CalvinBackup/apple_device-management
1
0
Fork 0
mirror of https://github.com/apple/device-management.git synced 2026-08-28 11:00:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Release_iOS-17-4_macOS-14-4

Browse Source
This commit is contained in:
Cyrus Daboo
2024-03-05 17:52:42 -05:00
parent 1cb86e0e35
commit 39e2a82234
298 changed files with 4811 additions and 1280 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mdm/commands/account.configuration.yaml
+8
View File
@@ -4,6 +4,8 @@ description: This command can be sent to the device to have it create the local
payload:
requesttype: AccountConfiguration
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
accessrights: None
@@ -12,6 +14,12 @@ payload:
requiresdep: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: When a macOS (v10.11 and later) device is configured via DEP to enroll
in an MDM server and the DEP profile has the await_device_configuration flag set
to true, the AccountConfiguration command can be sent to the device to have it
mdm/commands/application.extensions.listactive.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Returns information about the active NSExtensions for a particular
payload:
requesttype: ActiveNSExtensions
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
accessrights: QueryInstalledApps
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
Returns information about the active NSExtensions for a particular user.
NSExtensions are installed and enabled at the user level. There is no concept of "device" NSExtensions.
mdm/commands/application.extensions.mappings.yaml
+8
View File
@@ -3,6 +3,8 @@ description: This command returns information about installed extensions for a u
payload:
requesttype: NSExtensionMappings
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
accessrights: QueryInstalledApps
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
This command returns information about installed extensions for a user.
The purpose of this command is to allow the server to build a mapping of
mdm/commands/application.install.enterprise.yaml
+8
View File
@@ -5,6 +5,8 @@ description: This command allows the server to install enterprise applications o
payload:
requesttype: InstallEnterpriseApplication
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.13.6
accessrights: AllowAppInstallation
@@ -13,6 +15,12 @@ payload:
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to install an application on a device. It
provides a more secure version of 'InstallApplication' that specifies a 'ManifestURL'.
payloadkeys:
mdm/commands/application.install.yaml
+18
View File
@@ -33,6 +33,13 @@ payload:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowAppInstallation
@@ -212,6 +219,8 @@ payloadkeys:
introduced: '16.4'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -226,6 +235,8 @@ payloadkeys:
introduced: '17.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -243,6 +254,9 @@ payloadkeys:
introduced: '11.0'
userenrollment:
mode: forbidden
visionOS:
userenrollment:
mode: forbidden
type: <string>
presence: optional
rangelist:
@@ -263,6 +277,8 @@ payloadkeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -280,6 +296,8 @@ payloadkeys:
introduced: '11.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
mdm/commands/application.installed.list.yaml
+26 -2
View File
@@ -26,6 +26,13 @@ payload:
introduced: '10.2'
accessrights: AllowQueryApplications
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowQueryApplications
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowQueryApplications
@@ -85,6 +92,7 @@ payloadkeys:
- BetaApp
- BundleSize
- DeviceBasedVPP
- DistributorIdentifier
- DynamicSize
- ExternalVersionIdentifier
- HasUpdateAvailable
@@ -123,6 +131,22 @@ responsekeys:
content: |-
The app's external version identifier, which you can use in the iTunes Search API to determine if an updated version of the app is available. Compare this value to the 'externalId' value in the 'contentMetadataLookupUrl' response from the 'VPPServiceConfigSrv' endpoint. If these values don't match, an updated version of the app may be available.
A newer version of an app might not be available for installation on the device for a variety of reasons. A common reason is that the device's operating system version or hardware is incompatible with the available version of the app.
- key: DistributorIdentifier
supportedOS:
iOS:
introduced: '17.4'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The marketplace hosted application's distributor ID. This value is
available in iOS 17.4 and later.
- key: Version
type: <string>
presence: optional
@@ -272,5 +296,5 @@ responsekeys:
- key: Source
type: <string>
presence: optional
content: Source of the application. This value will be set to "Declarative Device
Management" when the app is managed by Declarative Device Management.
content: The source of the application. When the app is managed by Declarative
Device Management this value is 'Declarative Device Management'.
mdm/commands/application.invitetoprogram.yaml
+6
View File
@@ -22,6 +22,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows a server to invite a user to join a program. This command
issues the invitation, but does not allow the server to monitor whether the user
has joined the program. This command is supported in the user channel. This command
mdm/commands/application.managed.list.yaml
+7
View File
@@ -28,6 +28,13 @@ payload:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowAppInstallation
mdm/commands/application.redemptioncode.yaml
+8
View File
@@ -13,6 +13,14 @@ payload:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: If a redemption code is needed during app installation, the server can
use this command to complete the app installation.
payloadkeys:
mdm/commands/application.remove.yaml
+7
View File
@@ -25,6 +25,13 @@ payload:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowAppInstallation
mdm/commands/application.validate.yaml
+11
View File
@@ -15,10 +15,21 @@ payload:
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: n/a
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: n/a
content: This command allows the server to query for installed 3rd party applications.
payloadkeys:
- key: Identifiers
mdm/commands/certificate.list.yaml
+7
View File
@@ -32,6 +32,13 @@ payload:
introduced: '6.0'
accessrights: AllowInspection
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowInspection
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowInspection
mdm/commands/declarativemanagement.yaml
+6
View File
@@ -27,6 +27,12 @@ payload:
introduced: '16.0'
supervised: false
requiresdep: false
visionOS:
introduced: '1.1'
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
supervised: false
mdm/commands/device.activationlock.bypasscode.yaml
+6
View File
@@ -21,6 +21,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Retrieves the Activation Lock bypass code from the device. This bypass
code is only available for 15 days after supervision.
responsekeys:
mdm/commands/device.activationlock.clearbypasscode.yaml
+6
View File
@@ -21,4 +21,10 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Clears the Activation Lock bypass code from the device.
mdm/commands/device.configured.yaml
+4
View File
@@ -27,5 +27,9 @@ payload:
introduced: '10.2'
accessrights: None
supervised: true
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Informs the device that it can continue past DEP enrollment. Only works
on devices in DEP that have their cloud configuration set to await configuration.
mdm/commands/device.erase.yaml
+17
View File
@@ -27,6 +27,13 @@ payload:
introduced: '10.2'
accessrights: AllowDeviceErase
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowDeviceErase
supervised: false
requiresdep: false
userenrollment:
mode: forbidden
watchOS:
introduced: '10.0'
accessrights: AllowDeviceErase
@@ -42,6 +49,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
@@ -57,6 +66,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -73,6 +84,8 @@ payloadkeys:
introduced: '10.8'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -87,6 +100,8 @@ payloadkeys:
introduced: '12.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -117,6 +132,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
mdm/commands/device.esim.yaml
+8
View File
@@ -15,6 +15,14 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
Instructs the device to query for active cellular plan eSIM "profiles" (not a profile in the MDM sense)
at the designated carrier eSIM server URL. This command is only supported on cellular devices, and only
mdm/commands/device.lock.yaml
+4
View File
@@ -23,6 +23,10 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: '10.0'
accessrights: AllowPasscodeRemovalAndLock
mdm/commands/device.lostmode.disable.yaml
+8
View File
@@ -14,4 +14,12 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to take the device out of MDM lost mode.
mdm/commands/device.lostmode.enable.yaml
+8
View File
@@ -15,6 +15,14 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to put the device in MDM lost mode, with
a message, phone number, and footnote text. A message or phone number must be
provided.
mdm/commands/device.lostmode.location.yaml
+8
View File
@@ -15,6 +15,14 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
responsekeys:
- key: Latitude
type: <real>
mdm/commands/device.lostmode.playsound.yaml
+8
View File
@@ -16,6 +16,14 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to tell the device to play a sound if it
is in MDM Lost Mode. The sound will play until the device is either removed from
Lost Mode or a user disables the sound from the device.
mdm/commands/device.restart.yaml
+4
View File
@@ -27,6 +27,10 @@ payload:
introduced: '10.2'
accessrights: AllowPasscodeRemovalAndLock
supervised: true
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command requires the Device Lock access right. The device will restart
immediately.
payloadkeys:
mdm/commands/device.restrictions.clearpassword.yaml
+8
View File
@@ -13,3 +13,11 @@ payload:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
mdm/commands/device.restrictions.list.yaml
+9
View File
@@ -16,10 +16,19 @@ payload:
userchannel: true
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: '6.1'
accessrights: AllowQueryRestrictions
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowQueryRestrictions
supervised: false
requiresdep: false
userenrollment:
mode: forbidden
watchOS:
introduced: '10.0'
accessrights: AllowQueryRestrictions
mdm/commands/device.shutdown.yaml
+6
View File
@@ -23,5 +23,11 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command requires the Device Lock access right. The device will shut
down immediately.
mdm/commands/information.contentcaching.yaml
+8
View File
@@ -4,6 +4,8 @@ description: This command allows the server to query for information about Conte
payload:
requesttype: ContentCachingInformation
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.15.4
accessrights: AllowQueryNetworkInformation
@@ -12,6 +14,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to query for information about Content Caching.
responsekeys:
- key: StatusResponse
mdm/commands/information.device.yaml
+528 -179
View File
File diff suppressed because it is too large Load Diff
mdm/commands/information.security.yaml
+57
View File
@@ -27,6 +27,13 @@ payload:
introduced: '6.0'
accessrights: AllowQuerySecurity
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowQuerySecurity
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowQuerySecurity
@@ -58,6 +65,9 @@ responsekeys:
mode: forbidden
macOS:
introduced: n/a
visionOS:
userenrollment:
mode: forbidden
type: <boolean>
content: If 'true', the device has a passcode. This value is available in iOS
4 and later, and tvOS 6 and later.
@@ -76,6 +86,9 @@ responsekeys:
mode: forbidden
macOS:
introduced: n/a
visionOS:
userenrollment:
mode: forbidden
type: <boolean>
content: If 'true', the user's passcode is compliant with requirements from profiles.
This key doesn't apply to User-Enrolled devices. This value is available in
@@ -88,6 +101,9 @@ responsekeys:
mode: forbidden
macOS:
introduced: n/a
visionOS:
userenrollment:
mode: forbidden
type: <integer>
content: The user preference for the number of seconds before a locked screen
requires the device passcode to unlock it. This value is only available for
@@ -100,6 +116,9 @@ responsekeys:
mode: forbidden
macOS:
introduced: n/a
visionOS:
userenrollment:
mode: forbidden
type: <integer>
content: The enforced value for the number of seconds before a locked screen requires
the device passcode to unlock it. If a device has a passcode, changing 'PasscodeLockGracePeriod'
@@ -117,6 +136,8 @@ responsekeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <integer>
@@ -131,6 +152,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -147,6 +170,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -163,6 +188,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -179,6 +206,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <data>
@@ -197,6 +226,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -216,6 +247,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -230,6 +263,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -291,6 +326,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -325,6 +362,8 @@ responsekeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -336,6 +375,8 @@ responsekeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -357,6 +398,8 @@ responsekeys:
introduced: '10.15'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -371,6 +414,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -427,6 +472,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -441,6 +488,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -457,6 +506,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -478,6 +529,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -495,6 +548,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -512,6 +567,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
mdm/commands/lom.devicerequest.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Issues LOM requests to devices.
payload:
requesttype: LOMDeviceRequest
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
accessrights: DeviceLockAndRemovePasscode
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Used to send LOM requests ("PowerON", "PowerOFF", "Reset") to LOM Controller
which then forwards the request to LOM Devices.
payloadkeys:
mdm/commands/lom.setuprequest.yaml
+8
View File
@@ -4,6 +4,8 @@ description: Queries the device for LOM setup information such as IP addresses,
payload:
requesttype: LOMSetupRequest
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
accessrights: DeviceLockAndRemovePasscode
@@ -12,6 +14,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Queries the device for LOM setup information such as IP addresses, protocol
version, etc. The MDM server must send this command prior to sending the LOMDeviceRequest
command.
mdm/commands/managed.application.attributes.yaml
+13
View File
@@ -15,10 +15,19 @@ payload:
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: n/a
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowAppInstallation
@@ -143,6 +152,8 @@ responsekeys:
introduced: '16.4'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -158,6 +169,8 @@ responsekeys:
introduced: '17.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
mdm/commands/managed.application.configuration.yaml
+7
View File
@@ -30,6 +30,13 @@ payload:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowAppInstallation
mdm/commands/managed.application.feedback.yaml
+9
View File
@@ -26,6 +26,15 @@ payload:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: n/a
content: This command queries the device for application feedback information. This
command requires the App Management right. The response will not include apps
that are managed by Declarative Device Management.
mdm/commands/media.install.yaml
+6
View File
@@ -23,6 +23,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to install a book on a device. If the book
is already being managed, this command will update the book.
payloadkeys:
mdm/commands/media.managed.list.yaml
+8
View File
@@ -14,6 +14,14 @@ payload:
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to query for installed 3rd party applications.
responsekeys:
- key: Books
mdm/commands/media.remove.yaml
+8
View File
@@ -15,6 +15,14 @@ payload:
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows an MDM server to remove managed media. This command
returns Acknowledged even if the item is not found.
payloadkeys:
mdm/commands/mirroring.request.yaml
+6
View File
@@ -22,6 +22,12 @@ payload:
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command prompts the user to share their screen using AirPlay Mirroring.
payloadkeys:
- key: DestinationName
mdm/commands/mirroring.stop.yaml
+6
View File
@@ -22,4 +22,10 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command stops AirPlay mirroring.
mdm/commands/passcode.clear.yaml
+11
View File
@@ -13,6 +13,17 @@ payload:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: '1.1'
accessrights: AllowPasscodeRemovalAndLock
supervised: false
requiresdep: false
userenrollment:
mode: forbidden
watchOS:
introduced: '10.0'
accessrights: AllowPasscodeRemovalAndLock
mdm/commands/passcode.firmware.set.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Changes or clears the firmware password for the device.
payload:
requesttype: SetFirmwarePassword
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
accessrights: DeviceLockAndRemovePasscode
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Changes or clears the firmware password for the device. Requires the "Device
lock and passcode removal right". This command is not available on Apple silicon
devices.
mdm/commands/passcode.firmware.verify.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Verifies the device's firmware password.
payload:
requesttype: VerifyFirmwarePassword
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
accessrights: None
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Verifies the device's firmware password. This command is not available
on Apple silicon devices.
payloadkeys:
mdm/commands/passcode.recovery.set.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Sets or clears the recovery lock password (AppleSilicon devices onl
payload:
requesttype: SetRecoveryLock
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.5'
accessrights: DeviceLockAndRemovePasscode
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Sets or clears the recovery lock password (Apple Silicon devices only).
Requires the "Device lock and passcode removal right".
payloadkeys:
mdm/commands/passcode.recovery.verify.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Verifies the device's recovery lock password. (AppleSilicon devices
payload:
requesttype: VerifyRecoveryLock
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.5'
accessrights: DeviceLockAndRemovePasscode
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Verifies the device's recovery lock password. (AppleSilicon devices only)
payloadkeys:
- key: Password
mdm/commands/passcode.unlocktoken.yaml
+8
View File
@@ -13,6 +13,14 @@ payload:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command requests an UnlockToken from the device. Pass this token to
the ClearPasscode command to unlock the device.
responsekeys:
mdm/commands/profile.install.yaml
+7
View File
@@ -29,6 +29,13 @@ payload:
introduced: '6.0'
accessrights: AllowInstallationRemoval
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowInstallationRemoval
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowInstallationRemoval
mdm/commands/profile.list.yaml
+7
View File
@@ -28,6 +28,13 @@ payload:
introduced: '6.0'
accessrights: AllowInspection
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowInspection
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowInspection
mdm/commands/profile.provisioning.install.yaml
+8 -1
View File
@@ -29,13 +29,20 @@ payload:
introduced: '10.2'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
content: This command allows the server to install a provisioning profile. No error
occurs if the provisioning profile is already installed. This command requires
the Provisioning Profile Installation and Removal right. On macOS, this command
the Provisioning Profile Installation and Removal right. On macOS, this command
is for iOS and iPadOS style provisioning profiles only.
payloadkeys:
- key: ProvisioningProfile
mdm/commands/profile.provisioning.list.yaml
+7
View File
@@ -29,6 +29,13 @@ payload:
introduced: '10.2'
accessrights: AllowProvisioningInspection
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowProvisioningInspection
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowProvisioningInspection
mdm/commands/profile.provisioning.remove.yaml
+7
View File
@@ -28,6 +28,13 @@ payload:
introduced: '10.2'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowProvisioningInstallationRemoval
mdm/commands/profile.remove.yaml
+7
View File
@@ -27,6 +27,13 @@ payload:
introduced: '6.0'
accessrights: AllowInstallationRemoval
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowInstallationRemoval
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowInstallationRemoval
mdm/commands/remotedesktop.disable.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Disable Remote Desktop on the device.
payload:
requesttype: DisableRemoteDesktop
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.14.4
devicechannel: true
@@ -11,4 +13,10 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Disable Remote Desktop.
mdm/commands/remotedesktop.enable.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Enable Remote Desktop on the device.
payload:
requesttype: EnableRemoteDesktop
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.14.4
devicechannel: true
@@ -11,4 +13,10 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Enable Remote Desktop.
mdm/commands/rotate.file.vault.key.yaml
+8
View File
@@ -3,6 +3,8 @@ description: This command allows for changing a device's FileVaultMaster passwor
payload:
requesttype: RotateFileVaultKey
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
accessrights: DeviceLockAndRemovePasscode
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows for changing a device's FileVaultMaster password.
payloadkeys:
- key: KeyType
mdm/commands/set.auto.admin.password.yaml
+8
View File
@@ -4,6 +4,8 @@ description: Allows changing the password of a local admin account that was crea
payload:
requesttype: SetAutoAdminPassword
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
accessrights: None
@@ -12,6 +14,12 @@ payload:
requiresdep: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Allows changing the password of a local admin account that was created
by Setup Assistant during DEP enrollment via the AccountConfiguration command.
payloadkeys:
mdm/commands/settings.yaml
+56 -4
View File
@@ -26,6 +26,13 @@ payload:
introduced: '6.0'
accessrights: AllowSettings
supervised: false
visionOS:
introduced: '1.1'
accessrights: AllowSettings
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: AllowSettings
@@ -54,6 +61,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -82,9 +91,12 @@ payloadkeys:
- 3
content: |-
A number that indicates where to use the wallpaper, which is one of the following values:
* '1': Lock screen
* '2': Home screen
* '3': Lock and Home screens
* '3': Both lock and home screens.
In iOS 16 and later, and iPadOS 17 and later, when you set the wallpaper for the first time, the system sets both the lock screen and home screen. After that, you can separately set each location.
- key: DataRoaming
supportedOS:
iOS:
@@ -98,6 +110,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -131,6 +145,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -165,6 +181,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -200,6 +218,8 @@ payloadkeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -236,6 +256,8 @@ payloadkeys:
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
visionOS:
accessrights: AllowAppInstallation
watchOS:
accessrights: AllowAppInstallation
type: <dictionary>
@@ -282,6 +304,8 @@ payloadkeys:
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
visionOS:
accessrights: AllowAppInstallation
watchOS:
accessrights: AllowAppInstallation
type: <dictionary>
@@ -393,6 +417,8 @@ payloadkeys:
introduced: '16.4'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -407,6 +433,8 @@ payloadkeys:
introduced: '17.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
@@ -428,6 +456,8 @@ payloadkeys:
introduced: '10.10'
userenrollment:
mode: forbidden
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -456,6 +486,8 @@ payloadkeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -551,6 +583,8 @@ payloadkeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -588,6 +622,8 @@ payloadkeys:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
@@ -600,6 +636,8 @@ payloadkeys:
introduced: '11.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
@@ -626,6 +664,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -662,6 +702,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -785,9 +827,7 @@ payloadkeys:
content: |-
The number of seconds before a locked screen requires the user to enter the device passcode to unlock it. The minimum value is '0' seconds and the maximum value is '14400' seconds.
If a device has a passcode, a change to a larger value doesn't take effect until the user logs out or removes the passcode. For this reason, it's better to set this value before the user sets a passcode.
If the value set is less than one of the known
values, the next lowest value will be used. For example a value of 299 will
result in an effective setting of 60.
If the value set is less than one of the known values, the next lowest value will be used. For example a value of 299 will result in an effective setting of 60.
This setting won't take effect if 'TemporarySessionOnly' is 'true' because there's no passcode for a temporary session.
- key: AutoLockTime
type: <integer>
@@ -808,6 +848,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -841,6 +883,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -875,6 +919,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -922,6 +968,8 @@ payloadkeys:
tvOS:
introduced: '14.0'
supervised: true
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -957,6 +1005,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
@@ -999,6 +1049,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
supervised: true
type: <dictionary>
mdm/commands/system.update.available.yaml
+4
View File
@@ -29,6 +29,10 @@ payload:
devicechannel: true
supervised: true
requiresdep: false
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Queries the device for a list of available OS updates. On OS X, a ScheduleOSUpdateScan
must be performed to update the results returned by this query.
responsekeys:
mdm/commands/system.update.scan.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Requests that the device perform a background scan for OS updates.
payload:
requesttype: ScheduleOSUpdateScan
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
accessrights: None
@@ -12,6 +14,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Requests that the device perform a background scan for OS updates.
payloadkeys:
- key: Force
mdm/commands/system.update.schedule.yaml
+4
View File
@@ -29,6 +29,10 @@ payload:
devicechannel: true
supervised: true
requiresdep: false
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to schedule an OS update.
payloadkeys:
- key: Updates
mdm/commands/system.update.status.yaml
+4
View File
@@ -29,6 +29,10 @@ payload:
devicechannel: true
supervised: true
requiresdep: false
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Queries the device for the status of software updates.
responsekeys:
- key: OSUpdateStatus
mdm/commands/user.configured.yaml
+8
View File
@@ -15,6 +15,14 @@ payload:
userchannel: true
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Informs the device that it can continue past Setup Assistant and finish
login. Only works on Shared iPads that have the AwaitUserConfiguration feature
enabled.
mdm/commands/user.delete.yaml
+9 -2
View File
@@ -24,13 +24,20 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to delete a user that has an active account
on the device.
payloadkeys:
- key: UserName
type: <string>
presence: required
content: The user name of the account to delete.
presence: optional
content: The user name of the account to delete. This key is required when the value
for DeleteAllUsers is absent or false.
- key: ForceDeletion
supportedOS:
macOS:
mdm/commands/user.list.yaml
+6
View File
@@ -24,6 +24,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to query for a list of users that have an
active account on the device.
responsekeys:
mdm/commands/user.logout.yaml
+8
View File
@@ -14,4 +14,12 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to force the current user to logout.
mdm/commands/user.unlock.yaml
+8
View File
@@ -3,6 +3,8 @@ description: This command allows the server to unlock a local user account.
payload:
requesttype: UnlockUserAccount
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
accessrights: DeviceLockAndRemovePasscode
@@ -11,6 +13,12 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This command allows the server to unlock a local user account that has
been locked due to too many failed password attempts. Requires "Device lock and
passcode removal right".