, the AccountConfiguration command can be sent to the device to have it
mdm/commands/application.extensions.listactive.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Returns information about the active NSExtensions for a particular
payload:
requesttype: ActiveNSExtensions
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
accessrights: QueryInstalledApps
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
Returns information about the active NSExtensions for a particular user.
NSExtensions are installed and enabled at the user level. There is no concept of "device" NSExtensions.
mdm/commands/application.extensions.mappings.yaml
+8
View File
@@ -3,6 +3,8 @@ description: This command returns information about installed extensions for a u
payload:
requesttype: NSExtensionMappings
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
accessrights: QueryInstalledApps
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
This command returns information about installed extensions for a user.
The purpose of this command is to allow the server to build a mapping of
mdm/commands/application.install.enterprise.yaml
+8
View File
@@ -5,6 +5,8 @@ description: This command allows the server to install enterprise applications o
payload:
requesttype: InstallEnterpriseApplication
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.13.6
accessrights: AllowAppInstallation
@@ -13,6 +15,12 @@ payload:
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to install an application on a device. It
provides a more secure version of 'InstallApplication' that specifies a 'ManifestURL'.
payloadkeys:
mdm/commands/application.install.yaml
+18
View File
@@ -33,6 +33,13 @@ payload:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowAppInstallation
@@ -212,6 +219,8 @@ payloadkeys:
introduced: '16.4'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -226,6 +235,8 @@ payloadkeys:
introduced: '17.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -243,6 +254,9 @@ payloadkeys:
introduced: '11.0'
userenrollment:
mode: forbidden
visionOS:
userenrollment:
mode: forbidden
type: <string>
presence: optional
rangelist:
@@ -263,6 +277,8 @@ payloadkeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -280,6 +296,8 @@ payloadkeys:
introduced: '11.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
mdm/commands/application.installed.list.yaml
+26 -2
View File
@@ -26,6 +26,13 @@ payload:
introduced: '10.2'
accessrights: AllowQueryApplications
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowQueryApplications
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowQueryApplications
@@ -85,6 +92,7 @@ payloadkeys:
- BetaApp
- BundleSize
- DeviceBasedVPP
- DistributorIdentifier
- DynamicSize
- ExternalVersionIdentifier
- HasUpdateAvailable
@@ -123,6 +131,22 @@ responsekeys:
content: |-
The app's external version identifier, which you can use in the iTunes Search API to determine if an updated version of the app is available. Compare this value to the 'externalId' value in the 'contentMetadataLookupUrl' response from the 'VPPServiceConfigSrv' endpoint. If these values don't match, an updated version of the app may be available.
A newer version of an app might not be available for installation on the device for a variety of reasons. A common reason is that the device's operating system version or hardware is incompatible with the available version of the app.
- key: DistributorIdentifier
supportedOS:
iOS:
introduced: '17.4'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The marketplace hosted application's distributor ID. This value is
available in iOS 17.4 and later.
- key: Version
type: <string>
presence: optional
@@ -272,5 +296,5 @@ responsekeys:
- key: Source
type: <string>
presence: optional
content: Source of the application. This value will be set to "Declarative Device
Management" when the app is managed by Declarative Device Management.
content: The source of the application. When the app is managed by Declarative
Device Management this value is 'Declarative Device Management'.
mdm/commands/application.invitetoprogram.yaml
+6
View File
@@ -22,6 +22,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows a server to invite a user to join a program. This command
issues the invitation, but does not allow the server to monitor whether the user
has joined the program. This command is supported in the user channel. This command
mdm/commands/application.managed.list.yaml
+7
View File
@@ -28,6 +28,13 @@ payload:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowAppInstallation
mdm/commands/application.redemptioncode.yaml
+8
View File
@@ -13,6 +13,14 @@ payload:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: If a redemption code is needed during app installation, the server can
use this command to complete the app installation.
payloadkeys:
mdm/commands/application.remove.yaml
+7
View File
@@ -25,6 +25,13 @@ payload:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowAppInstallation
mdm/commands/application.validate.yaml
+11
View File
@@ -15,10 +15,21 @@ payload:
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: n/a
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: n/a
content: This command allows the server to query for installed 3rd party applications.
payloadkeys:
- key: Identifiers
mdm/commands/certificate.list.yaml
+7
View File
@@ -32,6 +32,13 @@ payload:
introduced: '6.0'
accessrights: AllowInspection
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowInspection
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowInspection
mdm/commands/declarativemanagement.yaml
+6
View File
@@ -27,6 +27,12 @@ payload:
introduced: '16.0'
supervised: false
requiresdep: false
visionOS:
introduced: '1.1'
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
supervised: false
mdm/commands/device.activationlock.bypasscode.yaml
+6
View File
@@ -21,6 +21,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Retrieves the Activation Lock bypass code from the device. This bypass
code is only available for 15 days after supervision.
responsekeys:
mdm/commands/device.activationlock.clearbypasscode.yaml
+6
View File
@@ -21,4 +21,10 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Clears the Activation Lock bypass code from the device.
mdm/commands/device.configured.yaml
+4
View File
@@ -27,5 +27,9 @@ payload:
introduced: '10.2'
accessrights: None
supervised: true
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Informs the device that it can continue past DEP enrollment. Only works
on devices in DEP that have their cloud configuration set to await configuration.
mdm/commands/device.erase.yaml
+17
View File
@@ -27,6 +27,13 @@ payload:
introduced: '10.2'
accessrights: AllowDeviceErase
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowDeviceErase
supervised: false
requiresdep: false
userenrollment:
mode: forbidden
watchOS:
introduced: '10.0'
accessrights: AllowDeviceErase
@@ -42,6 +49,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
@@ -57,6 +66,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -73,6 +84,8 @@ payloadkeys:
introduced: '10.8'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -87,6 +100,8 @@ payloadkeys:
introduced: '12.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -117,6 +132,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
mdm/commands/device.esim.yaml
+8
View File
@@ -15,6 +15,14 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
Instructs the device to query for active cellular plan eSIM "profiles" (not a profile in the MDM sense)
at the designated carrier eSIM server URL. This command is only supported on cellular devices, and only
mdm/commands/device.lock.yaml
+4
View File
@@ -23,6 +23,10 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: '10.0'
accessrights: AllowPasscodeRemovalAndLock
mdm/commands/device.lostmode.disable.yaml
+8
View File
@@ -14,4 +14,12 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to take the device out of MDM lost mode.
mdm/commands/device.lostmode.enable.yaml
+8
View File
@@ -15,6 +15,14 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to put the device in MDM lost mode, with
a message, phone number, and footnote text. A message or phone number must be
provided.
mdm/commands/device.lostmode.location.yaml
+8
View File
@@ -15,6 +15,14 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
responsekeys:
- key: Latitude
type: <real>
mdm/commands/device.lostmode.playsound.yaml
+8
View File
@@ -16,6 +16,14 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to tell the device to play a sound if it
is in MDM Lost Mode. The sound will play until the device is either removed from
Lost Mode or a user disables the sound from the device.
mdm/commands/device.restart.yaml
+4
View File
@@ -27,6 +27,10 @@ payload:
introduced: '10.2'
accessrights: AllowPasscodeRemovalAndLock
supervised: true
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command requires the Device Lock access right. The device will restart
immediately.
payloadkeys:
mdm/commands/device.restrictions.clearpassword.yaml
+8
View File
@@ -13,3 +13,11 @@ payload:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
mdm/commands/device.restrictions.list.yaml
+9
View File
@@ -16,10 +16,19 @@ payload:
userchannel: true
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: '6.1'
accessrights: AllowQueryRestrictions
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowQueryRestrictions
supervised: false
requiresdep: false
userenrollment:
mode: forbidden
watchOS:
introduced: '10.0'
accessrights: AllowQueryRestrictions
mdm/commands/device.shutdown.yaml
+6
View File
@@ -23,5 +23,11 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command requires the Device Lock access right. The device will shut
down immediately.
mdm/commands/information.contentcaching.yaml
+8
View File
@@ -4,6 +4,8 @@ description: This command allows the server to query for information about Conte
payload:
requesttype: ContentCachingInformation
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.15.4
accessrights: AllowQueryNetworkInformation
@@ -12,6 +14,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to query for information about Content Caching.
responsekeys:
- key: StatusResponse
mdm/commands/information.device.yaml
+528 -179
View File
File diff suppressed because it is too large Load Diff
mdm/commands/information.security.yaml
+57
View File
@@ -27,6 +27,13 @@ payload:
introduced: '6.0'
accessrights: AllowQuerySecurity
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowQuerySecurity
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowQuerySecurity
@@ -58,6 +65,9 @@ responsekeys:
mode: forbidden
macOS:
introduced: n/a
visionOS:
userenrollment:
mode: forbidden
type: <boolean>
content: If 'true', the device has a passcode. This value is available in iOS
4 and later, and tvOS 6 and later.
@@ -76,6 +86,9 @@ responsekeys:
mode: forbidden
macOS:
introduced: n/a
visionOS:
userenrollment:
mode: forbidden
type: <boolean>
content: If 'true', the user's passcode is compliant with requirements from profiles.
This key doesn't apply to User-Enrolled devices. This value is available in
@@ -88,6 +101,9 @@ responsekeys:
mode: forbidden
macOS:
introduced: n/a
visionOS:
userenrollment:
mode: forbidden
type: <integer>
content: The user preference for the number of seconds before a locked screen
requires the device passcode to unlock it. This value is only available for
@@ -100,6 +116,9 @@ responsekeys:
mode: forbidden
macOS:
introduced: n/a
visionOS:
userenrollment:
mode: forbidden
type: <integer>
content: The enforced value for the number of seconds before a locked screen requires
the device passcode to unlock it. If a device has a passcode, changing 'PasscodeLockGracePeriod'
@@ -117,6 +136,8 @@ responsekeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <integer>
@@ -131,6 +152,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -147,6 +170,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -163,6 +188,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -179,6 +206,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <data>
@@ -197,6 +226,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -216,6 +247,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -230,6 +263,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -291,6 +326,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -325,6 +362,8 @@ responsekeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -336,6 +375,8 @@ responsekeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -357,6 +398,8 @@ responsekeys:
introduced: '10.15'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -371,6 +414,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -427,6 +472,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -441,6 +488,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -457,6 +506,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -478,6 +529,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -495,6 +548,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -512,6 +567,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
mdm/commands/lom.devicerequest.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Issues LOM requests to devices.
payload:
requesttype: LOMDeviceRequest
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
accessrights: DeviceLockAndRemovePasscode
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Used to send LOM requests ("PowerON", "PowerOFF", "Reset") to LOM Controller
which then forwards the request to LOM Devices.
payloadkeys:
mdm/commands/lom.setuprequest.yaml
+8
View File
@@ -4,6 +4,8 @@ description: Queries the device for LOM setup information such as IP addresses,
payload:
requesttype: LOMSetupRequest
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
accessrights: DeviceLockAndRemovePasscode
@@ -12,6 +14,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Queries the device for LOM setup information such as IP addresses, protocol
version, etc. The MDM server must send this command prior to sending the LOMDeviceRequest
command.
mdm/commands/managed.application.attributes.yaml
+13
View File
@@ -15,10 +15,19 @@ payload:
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: n/a
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowAppInstallation
@@ -143,6 +152,8 @@ responsekeys:
introduced: '16.4'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -158,6 +169,8 @@ responsekeys:
introduced: '17.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
mdm/commands/managed.application.configuration.yaml
+7
View File
@@ -30,6 +30,13 @@ payload:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowAppInstallation
mdm/commands/managed.application.feedback.yaml
+9
View File
@@ -26,6 +26,15 @@ payload:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: n/a
content: This command queries the device for application feedback information. This
command requires the App Management right. The response will not include apps
that are managed by Declarative Device Management.
mdm/commands/media.install.yaml
+6
View File
@@ -23,6 +23,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to install a book on a device. If the book
is already being managed, this command will update the book.
payloadkeys:
mdm/commands/media.managed.list.yaml
+8
View File
@@ -14,6 +14,14 @@ payload:
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to query for installed 3rd party applications.
responsekeys:
- key: Books
mdm/commands/media.remove.yaml
+8
View File
@@ -15,6 +15,14 @@ payload:
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows an MDM server to remove managed media. This command
returns Acknowledged even if the item is not found.
payloadkeys:
mdm/commands/mirroring.request.yaml
+6
View File
@@ -22,6 +22,12 @@ payload:
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command prompts the user to share their screen using AirPlay Mirroring.
payloadkeys:
- key: DestinationName
mdm/commands/mirroring.stop.yaml
+6
View File
@@ -22,4 +22,10 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command stops AirPlay mirroring.
mdm/commands/passcode.clear.yaml
+11
View File
@@ -13,6 +13,17 @@ payload:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: '1.1'
accessrights: AllowPasscodeRemovalAndLock
supervised: false
requiresdep: false
userenrollment:
mode: forbidden
watchOS:
introduced: '10.0'
accessrights: AllowPasscodeRemovalAndLock
mdm/commands/passcode.firmware.set.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Changes or clears the firmware password for the device.
payload:
requesttype: SetFirmwarePassword
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
accessrights: DeviceLockAndRemovePasscode
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Changes or clears the firmware password for the device. Requires the "Device
lock and passcode removal right". This command is not available on Apple silicon
devices.
mdm/commands/passcode.firmware.verify.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Verifies the device's firmware password.
payload:
requesttype: VerifyFirmwarePassword
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
accessrights: None
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Verifies the device's firmware password. This command is not available
on Apple silicon devices.
payloadkeys:
mdm/commands/passcode.recovery.set.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Sets or clears the recovery lock password (AppleSilicon devices onl
payload:
requesttype: SetRecoveryLock
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.5'
accessrights: DeviceLockAndRemovePasscode
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Sets or clears the recovery lock password (Apple Silicon devices only).
Requires the "Device lock and passcode removal right".
payloadkeys:
mdm/commands/passcode.recovery.verify.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Verifies the device's recovery lock password. (AppleSilicon devices
payload:
requesttype: VerifyRecoveryLock
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.5'
accessrights: DeviceLockAndRemovePasscode
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Verifies the device's recovery lock password. (AppleSilicon devices only)
payloadkeys:
- key: Password
mdm/commands/passcode.unlocktoken.yaml
+8
View File
@@ -13,6 +13,14 @@ payload:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command requests an UnlockToken from the device. Pass this token to
the ClearPasscode command to unlock the device.
responsekeys:
mdm/commands/profile.install.yaml
+7
View File
@@ -29,6 +29,13 @@ payload:
introduced: '6.0'
accessrights: AllowInstallationRemoval
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowInstallationRemoval
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowInstallationRemoval
mdm/commands/profile.list.yaml
+7
View File
@@ -28,6 +28,13 @@ payload:
introduced: '6.0'
accessrights: AllowInspection
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowInspection
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowInspection
mdm/commands/profile.provisioning.install.yaml
+8 -1
View File
@@ -29,13 +29,20 @@ payload:
introduced: '10.2'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
content: This command allows the server to install a provisioning profile. No error
occurs if the provisioning profile is already installed. This command requires
the Provisioning Profile Installation and Removal right. On macOS, this command
the Provisioning Profile Installation and Removal right. On macOS, this command
is for iOS and iPadOS style provisioning profiles only.
payloadkeys:
- key: ProvisioningProfile
mdm/commands/profile.provisioning.list.yaml
+7
View File
@@ -29,6 +29,13 @@ payload:
introduced: '10.2'
accessrights: AllowProvisioningInspection
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowProvisioningInspection
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowProvisioningInspection
mdm/commands/profile.provisioning.remove.yaml
+7
View File
@@ -28,6 +28,13 @@ payload:
introduced: '10.2'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowProvisioningInstallationRemoval
mdm/commands/profile.remove.yaml
+7
View File
@@ -27,6 +27,13 @@ payload:
introduced: '6.0'
accessrights: AllowInstallationRemoval
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowInstallationRemoval
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowInstallationRemoval
mdm/commands/remotedesktop.disable.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Disable Remote Desktop on the device.
payload:
requesttype: DisableRemoteDesktop
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.14.4
devicechannel: true
@@ -11,4 +13,10 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Disable Remote Desktop.
mdm/commands/remotedesktop.enable.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Enable Remote Desktop on the device.
payload:
requesttype: EnableRemoteDesktop
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.14.4
devicechannel: true
@@ -11,4 +13,10 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Enable Remote Desktop.
mdm/commands/rotate.file.vault.key.yaml
+8
View File
@@ -3,6 +3,8 @@ description: This command allows for changing a device's FileVaultMaster passwor
payload:
requesttype: RotateFileVaultKey
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
accessrights: DeviceLockAndRemovePasscode
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows for changing a device's FileVaultMaster password.
payloadkeys:
- key: KeyType
mdm/commands/set.auto.admin.password.yaml
+8
View File
@@ -4,6 +4,8 @@ description: Allows changing the password of a local admin account that was crea
payload:
requesttype: SetAutoAdminPassword
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
accessrights: None
@@ -12,6 +14,12 @@ payload:
requiresdep: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Allows changing the password of a local admin account that was created
by Setup Assistant during DEP enrollment via the AccountConfiguration command.
payloadkeys:
mdm/commands/settings.yaml
+56 -4
View File
@@ -26,6 +26,13 @@ payload:
introduced: '6.0'
accessrights: AllowSettings
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowSettings
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowSettings
@@ -54,6 +61,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -82,9 +91,12 @@ payloadkeys:
- 3
content: |-
A number that indicates where to use the wallpaper, which is one of the following values:
* '1': Lock screen
* '2': Home screen
* '3': Lock and Home screens
* '3': Both lock and home screens.
In iOS 16 and later, and iPadOS 17 and later, when you set the wallpaper for the first time, the system sets both the lock screen and home screen. After that, you can separately set each location.
- key: DataRoaming
supportedOS:
iOS:
@@ -98,6 +110,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -131,6 +145,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -165,6 +181,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -200,6 +218,8 @@ payloadkeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -236,6 +256,8 @@ payloadkeys:
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
visionOS:
accessrights: AllowAppInstallation
watchOS:
accessrights: AllowAppInstallation
type: <dictionary>
@@ -282,6 +304,8 @@ payloadkeys:
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
visionOS:
accessrights: AllowAppInstallation
watchOS:
accessrights: AllowAppInstallation
type: <dictionary>
@@ -393,6 +417,8 @@ payloadkeys:
introduced: '16.4'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -407,6 +433,8 @@ payloadkeys:
introduced: '17.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -428,6 +456,8 @@ payloadkeys:
introduced: '10.10'
userenrollment:
mode: forbidden
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -456,6 +486,8 @@ payloadkeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -551,6 +583,8 @@ payloadkeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -588,6 +622,8 @@ payloadkeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
@@ -600,6 +636,8 @@ payloadkeys:
introduced: '11.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
@@ -626,6 +664,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -662,6 +702,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -785,9 +827,7 @@ payloadkeys:
content: |-
The number of seconds before a locked screen requires the user to enter the device passcode to unlock it. The minimum value is '0' seconds and the maximum value is '14400' seconds.
If a device has a passcode, a change to a larger value doesn't take effect until the user logs out or removes the passcode. For this reason, it's better to set this value before the user sets a passcode.
If the value set is less than one of the known
values, the next lowest value will be used. For example a value of 299 will
result in an effective setting of 60.
If the value set is less than one of the known values, the next lowest value will be used. For example a value of 299 will result in an effective setting of 60.
This setting won't take effect if 'TemporarySessionOnly' is 'true' because there's no passcode for a temporary session.
- key: AutoLockTime
type: <integer>
@@ -808,6 +848,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -841,6 +883,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -875,6 +919,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -922,6 +968,8 @@ payloadkeys:
tvOS:
introduced: '14.0'
supervised: true
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -957,6 +1005,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -999,6 +1049,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
supervised: true
type: <dictionary>
mdm/commands/system.update.available.yaml
+4
View File
@@ -29,6 +29,10 @@ payload:
devicechannel: true
supervised: true
requiresdep: false
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Queries the device for a list of available OS updates. On OS X, a ScheduleOSUpdateScan
must be performed to update the results returned by this query.
responsekeys:
mdm/commands/system.update.scan.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Requests that the device perform a background scan for OS updates.
payload:
requesttype: ScheduleOSUpdateScan
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
accessrights: None
@@ -12,6 +14,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Requests that the device perform a background scan for OS updates.
payloadkeys:
- key: Force
mdm/commands/system.update.schedule.yaml
+4
View File
@@ -29,6 +29,10 @@ payload:
devicechannel: true
supervised: true
requiresdep: false
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to schedule an OS update.
payloadkeys:
- key: Updates
mdm/commands/system.update.status.yaml
+4
View File
@@ -29,6 +29,10 @@ payload:
devicechannel: true
supervised: true
requiresdep: false
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Queries the device for the status of software updates.
responsekeys:
- key: OSUpdateStatus
mdm/commands/user.configured.yaml
+8
View File
@@ -15,6 +15,14 @@ payload:
userchannel: true
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Informs the device that it can continue past Setup Assistant and finish
login. Only works on Shared iPads that have the AwaitUserConfiguration feature
enabled.
mdm/commands/user.delete.yaml
+9 -2
View File
@@ -24,13 +24,20 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to delete a user that has an active account
on the device.
payloadkeys:
- key: UserName
type: <string>
presence: required
content: The user name of the account to delete.
presence: optional
content: The user name of the account to delete. This key is required when the value
for DeleteAllUsers is absent or false.
- key: ForceDeletion
supportedOS:
macOS:
mdm/commands/user.list.yaml
+6
View File
@@ -24,6 +24,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to query for a list of users that have an
active account on the device.
responsekeys:
mdm/commands/user.logout.yaml
+8
View File
@@ -14,4 +14,12 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to force the current user to logout.
mdm/commands/user.unlock.yaml
+8
View File
@@ -3,6 +3,8 @@ description: This command allows the server to unlock a local user account.
payload:
requesttype: UnlockUserAccount
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
accessrights: DeviceLockAndRemovePasscode
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to unlock a local user account that has
been locked due to too many failed password attempts. Requires "Device lock and
passcode removal right".
mdm/errors/softwareupdate.required.yaml
+2
View File
@@ -8,6 +8,8 @@ payload:
introduced: '14.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
mdm/errors/unrecognized.device.yaml
+40
View File
@@ -0,0 +1,40 @@
title: Error Unrecognized Device
description: Error response for unrecognized device.
payload:
supportedOS:
iOS:
introduced: '17.0'
macOS:
introduced: '14.0'
tvOS:
introduced: '17.0'
visionOS:
introduced: '1.1'
watchOS:
introduced: '10.0'
content: |-
The schema for a JSON or property list XML document returned in an MDM server's 403 response body. The
response headers must include a "Content-Type" header indicating whether JSON or XML is being returned.
This response is returned when a server does not recognize the device making the MDM request, and
causes the device to unenroll with the MDM server. This error should be used in place of the server
returning a 401 response to trigger an unenroll.
payloadkeys:
- key: code
type: <string>
presence: required
rangelist:
- com.apple.unrecognized.device
content: Indicates that the device is not recognized by the server, causing the
device to unenroll from MDM.
- key: description
type: <string>
presence: optional
content: The description of the error. This will only be used by the client for
logging purposes and will not be displayed to the user.
- key: message
type: <string>
presence: optional
content: A description of the error suitable for displaying to the user. If needed,
the client will make a best-effort attempt to display the message, but may not
be able to, due to local conditions.
mdm/errors/watch.pairing.token.missing.yaml
+2
View File
@@ -8,6 +8,8 @@ payload:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: '10.0'
content: |-
mdm/profiles/CommonPayloadKeys.yaml
+7
View File
@@ -29,6 +29,13 @@ payload:
multiple: false
supervised: false
allowmanualinstall: true
visionOS:
introduced: '1.0'
multiple: false
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: '1.0'
multiple: false
mdm/profiles/GlobalPreferences.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: .GlobalPreferences
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Global preferences on macOS
payloadkeys:
- key: MultipleSessionEnabled
mdm/profiles/TopLevel.yaml
+14 -1
View File
@@ -29,6 +29,13 @@ payload:
multiple: false
supervised: false
allowmanualinstall: true
visionOS:
introduced: '1.0'
multiple: false
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: '1.0'
multiple: false
@@ -110,6 +117,8 @@ payloadkeys:
mode: forbidden
tvOS:
supervised: true
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -159,6 +168,8 @@ payloadkeys:
introduced: '10.15'
tvOS:
introduced: '12.2'
visionOS:
introduced: '1.1'
watchOS:
introduced: '5.2'
type: <integer>
@@ -170,11 +181,12 @@ payloadkeys:
- 3
- 4
- 5
- 6
default: 0
content: |-
The type of platform of the target device. Specifying the platform type helps prevent unintended installations.
For interactive installations on iOS devices, specifying a target platform avoids interstitial alerts that prompt the user to choose a profile target when multiple targets are eligible.
Possible values include:
Allowed values:
* '0': Any/unspecified
* '1': iPhone/iPad/iPod Touch
@@ -182,6 +194,7 @@ payloadkeys:
* '3': HomePod
* '4': Apple TV
* '5': Mac
* '6': Vision Pro
- key: ConsentText
type: <dictionary>
presence: optional
mdm/profiles/com.apple.ADCertificate.managed.yaml
+15 -8
View File
@@ -3,6 +3,8 @@ description: Active Directory Certificate
payload:
payloadtype: com.apple.ADCertificate.managed
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: A certificate can be requested from a Microsoft Certificate Authority (CA)
using DCE/RPC and the Active Directory Certificate profile payload instructions
detailed at support.apple.com/kb/HT5357.
@@ -47,9 +55,7 @@ payloadkeys:
type: <string>
presence: optional
content: |-
The name of the certificate authority (CA). This value is determined from the common name (CN) of the Active Directory entry. Available in macOS 10.8 and later.
Valid values:
The name of the certificate authority (CA), which is determined from the common name (CN) of the Active Directory entry. Available in macOS 10.8 and later. Valid values:
* CN=<your CA Name>
* CN='Certification Authorities'
* CN='Public Key Services'
@@ -83,9 +89,10 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', the user is prompted for credentials when the profile is installed.
This key applies only to user certificates with the Manual Download profile delivery
method. Omit this key for computer certificates. Available in macOS 10.8 and later.
content: If 'true', the system prompts the user for credentials when is installs
the profile. This key applies only to user certificates with the Manual Download
profile delivery method. Omit this key for computer certificates. Available in
macOS 10.8 and later.
- key: KeyIsExtractable
title: Key Is Extractable
supportedOS:
@@ -94,8 +101,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', allows exporting the private key. Available in macOS 10.10 and
later.
content: If 'true', the system allows exporting the private key. Available in macOS
10.10 and later.
- key: Keysize
title: Key Size
supportedOS:
mdm/profiles/com.apple.AIM.account.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Use this section to define settings for configuration access to AIM
payload:
payloadtype: com.apple.AIM.account
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
deprecated: '10.13'
@@ -15,6 +17,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: An AIM payload creates an AIM account on the device.
payloadkeys:
- key: AIMAccountDescription
mdm/profiles/com.apple.AssetCache.managed.yaml
+46 -41
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.AssetCache.managed
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.13.4
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Configures the Content Caching service.
payloadkeys:
- key: AllowCacheDelete
@@ -22,9 +30,10 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: |-
Allow the system to purge content from the cache automatically when it needs disk space for other apps (i.e. when free disk space runs low on the computer). Customers who want Content Caching to be as effective as possible should turn this setting off.
Available in macOS 10.15 and later.
content: If true, the system purges content from the cache automatically when it
needs disk space for other apps when free disk space runs low on the computer.
Set to 'false' to maximize effectiveness of Content Caching. Available in macOS
10.15 and later.
- key: AllowPersonalCaching
supportedOS:
macOS:
@@ -33,9 +42,8 @@ payloadkeys:
presence: optional
default: true
content: |-
If 'true', caches the user's iCloud data. Clients may take some time (hours or days) to react to changes to this setting; it doesn't have an immediate effect.
At least one of the 'AllowPersonalCaching' or 'AllowSharedCaching' keys must be 'true'.
If 'true', the system caches the user's iCloud data. Changes to this value don't have an immediate effect. Clients may take some time, such as hours or days, to react to changes.
At least one of the 'AllowPersonalCaching' or 'AllowSharedCaching' keys need to be 'true'.
- key: AllowSharedCaching
supportedOS:
macOS:
@@ -44,9 +52,8 @@ payloadkeys:
presence: optional
default: true
content: |-
If 'true', caches non-iCloud content, such as apps and software updates. Clients may take some time (hours, days) to react to changes to this setting; it does not have an immediate effect.
At least one of the 'AllowPersonalCaching' or 'AllowSharedCaching' keys must be 'true'.
If 'true', the system caches non-iCloud content, such as apps and software updates. Changes to this value don't have an immediate effect. Clients may take some time, such as hours or days, to react to changes.
At least one of the 'AllowPersonalCaching' or 'AllowSharedCaching' keys need to be 'true'.
- key: AutoActivation
supportedOS:
macOS:
@@ -55,8 +62,8 @@ payloadkeys:
presence: optional
default: false
content: |-
If 'true', automatically activates the content cache when possible and prevents it from being disabled. If the 'allowContentCaching' restriction is set to 'false', 'AutoActivation' is also 'false'.
Removing a profile that set 'AutoActivation' to 'true' does not deactivate the Content Cache.
If 'true', the system automatically activates the content cache when possible and prevents disabling it. If 'allowContentCaching' is 'false', 'AutoActivation' is also 'false'.
Removing a profile that set 'AutoActivation' to 'true' doesn't deactivate the Content Cache.
- key: AutoEnableTetheredCaching
supportedOS:
macOS:
@@ -65,7 +72,7 @@ payloadkeys:
presence: optional
default: false
content: |-
Automatically enable Internet connection sharing when possible and prevent disabling Internet connection sharing. 'DenyTetheredCaching' overrides 'AutoEnableTetheredCaching'. Tethered caching requires Content Caching.
If 'true', the system automatically enables Internet connection sharing when possible and prevent disabling Internet connection sharing. 'DenyTetheredCaching' overrides 'AutoEnableTetheredCaching'. Tethered caching requires Content Caching.
Available in macOS 10.15.4 and later.
- key: CacheLimit
supportedOS:
@@ -74,8 +81,8 @@ payloadkeys:
type: <integer>
presence: optional
default: 0
content: The maximum number of bytes of disk space that will be used for the content
cache. A value of 0 means unlimited disk space.
content: The maximum number of bytes of disk space to use for the content cache.
Set to '0' for unlimited disk space.
- key: DataPath
supportedOS:
macOS:
@@ -85,8 +92,7 @@ payloadkeys:
default: /Library/Application Support/Apple/AssetCache/Data
content: |-
The path to the directory used to store cached content. Changing this setting manually doesn't automatically move cached content from the old location to the new one. To move content automatically, use the Sharing preference's Content Caching pane. The value must be (or end with) '/Library/Application Support/Apple/AssetCache/Data'.
A directory and its intermediates are created for the given data path if it doesn't already exist. The directory is owned by '_assetcache:_assetcache' and has mode 0750. Its immediate parent directory ('.../Library/Application Support/Apple/AssetCache') is owned by '_assetcache:_assetcache' and has mode '0755'.
The system creates a directory and its intermediates for the given data path if it doesn't already exist. The directory is owned by '_assetcache:_assetcache' and has mode 0750. Its immediate parent directory ('.../Library/Application Support/Apple/AssetCache') is owned by '_assetcache:_assetcache' and has mode '0755'.
- key: DenyTetheredCaching
supportedOS:
macOS:
@@ -94,7 +100,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', disables tethered caching.
content: If 'true', the system disables tethered caching.
- key: DisplayAlerts
supportedOS:
macOS:
@@ -102,9 +108,10 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: |-
If 'true', Content Caching displays exceptional conditions (alerts) as system notifications in the upper corner of the screen. Alerts were automatically displayed starting in macOS 10.13. In macOS 10.15 the alerts are off by default, but still available via this setting.
Available in macOS 10.15 and later.
content: If 'true', Content Caching displays exceptional conditions (alerts) as
system notifications in the upper corner of the screen. Alerts were automatically
displayed starting in macOS 10.13. In macOS 10.15 the alerts are off by default,
but still available through this setting. Available in macOS 10.15 and later.
- key: KeepAwake
supportedOS:
macOS:
@@ -112,16 +119,18 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: |-
If 'true', prevents the computer from sleeping as long as Content Caching is on (System Preferences > Sharing > Content Caching is on). Customers who want Content Caching to be as available as much as possible should turn this setting on.
Available in macOS 10.15 and later.
content: If 'true', the system prevents the computer from sleeping as long as Content
Caching is on (System Settings > Sharing > Content Caching is on). Customers who
want Content Caching to be as available as much as possible should turn this setting
on. Available in macOS 10.15 and later.
- key: ListenRanges
supportedOS:
macOS:
introduced: 10.13.4
type: <array>
presence: optional
content: An array of dictionaries describing a range of client IP addresses to serve.
content: An array of dictionaries that describe a range of client IP addresses to
serve.
subkeytype: Ranges
subkeys: &id001
- key: RangesItem
@@ -178,8 +187,8 @@ payloadkeys:
default: true
content: If 'true', the content cache offers content to clients only on the same
immediate local network only. No content is offered to clients on other networks
reachable by the content cache. If 'LocalSubnetsOnly' is set to 'true', 'ListenRanges'
will be ignored.
reachable by the content cache. If 'LocalSubnetsOnly' is 'true', the system ignores
'ListenRanges'.
- key: LogClientIdentity
supportedOS:
macOS:
@@ -197,10 +206,10 @@ payloadkeys:
presence: optional
content: An array of the local IP addresses of other content caches that this cache
should download from or upload to, instead of downloading from or uploading to
Apple directly. Invalid addresses and addresses of computers that aren't content
caches are ignored. Parent caches that become unavailable are skipped. If all
parent content caches become unavailable, the content cache downloads from or
uploads to Apple directly, until a parent content cache becomes available again.
Apple directly. The system ignores invalid addresses and addresses of computers
that aren't content caches. The system skips Parent caches that become unavailable.
If all parent content caches become unavailable, the content cache downloads from
or uploads to Apple directly, until a parent content cache becomes available again.
subkeys:
- key: ParentsItem
type: <string>
@@ -220,17 +229,13 @@ payloadkeys:
- sticky-available
default: round-robin
content: |-
The policy to implement when choosing among more than one configured parent content cache. With every policy, parent caches that are temporarily unavailable are skipped.
The policy to implement when choosing among more than one configured parent content cache. With every policy, the system skips parent caches that are temporarily unavailable. Allowed values:
'first-available': Always use the first available parent in the Parents list. Use this policy to designate permanent primary, secondary, and subsequent parents.
'url-path-hash': Hash the path part of the requested URL so that the same parent is always used for the same URL. This is useful for maximizing the size of the combined caches of the parents.
'random': Choose a parent at random. Use this policy for load balancing.
'round-robin': Rotate through the parents in order. Use this policy for load balancing.
'sticky-available': Use the first available parent that is available in the Parents list until it becomes unavailable, then advance to the next one. Use this policy for designating floating primary, secondary, and subsequent parents.
* 'first-available': Always use the first available parent in the Parents list. Use this policy to designate permanent primary, secondary, and subsequent parents.
* 'url-path-hash': Hash the path part of the requested URL so that the same parent is always used for the same URL. This is useful for maximizing the size of the combined caches of the parents.
* 'random': Choose a parent at random. Use this policy for load balancing.
* 'round-robin': Rotate through the parents in order. Use this policy for load balancing.
* 'sticky-available': Use the first available parent in the Parents list until it becomes unavailable, then advance to the next one. Use this policy for designating floating primary, secondary, and subsequent parents.
- key: PeerFilterRanges
supportedOS:
macOS:
@@ -276,7 +281,7 @@ payloadkeys:
presence: optional
default: 0
content: The TCP port number on which the content cache accepts requests for uploads
or downloads. Set the port to 0 to pick a random, available port.
or downloads. Set to '0' to pick a random, available port.
- key: PublicRanges
supportedOS:
macOS:
mdm/profiles/com.apple.Dictionary.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.Dictionary
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Parental controls dictionary restrictions.
payloadkeys:
- key: parentalControl
mdm/profiles/com.apple.DirectoryService.managed.yaml
+35 -27
View File
@@ -3,6 +3,8 @@ description: Directory Service
payload:
payloadtype: com.apple.DirectoryService.managed
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.8'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: In macOS 10.9 and later, a configuration profile can be used to configure
macOS to join an Active Directory (AD) domain. Advanced AD options available via
Directory Utility or the dsconfigad command line tool can also be set using a
@@ -47,7 +55,7 @@ payloadkeys:
title: ADOrganizationalUnit
type: <string>
presence: optional
content: The organizational unit where the joining computer object is added.
content: The organizational unit to add the joining computer object to.
- key: ADMountStyle
title: ADMountStyle
type: <string>
@@ -61,13 +69,13 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADCreateMobileAccountAtLogin' key.
content: If 'true', the system enables the 'ADCreateMobileAccountAtLogin' key.
- key: ADCreateMobileAccountAtLogin
title: ADCreateMobileAccountAtLogin
type: <boolean>
presence: optional
default: false
content: If 'true', creates a mobile account at login.
content: If 'true', the system creates a mobile account at login.
- key: ADWarnUserBeforeCreatingMAFlag
title: ADWarnUserBeforeCreatingMAFlag
supportedOS:
@@ -76,13 +84,13 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADWarnUserBeforeCreatingMA' key.
content: If 'true', the system enables the 'ADWarnUserBeforeCreatingMA' key.
- key: ADWarnUserBeforeCreatingMA
title: ADWarnUserBeforeCreatingMA
type: <boolean>
presence: optional
default: false
content: If 'true', enables the warning before creating the mobile account.
content: If 'true', the system enables the warning before creating the mobile account.
- key: ADForceHomeLocalFlag
title: ADForceHomeLocalFlag
supportedOS:
@@ -91,13 +99,13 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADForceHomeLocal' key.
content: If 'true', the system enables the 'ADForceHomeLocal' key.
- key: ADForceHomeLocal
title: ADForceHomeLocal
type: <boolean>
presence: optional
default: false
content: If 'true', forces a local home directory.
content: If 'true', the system forces a local home directory.
- key: ADUseWindowsUNCPathFlag
title: ADUseWindowsUNCPathFlag
supportedOS:
@@ -106,14 +114,14 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADUseWindowsUNCPath' key.
content: If 'true', the system enables the 'ADUseWindowsUNCPath' key.
- key: ADUseWindowsUNCPath
title: ADUseWindowsUNCPath
type: <boolean>
presence: optional
default: false
content: If 'true', uses the UNC path from Active Directory to derive the network
home location.
content: If 'true', the system uses the UNC path from Active Directory to derive
the network home location.
- key: ADAllowMultiDomainAuthFlag
title: ADAllowMultiDomainAuthFlag
supportedOS:
@@ -122,19 +130,19 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADAllowMultiDomainAuth' key.
content: If 'true', the system enables the 'ADAllowMultiDomainAuth' key.
- key: ADAllowMultiDomainAuth
title: ADAllowMultiDomainAuth
type: <boolean>
presence: optional
default: false
content: If 'true', allows authentication from any domain in the namespace.
content: If 'true', the system allows authentication from any domain in the namespace.
- key: ADDefaultUserShellFlag
title: ADDefaultUserShellFlag
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADDefaultUserShell' key.
content: If 'true', the system enables the 'ADDefaultUserShell' key.
- key: ADDefaultUserShell
title: ADDefaultUserShell
type: <string>
@@ -145,7 +153,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADMapUIDAttribute' key.
content: If 'true', the system enables the 'ADMapUIDAttribute' key.
- key: ADMapUIDAttribute
title: ADMapUIDAttribute
type: <string>
@@ -156,7 +164,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADMapGIDAttribute' key.
content: If 'true', the system enables the 'ADMapGIDAttribute' key.
- key: ADMapGIDAttribute
title: ADMapGIDAttribute
type: <string>
@@ -167,7 +175,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADMapGGIDAttributeFlag' key.
content: If 'true', the system enables the 'ADMapGGIDAttributeFlag' key.
- key: ADMapGGIDAttribute
title: ADMapGGIDAttribute
type: <string>
@@ -178,7 +186,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADPreferredDCServer' key.
content: If 'true', the system enables the 'ADPreferredDCServer' key.
- key: ADPreferredDCServer
title: ADPreferredDCServer
type: <string>
@@ -189,12 +197,12 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADDomainAdminGroupList' key.
content: If 'true', the system enables the 'ADDomainAdminGroupList' key.
- key: ADDomainAdminGroupList
title: ADDomainAdminGroupList
type: <array>
presence: optional
content: The list of Active Directory groups that are granted admin access.
content: The list of Active Directory groups with admin access.
subkeys:
- key: ADDomainAdminGroupListItem
type: <string>
@@ -203,7 +211,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADNamespace' key.
content: If 'true', the system enables the 'ADNamespace' key.
- key: ADNamespace
title: ADNamespace
type: <string>
@@ -217,7 +225,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADPacketSign' key.
content: If 'true', the system enables the 'ADPacketSign' key.
- key: ADPacketSign
title: ADPacketSign
type: <string>
@@ -228,7 +236,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADPacketEncrypt' key.
content: If 'true', the system enables the 'ADPacketEncrypt' key.
- key: ADPacketEncrypt
title: ADPacketEncrypt
type: <string>
@@ -239,7 +247,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADRestrictDDNS' key.
content: If 'true', the system enables the 'ADRestrictDDNS' key.
- key: ADRestrictDDNS
title: ADRestrictDDNS
supportedOS:
@@ -247,8 +255,8 @@ payloadkeys:
introduced: '10.8'
type: <array>
presence: optional
content: An array of strings representing the interfaces that are allowed for dynamic
DNS updates (for example, en0, en1, and so on).
content: An array of strings that represent the interfaces allowed for dynamic DNS
updates, such as en0 and en1.
subkeys:
- key: ADRestrictDDNSItem
type: <string>
@@ -257,10 +265,10 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If true, enables the 'ADTrustChangePassIntervalDays 'key.
content: If 'true', the system enables the 'ADTrustChangePassIntervalDays 'key.
- key: ADTrustChangePassIntervalDays
title: ADTrustChangePassIntervalDays
type: <integer>
presence: optional
content: The number of days before requiring a change of the computer trust account
password. '0' disables the feature.
password. Set to '0' to disable the feature.
mdm/profiles/com.apple.DiscRecording.yaml
+12 -4
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.DiscRecording
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: BurnSupport
type: <string>
@@ -22,8 +30,8 @@ payloadkeys:
- authenticate
- 'on'
content: |-
If 'off', disables disc burning.
Configure disc-burn. Allowed values:
If 'on', allows normal default operation. Setting this key to 'on' doesn't enable disc burn support if it has already been disabled by other mechanisms or preferences. It also must be enabled with the Finder profile.
If 'authenticate', requires authentication.
* 'off': The system disables disc burning.
* 'on': The system allows normal default operation. Setting this key to 'on' doesn't enable disc burn support if other mechanisms or preferences disabled it. Needs to be enabled with the Finder profile
* 'authenticate': The system requires authentication.
mdm/profiles/com.apple.MCX(Accounts).yaml
+11 -3
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: EnableGuestAccount
supportedOS:
@@ -21,7 +29,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the guest account.
content: If 'true', the system enables the guest account.
- key: DisableGuestAccount
supportedOS:
macOS:
@@ -29,5 +37,5 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', disables the guest account. This property has no effect if 'EnableGuestAccount'
is 'true'.
content: If 'true', the system disables the guest account. This property has no
effect if 'EnableGuestAccount' is 'true'.
mdm/profiles/com.apple.MCX(EnergySaver).yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: com.apple.EnergySaver.desktop.ACPower
type: <dictionary>
mdm/profiles/com.apple.MCX(FileVault2).yaml
+11 -3
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,18 +15,24 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: The FileVault accounts payload sets up options for enabling FileVault.
payloadkeys:
- key: dontAllowFDEDisable
type: <boolean>
presence: optional
default: false
content: Set to 'true' to prevent FileVault from being disabled.
content: If 'true', the system won't disable FileVault.
- key: dontAllowFDEEnable
type: <boolean>
presence: optional
default: false
content: Set to 'true' to prevent FileVault from being enabled.
content: If 'true', the system won't enable FileVault.
- key: DestroyFVKeyOnStandby
supportedOS:
macOS:
@@ -32,4 +40,4 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: Set to 'true' to prevent storing the FileVault key across restarts.
content: If 'true', the system won't store th FileVault key across restarts.
mdm/profiles/com.apple.MCX(Mobililty).yaml
+20 -11
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,36 +15,43 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Sets up mobile account options for network based user accounts.
payloadkeys:
- key: com.apple.cachedaccounts.CreateAtLogin
type: <boolean>
presence: optional
default: false
content: If 'true', creates the mobile account at login time.
content: If 'true', the system creates the mobile account at login time.
- key: com.apple.cachedaccounts.WarnOnCreate
type: <boolean>
presence: optional
default: false
content: If 'true', asks the user if the mobile account should be created and allow
the user to not create it.
content: If 'true', the system asks the user whether to create the mobile account
and it allows the user to not create it.
- key: cachedaccounts.WarnOnCreate.allowNever
type: <boolean>
presence: optional
default: false
content: If 'true', allows the user to stop the prompts about mobile account creation
every time the user logs in. This key is only valid if 'com.apple.cachedaccounts.WarnOnCreate'
is set to 'true'.
content: If 'true', the system allows the user to stop the prompts about mobile
account creation every time the user logs in. This key is only valid if 'com.apple.cachedaccounts.WarnOnCreate'
is 'true'.
- key: cachedaccounts.expiry.delete.disusedSeconds
type: <integer>
presence: optional
default: -1
content: |-
The minimum number of seconds a mobile account can exist before an automatic attempt is made to remove the mobile account.
Set to '0' to try to remove it at next login or logout time. Set to '-1' to never try to remove the mobile account.
content: The minimum number of seconds a mobile account can exist before the system
makes an automatic attempt to remove the mobile account. Set to '0' to attempt
removing it at the next login or logout. Set to '-1' to never attempt removing
the mobile account.
- key: cachedaccounts.askForSecureTokenAuthBypass
type: <boolean>
presence: optional
default: false
content: If 'true', bypasses the secure token authorization dialog. This dialog
only appears on APFS volumes.
content: If 'true', the system bypasses the secure token authorization dialog. This
dialog only appears on APFS volumes.
mdm/profiles/com.apple.MCX(TimeServer).yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.12.4
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Settings for time zone and server. If multiple profiles with this payload
are sent, the device's time server will be set to the value in the last payload
installed. Removing the payload will not change the settings back to the prior
mdm/profiles/com.apple.MCX(WiFi).yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: RequireAdminForIBSS
supportedOS:
mdm/profiles/com.apple.MCX.FileVault2.yaml
+19 -8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.MCX.FileVault2
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: The FileVault payload only works on macOS to enable or disable FileVault.
Starting with macOS 10.15, this payload requires UAMDM to enable FileVault.
payloadkeys:
@@ -31,25 +39,27 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', defers enabling FileVault until the designated user logs out.
For details, see 'fdesetup(8)'. Only a local user or a mobile account user can
enable FileVault.
content: If 'true', the system defers enabling FileVault until the designated user
logs out. For details, see 'fdesetup(8)'. Only a local user or a mobile account
user can enable FileVault.
- key: UserEntersMissingInfo
type: <boolean>
presence: optional
default: false
content: If 'true', enables a prompt for missing user name or password fields.
content: If 'true', the system enables a prompt for missing user name or password
fields.
- key: UseRecoveryKey
type: <boolean>
presence: optional
default: true
content: If 'true', creates a personal recovery key and displays it to the user.
content: If 'true', the system creates a personal recovery key and displays it to
the user.
- key: ShowRecoveryKey
type: <boolean>
presence: optional
default: true
content: If 'false', prevents display of the personal recovery key to the user after
the system enables FileVault.
content: If 'false', the system prevents display of the personal recovery key to
the user after the system enables FileVault.
- key: OutputPath
type: <string>
presence: optional
@@ -97,7 +107,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', prevents requests to enable FileVault at user logout time.
content: If 'true', the system prevents requests to enable FileVault at user logout
time.
- key: ForceEnableInSetupAssistant
supportedOS:
macOS:
mdm/profiles/com.apple.MCX.TimeMachine.yaml
+8
View File
@@ -2,6 +2,8 @@ title: Time Machine
payload:
payloadtype: com.apple.MCX.TimeMachine
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -12,6 +14,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: AutoBackup
type: <boolean>
mdm/profiles/com.apple.ManagedClient.preferences.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.ManagedClient.preferences
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: PreferenceDomain
type: <dictionary>
mdm/profiles/com.apple.NSExtension.yaml
+13 -5
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.NSExtension
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Specifies which NSExtension extensions are to be allowed or disallowed
on a system. Extensions can be managed by bundleID allow/deny lists and "extension
points".
@@ -20,7 +28,7 @@ payloadkeys:
- key: AllowedExtensions
type: <array>
presence: optional
content: An array of identifiers for extensions that are allowed to run on the system.
content: An array of bundle identifiers for allowed extensions.
subkeys:
- key: AllowedExtensionsItem
type: <string>
@@ -29,8 +37,8 @@ payloadkeys:
- key: DeniedExtensions
type: <array>
presence: optional
content: An array of identifiers for extensions that aren't allowed to run on the
system.
content: An array of bundle identifiers for extensions that the system doesn't allow
to run.
subkeys:
- key: DeniedExtensionsItem
type: <string>
@@ -39,8 +47,8 @@ payloadkeys:
- key: DeniedExtensionPoints
type: <array>
presence: optional
content: An array of extension points for extensions that aren't allowed to run
on the system.
content: An array of extension points for extensions that the system doesn't allow
to run.
subkeys:
- key: DeniedExtensionPointsItem
type: <string>
mdm/profiles/com.apple.SetupAssistant.managed.yaml
+6
View File
@@ -24,6 +24,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: On macOS, this payload can specify Setup Assistant options for either the
system or particular users.
payloadkeys:
mdm/profiles/com.apple.ShareKitHelper.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.ShareKitHelper
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
deprecated: '10.12'
@@ -14,6 +16,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: macOS only. Specifies which ShareKit plugin can be accessed on client.
Both allow and disallow lists can be specified.
payloadkeys:
mdm/profiles/com.apple.SoftwareUpdate.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Software Update Managed Settings
payload:
payloadtype: com.apple.SoftwareUpdate
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Software update catalog options.
payloadkeys:
- key: CatalogURL
mdm/profiles/com.apple.SystemConfiguration.yaml
+8
View File
@@ -2,6 +2,8 @@ title: Network Proxy Configuration
payload:
payloadtype: com.apple.SystemConfiguration
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -12,6 +14,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: Proxies
type: <dictionary>

Some files were not shown because too many files have changed in this diff Show More