CalvinBackup/apple_device-management
1
0
Fork 0
mirror of https://github.com/apple/device-management.git synced 2026-08-27 18:40:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

Release_iOS-17-4_macOS-14-4

Browse Source
This commit is contained in:
Cyrus Daboo
2024-03-05 17:52:42 -05:00
parent 1cb86e0e35
commit 39e2a82234
298 changed files with 4811 additions and 1280 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mdm/profiles/CommonPayloadKeys.yaml
+7
View File
@@ -29,6 +29,13 @@ payload:
multiple: false
supervised: false
allowmanualinstall: true
visionOS:
introduced: '1.0'
multiple: false
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: '1.0'
multiple: false
mdm/profiles/GlobalPreferences.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: .GlobalPreferences
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Global preferences on macOS
payloadkeys:
- key: MultipleSessionEnabled
mdm/profiles/TopLevel.yaml
+14 -1
View File
@@ -29,6 +29,13 @@ payload:
multiple: false
supervised: false
allowmanualinstall: true
visionOS:
introduced: '1.0'
multiple: false
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: '1.0'
multiple: false
@@ -110,6 +117,8 @@ payloadkeys:
mode: forbidden
tvOS:
supervised: true
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -159,6 +168,8 @@ payloadkeys:
introduced: '10.15'
tvOS:
introduced: '12.2'
visionOS:
introduced: '1.1'
watchOS:
introduced: '5.2'
type: <integer>
@@ -170,11 +181,12 @@ payloadkeys:
- 3
- 4
- 5
- 6
default: 0
content: |-
The type of platform of the target device. Specifying the platform type helps prevent unintended installations.
For interactive installations on iOS devices, specifying a target platform avoids interstitial alerts that prompt the user to choose a profile target when multiple targets are eligible.
Possible values include:
Allowed values:
* '0': Any/unspecified
* '1': iPhone/iPad/iPod Touch
@@ -182,6 +194,7 @@ payloadkeys:
* '3': HomePod
* '4': Apple TV
* '5': Mac
* '6': Vision Pro
- key: ConsentText
type: <dictionary>
presence: optional
mdm/profiles/com.apple.ADCertificate.managed.yaml
+15 -8
View File
@@ -3,6 +3,8 @@ description: Active Directory Certificate
payload:
payloadtype: com.apple.ADCertificate.managed
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: A certificate can be requested from a Microsoft Certificate Authority (CA)
using DCE/RPC and the Active Directory Certificate profile payload instructions
detailed at support.apple.com/kb/HT5357.
@@ -47,9 +55,7 @@ payloadkeys:
type: <string>
presence: optional
content: |-
The name of the certificate authority (CA). This value is determined from the common name (CN) of the Active Directory entry. Available in macOS 10.8 and later.
Valid values:
The name of the certificate authority (CA), which is determined from the common name (CN) of the Active Directory entry. Available in macOS 10.8 and later. Valid values:
* CN=<your CA Name>
* CN='Certification Authorities'
* CN='Public Key Services'
@@ -83,9 +89,10 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', the user is prompted for credentials when the profile is installed.
This key applies only to user certificates with the Manual Download profile delivery
method. Omit this key for computer certificates. Available in macOS 10.8 and later.
content: If 'true', the system prompts the user for credentials when is installs
the profile. This key applies only to user certificates with the Manual Download
profile delivery method. Omit this key for computer certificates. Available in
macOS 10.8 and later.
- key: KeyIsExtractable
title: Key Is Extractable
supportedOS:
@@ -94,8 +101,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', allows exporting the private key. Available in macOS 10.10 and
later.
content: If 'true', the system allows exporting the private key. Available in macOS
10.10 and later.
- key: Keysize
title: Key Size
supportedOS:
mdm/profiles/com.apple.AIM.account.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Use this section to define settings for configuration access to AIM
payload:
payloadtype: com.apple.AIM.account
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
deprecated: '10.13'
@@ -15,6 +17,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: An AIM payload creates an AIM account on the device.
payloadkeys:
- key: AIMAccountDescription
mdm/profiles/com.apple.AssetCache.managed.yaml
+46 -41
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.AssetCache.managed
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.13.4
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Configures the Content Caching service.
payloadkeys:
- key: AllowCacheDelete
@@ -22,9 +30,10 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: |-
Allow the system to purge content from the cache automatically when it needs disk space for other apps (i.e. when free disk space runs low on the computer). Customers who want Content Caching to be as effective as possible should turn this setting off.
Available in macOS 10.15 and later.
content: If true, the system purges content from the cache automatically when it
needs disk space for other apps when free disk space runs low on the computer.
Set to 'false' to maximize effectiveness of Content Caching. Available in macOS
10.15 and later.
- key: AllowPersonalCaching
supportedOS:
macOS:
@@ -33,9 +42,8 @@ payloadkeys:
presence: optional
default: true
content: |-
If 'true', caches the user's iCloud data. Clients may take some time (hours or days) to react to changes to this setting; it doesn't have an immediate effect.
At least one of the 'AllowPersonalCaching' or 'AllowSharedCaching' keys must be 'true'.
If 'true', the system caches the user's iCloud data. Changes to this value don't have an immediate effect. Clients may take some time, such as hours or days, to react to changes.
At least one of the 'AllowPersonalCaching' or 'AllowSharedCaching' keys need to be 'true'.
- key: AllowSharedCaching
supportedOS:
macOS:
@@ -44,9 +52,8 @@ payloadkeys:
presence: optional
default: true
content: |-
If 'true', caches non-iCloud content, such as apps and software updates. Clients may take some time (hours, days) to react to changes to this setting; it does not have an immediate effect.
At least one of the 'AllowPersonalCaching' or 'AllowSharedCaching' keys must be 'true'.
If 'true', the system caches non-iCloud content, such as apps and software updates. Changes to this value don't have an immediate effect. Clients may take some time, such as hours or days, to react to changes.
At least one of the 'AllowPersonalCaching' or 'AllowSharedCaching' keys need to be 'true'.
- key: AutoActivation
supportedOS:
macOS:
@@ -55,8 +62,8 @@ payloadkeys:
presence: optional
default: false
content: |-
If 'true', automatically activates the content cache when possible and prevents it from being disabled. If the 'allowContentCaching' restriction is set to 'false', 'AutoActivation' is also 'false'.
Removing a profile that set 'AutoActivation' to 'true' does not deactivate the Content Cache.
If 'true', the system automatically activates the content cache when possible and prevents disabling it. If 'allowContentCaching' is 'false', 'AutoActivation' is also 'false'.
Removing a profile that set 'AutoActivation' to 'true' doesn't deactivate the Content Cache.
- key: AutoEnableTetheredCaching
supportedOS:
macOS:
@@ -65,7 +72,7 @@ payloadkeys:
presence: optional
default: false
content: |-
Automatically enable Internet connection sharing when possible and prevent disabling Internet connection sharing. 'DenyTetheredCaching' overrides 'AutoEnableTetheredCaching'. Tethered caching requires Content Caching.
If 'true', the system automatically enables Internet connection sharing when possible and prevent disabling Internet connection sharing. 'DenyTetheredCaching' overrides 'AutoEnableTetheredCaching'. Tethered caching requires Content Caching.
Available in macOS 10.15.4 and later.
- key: CacheLimit
supportedOS:
@@ -74,8 +81,8 @@ payloadkeys:
type: <integer>
presence: optional
default: 0
content: The maximum number of bytes of disk space that will be used for the content
cache. A value of 0 means unlimited disk space.
content: The maximum number of bytes of disk space to use for the content cache.
Set to '0' for unlimited disk space.
- key: DataPath
supportedOS:
macOS:
@@ -85,8 +92,7 @@ payloadkeys:
default: /Library/Application Support/Apple/AssetCache/Data
content: |-
The path to the directory used to store cached content. Changing this setting manually doesn't automatically move cached content from the old location to the new one. To move content automatically, use the Sharing preference's Content Caching pane. The value must be (or end with) '/Library/Application Support/Apple/AssetCache/Data'.
A directory and its intermediates are created for the given data path if it doesn't already exist. The directory is owned by '_assetcache:_assetcache' and has mode 0750. Its immediate parent directory ('.../Library/Application Support/Apple/AssetCache') is owned by '_assetcache:_assetcache' and has mode '0755'.
The system creates a directory and its intermediates for the given data path if it doesn't already exist. The directory is owned by '_assetcache:_assetcache' and has mode 0750. Its immediate parent directory ('.../Library/Application Support/Apple/AssetCache') is owned by '_assetcache:_assetcache' and has mode '0755'.
- key: DenyTetheredCaching
supportedOS:
macOS:
@@ -94,7 +100,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', disables tethered caching.
content: If 'true', the system disables tethered caching.
- key: DisplayAlerts
supportedOS:
macOS:
@@ -102,9 +108,10 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: |-
If 'true', Content Caching displays exceptional conditions (alerts) as system notifications in the upper corner of the screen. Alerts were automatically displayed starting in macOS 10.13. In macOS 10.15 the alerts are off by default, but still available via this setting.
Available in macOS 10.15 and later.
content: If 'true', Content Caching displays exceptional conditions (alerts) as
system notifications in the upper corner of the screen. Alerts were automatically
displayed starting in macOS 10.13. In macOS 10.15 the alerts are off by default,
but still available through this setting. Available in macOS 10.15 and later.
- key: KeepAwake
supportedOS:
macOS:
@@ -112,16 +119,18 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: |-
If 'true', prevents the computer from sleeping as long as Content Caching is on (System Preferences > Sharing > Content Caching is on). Customers who want Content Caching to be as available as much as possible should turn this setting on.
Available in macOS 10.15 and later.
content: If 'true', the system prevents the computer from sleeping as long as Content
Caching is on (System Settings > Sharing > Content Caching is on). Customers who
want Content Caching to be as available as much as possible should turn this setting
on. Available in macOS 10.15 and later.
- key: ListenRanges
supportedOS:
macOS:
introduced: 10.13.4
type: <array>
presence: optional
content: An array of dictionaries describing a range of client IP addresses to serve.
content: An array of dictionaries that describe a range of client IP addresses to
serve.
subkeytype: Ranges
subkeys: &id001
- key: RangesItem
@@ -178,8 +187,8 @@ payloadkeys:
default: true
content: If 'true', the content cache offers content to clients only on the same
immediate local network only. No content is offered to clients on other networks
reachable by the content cache. If 'LocalSubnetsOnly' is set to 'true', 'ListenRanges'
will be ignored.
reachable by the content cache. If 'LocalSubnetsOnly' is 'true', the system ignores
'ListenRanges'.
- key: LogClientIdentity
supportedOS:
macOS:
@@ -197,10 +206,10 @@ payloadkeys:
presence: optional
content: An array of the local IP addresses of other content caches that this cache
should download from or upload to, instead of downloading from or uploading to
Apple directly. Invalid addresses and addresses of computers that aren't content
caches are ignored. Parent caches that become unavailable are skipped. If all
parent content caches become unavailable, the content cache downloads from or
uploads to Apple directly, until a parent content cache becomes available again.
Apple directly. The system ignores invalid addresses and addresses of computers
that aren't content caches. The system skips Parent caches that become unavailable.
If all parent content caches become unavailable, the content cache downloads from
or uploads to Apple directly, until a parent content cache becomes available again.
subkeys:
- key: ParentsItem
type: <string>
@@ -220,17 +229,13 @@ payloadkeys:
- sticky-available
default: round-robin
content: |-
The policy to implement when choosing among more than one configured parent content cache. With every policy, parent caches that are temporarily unavailable are skipped.
The policy to implement when choosing among more than one configured parent content cache. With every policy, the system skips parent caches that are temporarily unavailable. Allowed values:
'first-available': Always use the first available parent in the Parents list. Use this policy to designate permanent primary, secondary, and subsequent parents.
'url-path-hash': Hash the path part of the requested URL so that the same parent is always used for the same URL. This is useful for maximizing the size of the combined caches of the parents.
'random': Choose a parent at random. Use this policy for load balancing.
'round-robin': Rotate through the parents in order. Use this policy for load balancing.
'sticky-available': Use the first available parent that is available in the Parents list until it becomes unavailable, then advance to the next one. Use this policy for designating floating primary, secondary, and subsequent parents.
* 'first-available': Always use the first available parent in the Parents list. Use this policy to designate permanent primary, secondary, and subsequent parents.
* 'url-path-hash': Hash the path part of the requested URL so that the same parent is always used for the same URL. This is useful for maximizing the size of the combined caches of the parents.
* 'random': Choose a parent at random. Use this policy for load balancing.
* 'round-robin': Rotate through the parents in order. Use this policy for load balancing.
* 'sticky-available': Use the first available parent in the Parents list until it becomes unavailable, then advance to the next one. Use this policy for designating floating primary, secondary, and subsequent parents.
- key: PeerFilterRanges
supportedOS:
macOS:
@@ -276,7 +281,7 @@ payloadkeys:
presence: optional
default: 0
content: The TCP port number on which the content cache accepts requests for uploads
or downloads. Set the port to 0 to pick a random, available port.
or downloads. Set to '0' to pick a random, available port.
- key: PublicRanges
supportedOS:
macOS:
mdm/profiles/com.apple.Dictionary.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.Dictionary
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Parental controls dictionary restrictions.
payloadkeys:
- key: parentalControl
mdm/profiles/com.apple.DirectoryService.managed.yaml
+35 -27
View File
@@ -3,6 +3,8 @@ description: Directory Service
payload:
payloadtype: com.apple.DirectoryService.managed
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.8'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: In macOS 10.9 and later, a configuration profile can be used to configure
macOS to join an Active Directory (AD) domain. Advanced AD options available via
Directory Utility or the dsconfigad command line tool can also be set using a
@@ -47,7 +55,7 @@ payloadkeys:
title: ADOrganizationalUnit
type: <string>
presence: optional
content: The organizational unit where the joining computer object is added.
content: The organizational unit to add the joining computer object to.
- key: ADMountStyle
title: ADMountStyle
type: <string>
@@ -61,13 +69,13 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADCreateMobileAccountAtLogin' key.
content: If 'true', the system enables the 'ADCreateMobileAccountAtLogin' key.
- key: ADCreateMobileAccountAtLogin
title: ADCreateMobileAccountAtLogin
type: <boolean>
presence: optional
default: false
content: If 'true', creates a mobile account at login.
content: If 'true', the system creates a mobile account at login.
- key: ADWarnUserBeforeCreatingMAFlag
title: ADWarnUserBeforeCreatingMAFlag
supportedOS:
@@ -76,13 +84,13 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADWarnUserBeforeCreatingMA' key.
content: If 'true', the system enables the 'ADWarnUserBeforeCreatingMA' key.
- key: ADWarnUserBeforeCreatingMA
title: ADWarnUserBeforeCreatingMA
type: <boolean>
presence: optional
default: false
content: If 'true', enables the warning before creating the mobile account.
content: If 'true', the system enables the warning before creating the mobile account.
- key: ADForceHomeLocalFlag
title: ADForceHomeLocalFlag
supportedOS:
@@ -91,13 +99,13 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADForceHomeLocal' key.
content: If 'true', the system enables the 'ADForceHomeLocal' key.
- key: ADForceHomeLocal
title: ADForceHomeLocal
type: <boolean>
presence: optional
default: false
content: If 'true', forces a local home directory.
content: If 'true', the system forces a local home directory.
- key: ADUseWindowsUNCPathFlag
title: ADUseWindowsUNCPathFlag
supportedOS:
@@ -106,14 +114,14 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADUseWindowsUNCPath' key.
content: If 'true', the system enables the 'ADUseWindowsUNCPath' key.
- key: ADUseWindowsUNCPath
title: ADUseWindowsUNCPath
type: <boolean>
presence: optional
default: false
content: If 'true', uses the UNC path from Active Directory to derive the network
home location.
content: If 'true', the system uses the UNC path from Active Directory to derive
the network home location.
- key: ADAllowMultiDomainAuthFlag
title: ADAllowMultiDomainAuthFlag
supportedOS:
@@ -122,19 +130,19 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADAllowMultiDomainAuth' key.
content: If 'true', the system enables the 'ADAllowMultiDomainAuth' key.
- key: ADAllowMultiDomainAuth
title: ADAllowMultiDomainAuth
type: <boolean>
presence: optional
default: false
content: If 'true', allows authentication from any domain in the namespace.
content: If 'true', the system allows authentication from any domain in the namespace.
- key: ADDefaultUserShellFlag
title: ADDefaultUserShellFlag
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADDefaultUserShell' key.
content: If 'true', the system enables the 'ADDefaultUserShell' key.
- key: ADDefaultUserShell
title: ADDefaultUserShell
type: <string>
@@ -145,7 +153,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADMapUIDAttribute' key.
content: If 'true', the system enables the 'ADMapUIDAttribute' key.
- key: ADMapUIDAttribute
title: ADMapUIDAttribute
type: <string>
@@ -156,7 +164,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADMapGIDAttribute' key.
content: If 'true', the system enables the 'ADMapGIDAttribute' key.
- key: ADMapGIDAttribute
title: ADMapGIDAttribute
type: <string>
@@ -167,7 +175,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADMapGGIDAttributeFlag' key.
content: If 'true', the system enables the 'ADMapGGIDAttributeFlag' key.
- key: ADMapGGIDAttribute
title: ADMapGGIDAttribute
type: <string>
@@ -178,7 +186,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADPreferredDCServer' key.
content: If 'true', the system enables the 'ADPreferredDCServer' key.
- key: ADPreferredDCServer
title: ADPreferredDCServer
type: <string>
@@ -189,12 +197,12 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADDomainAdminGroupList' key.
content: If 'true', the system enables the 'ADDomainAdminGroupList' key.
- key: ADDomainAdminGroupList
title: ADDomainAdminGroupList
type: <array>
presence: optional
content: The list of Active Directory groups that are granted admin access.
content: The list of Active Directory groups with admin access.
subkeys:
- key: ADDomainAdminGroupListItem
type: <string>
@@ -203,7 +211,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADNamespace' key.
content: If 'true', the system enables the 'ADNamespace' key.
- key: ADNamespace
title: ADNamespace
type: <string>
@@ -217,7 +225,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADPacketSign' key.
content: If 'true', the system enables the 'ADPacketSign' key.
- key: ADPacketSign
title: ADPacketSign
type: <string>
@@ -228,7 +236,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADPacketEncrypt' key.
content: If 'true', the system enables the 'ADPacketEncrypt' key.
- key: ADPacketEncrypt
title: ADPacketEncrypt
type: <string>
@@ -239,7 +247,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADRestrictDDNS' key.
content: If 'true', the system enables the 'ADRestrictDDNS' key.
- key: ADRestrictDDNS
title: ADRestrictDDNS
supportedOS:
@@ -247,8 +255,8 @@ payloadkeys:
introduced: '10.8'
type: <array>
presence: optional
content: An array of strings representing the interfaces that are allowed for dynamic
DNS updates (for example, en0, en1, and so on).
content: An array of strings that represent the interfaces allowed for dynamic DNS
updates, such as en0 and en1.
subkeys:
- key: ADRestrictDDNSItem
type: <string>
@@ -257,10 +265,10 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If true, enables the 'ADTrustChangePassIntervalDays 'key.
content: If 'true', the system enables the 'ADTrustChangePassIntervalDays 'key.
- key: ADTrustChangePassIntervalDays
title: ADTrustChangePassIntervalDays
type: <integer>
presence: optional
content: The number of days before requiring a change of the computer trust account
password. '0' disables the feature.
password. Set to '0' to disable the feature.
mdm/profiles/com.apple.DiscRecording.yaml
+12 -4
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.DiscRecording
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: BurnSupport
type: <string>
@@ -22,8 +30,8 @@ payloadkeys:
- authenticate
- 'on'
content: |-
If 'off', disables disc burning.
Configure disc-burn. Allowed values:
If 'on', allows normal default operation. Setting this key to 'on' doesn't enable disc burn support if it has already been disabled by other mechanisms or preferences. It also must be enabled with the Finder profile.
If 'authenticate', requires authentication.
* 'off': The system disables disc burning.
* 'on': The system allows normal default operation. Setting this key to 'on' doesn't enable disc burn support if other mechanisms or preferences disabled it. Needs to be enabled with the Finder profile
* 'authenticate': The system requires authentication.
mdm/profiles/com.apple.MCX(Accounts).yaml
+11 -3
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: EnableGuestAccount
supportedOS:
@@ -21,7 +29,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables the guest account.
content: If 'true', the system enables the guest account.
- key: DisableGuestAccount
supportedOS:
macOS:
@@ -29,5 +37,5 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', disables the guest account. This property has no effect if 'EnableGuestAccount'
is 'true'.
content: If 'true', the system disables the guest account. This property has no
effect if 'EnableGuestAccount' is 'true'.
mdm/profiles/com.apple.MCX(EnergySaver).yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: com.apple.EnergySaver.desktop.ACPower
type: <dictionary>
mdm/profiles/com.apple.MCX(FileVault2).yaml
+11 -3
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,18 +15,24 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: The FileVault accounts payload sets up options for enabling FileVault.
payloadkeys:
- key: dontAllowFDEDisable
type: <boolean>
presence: optional
default: false
content: Set to 'true' to prevent FileVault from being disabled.
content: If 'true', the system won't disable FileVault.
- key: dontAllowFDEEnable
type: <boolean>
presence: optional
default: false
content: Set to 'true' to prevent FileVault from being enabled.
content: If 'true', the system won't enable FileVault.
- key: DestroyFVKeyOnStandby
supportedOS:
macOS:
@@ -32,4 +40,4 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: Set to 'true' to prevent storing the FileVault key across restarts.
content: If 'true', the system won't store th FileVault key across restarts.
mdm/profiles/com.apple.MCX(Mobililty).yaml
+20 -11
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,36 +15,43 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Sets up mobile account options for network based user accounts.
payloadkeys:
- key: com.apple.cachedaccounts.CreateAtLogin
type: <boolean>
presence: optional
default: false
content: If 'true', creates the mobile account at login time.
content: If 'true', the system creates the mobile account at login time.
- key: com.apple.cachedaccounts.WarnOnCreate
type: <boolean>
presence: optional
default: false
content: If 'true', asks the user if the mobile account should be created and allow
the user to not create it.
content: If 'true', the system asks the user whether to create the mobile account
and it allows the user to not create it.
- key: cachedaccounts.WarnOnCreate.allowNever
type: <boolean>
presence: optional
default: false
content: If 'true', allows the user to stop the prompts about mobile account creation
every time the user logs in. This key is only valid if 'com.apple.cachedaccounts.WarnOnCreate'
is set to 'true'.
content: If 'true', the system allows the user to stop the prompts about mobile
account creation every time the user logs in. This key is only valid if 'com.apple.cachedaccounts.WarnOnCreate'
is 'true'.
- key: cachedaccounts.expiry.delete.disusedSeconds
type: <integer>
presence: optional
default: -1
content: |-
The minimum number of seconds a mobile account can exist before an automatic attempt is made to remove the mobile account.
Set to '0' to try to remove it at next login or logout time. Set to '-1' to never try to remove the mobile account.
content: The minimum number of seconds a mobile account can exist before the system
makes an automatic attempt to remove the mobile account. Set to '0' to attempt
removing it at the next login or logout. Set to '-1' to never attempt removing
the mobile account.
- key: cachedaccounts.askForSecureTokenAuthBypass
type: <boolean>
presence: optional
default: false
content: If 'true', bypasses the secure token authorization dialog. This dialog
only appears on APFS volumes.
content: If 'true', the system bypasses the secure token authorization dialog. This
dialog only appears on APFS volumes.
mdm/profiles/com.apple.MCX(TimeServer).yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.12.4
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Settings for time zone and server. If multiple profiles with this payload
are sent, the device's time server will be set to the value in the last payload
installed. Removing the payload will not change the settings back to the prior
mdm/profiles/com.apple.MCX(WiFi).yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: RequireAdminForIBSS
supportedOS:
mdm/profiles/com.apple.MCX.FileVault2.yaml
+19 -8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.MCX.FileVault2
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: The FileVault payload only works on macOS to enable or disable FileVault.
Starting with macOS 10.15, this payload requires UAMDM to enable FileVault.
payloadkeys:
@@ -31,25 +39,27 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', defers enabling FileVault until the designated user logs out.
For details, see 'fdesetup(8)'. Only a local user or a mobile account user can
enable FileVault.
content: If 'true', the system defers enabling FileVault until the designated user
logs out. For details, see 'fdesetup(8)'. Only a local user or a mobile account
user can enable FileVault.
- key: UserEntersMissingInfo
type: <boolean>
presence: optional
default: false
content: If 'true', enables a prompt for missing user name or password fields.
content: If 'true', the system enables a prompt for missing user name or password
fields.
- key: UseRecoveryKey
type: <boolean>
presence: optional
default: true
content: If 'true', creates a personal recovery key and displays it to the user.
content: If 'true', the system creates a personal recovery key and displays it to
the user.
- key: ShowRecoveryKey
type: <boolean>
presence: optional
default: true
content: If 'false', prevents display of the personal recovery key to the user after
the system enables FileVault.
content: If 'false', the system prevents display of the personal recovery key to
the user after the system enables FileVault.
- key: OutputPath
type: <string>
presence: optional
@@ -97,7 +107,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', prevents requests to enable FileVault at user logout time.
content: If 'true', the system prevents requests to enable FileVault at user logout
time.
- key: ForceEnableInSetupAssistant
supportedOS:
macOS:
mdm/profiles/com.apple.MCX.TimeMachine.yaml
+8
View File
@@ -2,6 +2,8 @@ title: Time Machine
payload:
payloadtype: com.apple.MCX.TimeMachine
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -12,6 +14,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: AutoBackup
type: <boolean>
mdm/profiles/com.apple.ManagedClient.preferences.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.ManagedClient.preferences
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: PreferenceDomain
type: <dictionary>
mdm/profiles/com.apple.NSExtension.yaml
+13 -5
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.NSExtension
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Specifies which NSExtension extensions are to be allowed or disallowed
on a system. Extensions can be managed by bundleID allow/deny lists and "extension
points".
@@ -20,7 +28,7 @@ payloadkeys:
- key: AllowedExtensions
type: <array>
presence: optional
content: An array of identifiers for extensions that are allowed to run on the system.
content: An array of bundle identifiers for allowed extensions.
subkeys:
- key: AllowedExtensionsItem
type: <string>
@@ -29,8 +37,8 @@ payloadkeys:
- key: DeniedExtensions
type: <array>
presence: optional
content: An array of identifiers for extensions that aren't allowed to run on the
system.
content: An array of bundle identifiers for extensions that the system doesn't allow
to run.
subkeys:
- key: DeniedExtensionsItem
type: <string>
@@ -39,8 +47,8 @@ payloadkeys:
- key: DeniedExtensionPoints
type: <array>
presence: optional
content: An array of extension points for extensions that aren't allowed to run
on the system.
content: An array of extension points for extensions that the system doesn't allow
to run.
subkeys:
- key: DeniedExtensionPointsItem
type: <string>
mdm/profiles/com.apple.SetupAssistant.managed.yaml
+6
View File
@@ -24,6 +24,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: On macOS, this payload can specify Setup Assistant options for either the
system or particular users.
payloadkeys:
mdm/profiles/com.apple.ShareKitHelper.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.ShareKitHelper
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
deprecated: '10.12'
@@ -14,6 +16,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: macOS only. Specifies which ShareKit plugin can be accessed on client.
Both allow and disallow lists can be specified.
payloadkeys:
mdm/profiles/com.apple.SoftwareUpdate.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Software Update Managed Settings
payload:
payloadtype: com.apple.SoftwareUpdate
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Software update catalog options.
payloadkeys:
- key: CatalogURL
mdm/profiles/com.apple.SystemConfiguration.yaml
+8
View File
@@ -2,6 +2,8 @@ title: Network Proxy Configuration
payload:
payloadtype: com.apple.SystemConfiguration
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -12,6 +14,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: Proxies
type: <dictionary>
mdm/profiles/com.apple.TCC.configuration-profile-policy.yaml
+18 -6
View File
@@ -3,6 +3,8 @@ description: Configures Security Preferences:Privacy settings
payload:
payloadtype: com.apple.TCC.configuration-profile-policy
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.14'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: Services
type: <dictionary>
@@ -57,8 +65,9 @@ payloadkeys:
- key: Allowed
type: <boolean>
presence: required
content: If 'true', access is granted; otherwise, the process doesn't have
access. The user isn't prompted and can't change this value.
content: |-
If 'true', access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
Every payload needs to include either 'Authorization' or 'Allowed', but not both.
- key: Authorization
supportedOS:
macOS:
@@ -70,10 +79,13 @@ payloadkeys:
- Deny
- AllowStandardUserToSetSystemService
content: |-
The 'Authorization' key is an optional replacement for the 'Allowed' key. Every payload must specify either 'Authorization' or 'Allowed', but not both.
'Allow': Equivalent to a 'true' value for the 'Allowed' key.
'Deny': Equivalent to a 'false' value for the 'Allowed' key.
'AllowStandardUserToSetSystemService:' allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization. 'AllowStandardUserToSetSystemService' is only valid for the 'ListenEvent' and 'ScreenCapture' services.
The 'Authorization' key is an optional replacement for the 'Allowed' key, which has one of the following possible values:
* 'Allow': Equivalent to a 'true' value for the 'Allowed' key
* 'Deny': Equivalent to a 'false' value for the 'Allowed' key
* 'AllowStandardUserToSetSystemService': Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the 'ListenEvent' and 'ScreenCapture' services
Every payload needs to include either 'Authorization' or 'Allowed', but not both.
Available in macOS 11 and later.
- key: Comment
type: <string>
mdm/profiles/com.apple.airplay.security.yaml
+14 -6
View File
@@ -3,11 +3,19 @@ description: AirPlay Security settings
payload:
payloadtype: com.apple.airplay.security
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: n/a
tvOS:
introduced: '11.0'
multiple: false
supervised: false
allowmanualinstall: true
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Manages the AirPlay Security settings on Apple TV (Settings > AirPlay >
Security). Use this payload to lock Apple TV to a particular style of AirPlay
security. The setting can enable/disable an on-screen passcode, or require a specific
@@ -22,13 +30,13 @@ payloadkeys:
- PASSCODE_ALWAYS
- PASSWORD
content: |-
The security policy for AirPlay.
'PASSCODE_ONCE' requires an onscreen passcode on first connection from a device. Subsequent connections from the same device aren't prompted.
'PASSCODE_ALWAYS' requires an onscreen passcode for every AirPlay connection. After an AirPlay connection ends, reconnecting within 30 seconds is allowed without a password.
The security policy for AirPlay. Allowed values:
'PASSWORD' requires a passphrase as specified in the 'Password' key.
* 'PASSCODE_ONCE': Requires an onscreen passcode on first connection from a device. Subsequent connections from the same device aren't prompted.
* 'PASSCODE_ALWAYS': Requires an onscreen passcode for every AirPlay connection. After an AirPlay connection ends, the system allows reconnecting within 30 seconds without a password.
* 'PASSWORD': Requires the passphrase set for 'Password'.
'NONE' was deprecated in tvOS 11.3. Existing profiles using 'NONE' get the 'PASSWORD_ONCE' behavior.
'NONE' was deprecated in tvOS 11.3. Existing profiles that use 'NONE' get the 'PASSWORD_ONCE' behavior.
- key: AccessType
title: Access Type
type: <string>
@@ -44,4 +52,4 @@ payloadkeys:
title: Password
type: <string>
presence: optional
content: The AirPlay password; required if SecurityType is 'PASSWORD'.
content: The AirPlay password; required if 'SecurityType' is 'PASSWORD'.
mdm/profiles/com.apple.airplay.yaml
+10 -4
View File
@@ -24,6 +24,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: macOS supports more than one payload, iOS does not. Supported on the user
channel for macOS only.
payloadkeys:
@@ -70,9 +76,9 @@ payloadkeys:
title: Passwords
type: <array>
presence: optional
content: |-
If present, sets passwords for known AirPlay destinations.
Using multiple entries for the same destination, whether within the same payload or across multiple installed payloads, is an error and results in undefined behavior.
content: If present, sets passwords for known AirPlay destinations. Using multiple
entries for the same destination, whether within the same payload or across multiple
installed payloads, is an error and results in undefined behavior.
subkeys:
- key: PasswordsItem
title: Password Content Item
@@ -113,5 +119,5 @@ payloadkeys:
mode: ignored
type: <array>
presence: optional
content: Use 'AllowList' instead. As of macOS 11.3 and iOS 14.5 this key is deprecated.
content: Use 'AllowList' instead. This key is deprecated in iOS 14.5 and macOS 11.3.
subkeys: *id001
mdm/profiles/com.apple.airprint.yaml
+6
View File
@@ -24,6 +24,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: AirPrint
title: Air print
mdm/profiles/com.apple.apn.managed.yaml
+8
View File
@@ -15,6 +15,14 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
Not supported in macOS.
This technically does install on watchOS but we are removing the supportedOS dictionary. The cellular payload should be used instead.
mdm/profiles/com.apple.app.lock.yaml
+27 -20
View File
@@ -14,11 +14,17 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: '10.2'
multiple: false
supervised: true
allowmanualinstall: true
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: App
title: App
@@ -38,15 +44,15 @@ payloadkeys:
introduced: '7.0'
type: <dictionary>
presence: optional
content: A dictionary of options that the user cannot change.
content: A dictionary of options that the user can't change.
subkeys:
- key: DisableTouch
title: Disable Touch
type: <boolean>
presence: optional
default: false
content: If 'true', disables the touch screen. In tvOS, it disables the touch
surface on the Apple TV Remote.
content: If 'true', the system disables the touch screen. In tvOS, it disables
the touch surface on the Apple TV Remote.
- key: DisableDeviceRotation
title: Disable Device Rotation
supportedOS:
@@ -55,7 +61,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', disables device rotation sensing.
content: If 'true', the system disables device rotation sensing.
- key: DisableVolumeButtons
title: Disable Volume Buttons
supportedOS:
@@ -64,7 +70,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', disables the volume buttons.
content: If 'true', the system disables the volume buttons.
- key: DisableRingerSwitch
title: Disable Ringer Switch
supportedOS:
@@ -73,8 +79,9 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', disables the ringer switch. When disabled, the ringer behavior
depends on what position the switch was in when it was first disabled.
content: If 'true', the system disables the ringer switch. When disabled, the
ringer behavior depends on what position the switch was in when it was first
disabled.
- key: DisableSleepWakeButton
title: Disable Sleep Wake Button
supportedOS:
@@ -83,7 +90,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', disables the sleep/wake button.
content: If 'true', the system disables the sleep/wake button.
- key: DisableAutoLock
title: Disable Auto Lock
type: <boolean>
@@ -96,19 +103,19 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables VoiceOver.
content: If 'true', the system enables VoiceOver.
- key: EnableZoom
title: Enable Zoom
type: <boolean>
presence: optional
default: false
content: If 'true', enables Zoom.
content: If 'true', the system enables Zoom.
- key: EnableInvertColors
title: Enable Invert Colors
type: <boolean>
presence: optional
default: false
content: If 'true', enables Invert Colors.
content: If 'true', the system enables Invert Colors.
- key: EnableAssistiveTouch
title: Enable Assistive Touch
supportedOS:
@@ -117,7 +124,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables AssistiveTouch.
content: If 'true', the system enables AssistiveTouch.
- key: EnableSpeakSelection
title: Enable Speak Selection
supportedOS:
@@ -126,7 +133,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables Speak Selection.
content: If 'true', the system enables Speak Selection.
- key: EnableMonoAudio
title: Enable Mono Audio
supportedOS:
@@ -135,7 +142,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables Mono Audio.
content: If 'true', the system enables Mono Audio.
- key: EnableVoiceControl
title: Enable Voice Control
supportedOS:
@@ -146,7 +153,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables Voice Control.
content: If 'true', the system enables Voice Control.
- key: UserEnabledOptions
title: User Enabled Options
supportedOS:
@@ -166,25 +173,25 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', allows the user to toggle Voice Control.
content: If 'true', the system allows the user to toggle Voice Control.
- key: VoiceOver
title: Voice Over
type: <boolean>
presence: optional
default: false
content: If 'true', allows the user to toggle VoiceOver.
content: If 'true', the system allows the user to toggle VoiceOver.
- key: Zoom
title: Zoom
type: <boolean>
presence: optional
default: false
content: If 'true', allows the user to toggle Zoom.
content: If 'true', the system allows the user to toggle Zoom.
- key: InvertColors
title: Invert Colors
type: <boolean>
presence: optional
default: false
content: If 'true', allows the user to toggle Invert Colors.
content: If 'true', the system allows the user to toggle Invert Colors.
- key: AssistiveTouch
title: Assistive Touch
supportedOS:
@@ -193,4 +200,4 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', allows the user to toggle AssistiveTouch.
content: If 'true', the system allows the user to toggle AssistiveTouch.
mdm/profiles/com.apple.applicationaccess.new.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.applicationaccess.new
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
Parental controls application restrictions.
Order of evaluation:
mdm/profiles/com.apple.applicationaccess.yaml
+552 -190
View File
File diff suppressed because it is too large Load Diff
mdm/profiles/com.apple.appstore.yaml
+18 -9
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.appstore
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Use this payload to set restrictions used by the Mac App Store.
payloadkeys:
- key: restrict-store-require-admin-to-install
@@ -23,9 +31,9 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', restricts app installations to admin users only. Deprecated
in macOS 10.14. Use the 'com.apple.SoftwareUpdate' payload key 'restrict-software-update-require-admin-to-install'
as a replacement.
content: If 'true', the system restricts app installations to admin users only.
Deprecated in macOS 10.14. Use the 'com.apple.SoftwareUpdate' payload key 'restrict-software-update-require-admin-to-install'
instead.
- key: restrict-store-softwareupdate-only
supportedOS:
macOS:
@@ -33,8 +41,9 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', prevents App Store from launching. Available in macOS 10.14
and later. Restricts installations to software updates only in macOS 10.10 - 10.13.
content: If 'true', the system prevents App Store from launching. Available in macOS
10.14 and later. Restricts installations to software updates only in macOS 10.10
through 10.13.
- key: restrict-store-disable-app-adoption
supportedOS:
macOS:
@@ -42,8 +51,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', disables app adoption by users. Available in macOS 10.10 and
later.
content: If 'true', the system disables app adoption by users. Available in macOS
10.10 and later.
- key: DisableSoftwareUpdateNotifications
supportedOS:
macOS:
@@ -51,5 +60,5 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', disables software update notifications. Available in macOS 10.10
and later.
content: If 'true', the system disables software update notifications. Available
in macOS 10.10 and later.
mdm/profiles/com.apple.asam.yaml
+12 -3
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.asam
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.13.4
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: AllowedApplications
supportedOS:
@@ -20,8 +28,8 @@ payloadkeys:
introduced: 10.13.4
type: <array>
presence: required
content: An array of dictionaries that specifies the apps that can be granted access
to the Accessibility APIs.
content: An array of dictionaries that specifies the apps that the system grants
access to the Accessibility APIs.
subkeys:
- key: AllowedApplicationsItem
type: <dictionary>
@@ -41,4 +49,5 @@ payloadkeys:
introduced: 10.13.4
type: <string>
presence: required
content: The developer's team identifier, used when the app was signed.
content: The developer's team identifier that the system used when it signed
the app.
mdm/profiles/com.apple.associated-domains.yaml
+13 -5
View File
@@ -4,6 +4,8 @@ description: Use this section to define settings for Associated Domains to be us
payload:
payloadtype: com.apple.associated-domains
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.15'
multiple: true
@@ -14,6 +16,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Configures Associated Domains to be used with features such as Extensible
AppSSO, universal links and Password AutoFill. Settings are per-user. The effective
settings for a user will be the union of payloads installed for the device and
@@ -36,8 +44,8 @@ payloadkeys:
- key: AssociatedDomains
type: <array>
presence: required
content: |-
The domains to be associated with the app. Each string is in the form of ''service:domain''. Domains should be fully qualified hostnames, like 'www.example.com'.
content: The domains to associate with the app. Each string is in the form of
''service:domain''. Use fully qualified hostnames, such as 'www.example.com'.
See Supporting associated domains for more information.
subkeys:
- key: AssociatedDomain
@@ -50,6 +58,6 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', data for this domain should be downloaded directly instead
of through a CDN. The entitlement value for this domain must be set to 'service:domain?mode=managed'
or this value will be ignored. Available in macOS 11 and later.
content: If 'true', the system enables direct download of data for this domain
instead of through a CDN. Set the entitlement value for this domain to 'service:domain?mode=managed';
otherwise, the system ignores this value. Available in macOS 11 and later.
mdm/profiles/com.apple.caldav.account.yaml
+16 -7
View File
@@ -25,6 +25,17 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: '1.1'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: n/a
payloadkeys:
- key: CalDAVAccountDescription
title: Account Description
@@ -40,14 +51,13 @@ payloadkeys:
title: Account Username
type: <string>
presence: optional
content: |-
The user name for logins.
If this profile part of a non-interactive install, this field is required.
content: The user name for logins. If this profile is part of a non-interactive
install, the system requires this field.
- key: CalDAVPassword
title: Account Password
type: <string>
presence: optional
content: The user's password. This is only used with encrypted profiles.
content: The user's password. Only use this with encrypted profiles.
- key: CalDAVPrincipalURL
title: Principal URL
type: <string>
@@ -58,7 +68,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: If 'true', enables SSL.
content: If 'true', the system enables SSL.
- key: CalDAVPort
title: Port Number
type: <integer>
@@ -73,6 +83,5 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: |-
The VPNUUID of the per-app VPN the account uses for network communication.
content: The VPNUUID of the per-app VPN the account uses for network communication.
Available in iOS 14 and later.
mdm/profiles/com.apple.carddav.account.yaml
+16 -6
View File
@@ -25,6 +25,17 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: '1.1'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: n/a
payloadkeys:
- key: CardDAVAccountDescription
title: Account Description
@@ -57,7 +68,7 @@ payloadkeys:
introduced: '10.7'
type: <string>
presence: optional
content: The user's password.
content: The user's password. Only use this with encrypted profiles.
- key: CardDAVPrincipalURL
title: Principal URL
supportedOS:
@@ -74,7 +85,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: If 'true', enables SSL.
content: If 'true', the system enables SSL.
- key: CardDAVPort
title: Port Number
supportedOS:
@@ -114,8 +125,8 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: A string containing the bundle identifier for the default application
that handles audio calls made to contacts from this account.
content: The bundle identifier for the default application that handles audio
calls to contacts from this account.
- key: VPNUUID
title: VPNUUID
supportedOS:
@@ -125,6 +136,5 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: |-
The VPNUUID of the per-app VPN the account uses for network communication.
content: The VPNUUID of the per-app VPN the account uses for network communication.
Available in iOS 14 and later.
mdm/profiles/com.apple.cellular.yaml
+11 -5
View File
@@ -14,6 +14,12 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: '3.2'
multiple: false
@@ -65,7 +71,7 @@ payloadkeys:
- 2
- 3
content: |-
The Internet Protocol versions that the system supports. Possible values are:
The Internet Protocol versions that the system supports. Allowed values:
* '1': IPv4
* '2': IPv6
@@ -128,7 +134,7 @@ payloadkeys:
- 2
- 3
content: |-
The default Internet Protocol versions. Available in iOS 10.3 but no longer used in iOS 11 and later. Possible values are:
The default Internet Protocol versions. Available in iOS 10.3 but no longer used in iOS 11 and later. Allowed values:
* '1': IPv4
* '2': IPv6
@@ -145,7 +151,7 @@ payloadkeys:
- 2
- 3
content: |-
The Internet Protocol versions that the system supports. Available in iOS 10.3 and later. Possible values are:
The Internet Protocol versions that the system supports. Available in iOS 10.3 and later. Allowed values:
* '1': IPv4
* '2': IPv6
@@ -162,7 +168,7 @@ payloadkeys:
- 2
- 3
content: |-
The Internet Protocol versions that the system supports while roaming. Available in iOS 10.3 and later. Possible values are:
The Internet Protocol versions that the system supports while roaming. Available in iOS 10.3 and later. Allowed values:
* '1': IPv4
* '2': IPv6
@@ -179,7 +185,7 @@ payloadkeys:
- 2
- 3
content: |-
The Internet Protocol versions that the system supports while roaming. Available in iOS 10.3 and later. Possible values are:
The Internet Protocol versions that the system supports while roaming. Available in iOS 10.3 and later. Allowed values:
* '1': IPv4
* '2': IPv6
mdm/profiles/com.apple.cellularprivatenetwork.managed.yaml
+8
View File
@@ -14,6 +14,14 @@ payload:
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Payload can be used to provide device info on private network deployments
including geographical location, preference over wifi, and network deployment
type.
mdm/profiles/com.apple.conferenceroomdisplay.yaml
+8
View File
@@ -4,11 +4,19 @@ description: Use this section to place an Apple TV device into Conference Room D
payload:
payloadtype: com.apple.conferenceroomdisplay
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: n/a
tvOS:
introduced: '10.2'
multiple: false
supervised: true
allowmanualinstall: true
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Configures an Apple TV to enter Conference Room Display mode, and restrictions
exit from that mode
payloadkeys:
mdm/profiles/com.apple.configurationprofile.identification.yaml
+12 -5
View File
@@ -2,6 +2,8 @@ title: Identification
payload:
payloadtype: com.apple.configurationprofile.identification
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -12,6 +14,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
This payload can be used on the device or user channel depending on what payload it is paired with.
@@ -30,7 +38,7 @@ payloadkeys:
- key: PayloadIdentification
type: <dictionary>
presence: required
content: The dictionary containing details about the user.
content: The dictionary that contains details about the user.
subkeys:
- key: UserName
type: <string>
@@ -50,13 +58,12 @@ payloadkeys:
rangelist:
- Password
- UserEnteredPassword
content: The authorization method. Either the password is supplied in the profile
or the user supplies it.
content: The authorization method. Either the profile contains the password or
the user provides it.
- key: Password
type: <string>
presence: required
content: The password for the account. Required when the 'AuthMethod' is of type
'password'.
content: The password for the account. Required when the 'AuthMethod' is 'Password'.
- key: Prompt
type: <string>
presence: optional
mdm/profiles/com.apple.dashboard.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.dashboard
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
deprecated: '10.15'
@@ -15,6 +17,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Widget restrictions.
payloadkeys:
- key: whiteListEnabled
mdm/profiles/com.apple.declarations.yaml
+7
View File
@@ -27,6 +27,13 @@ payload:
multiple: true
supervised: false
allowmanualinstall: true
visionOS:
introduced: '1.0'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: forbidden
watchOS:
introduced: '10.0'
multiple: true
mdm/profiles/com.apple.desktop.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.desktop
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.10'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: locked
supportedOS:
mdm/profiles/com.apple.dnsProxy.managed.yaml
+11
View File
@@ -24,6 +24,17 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: '1.1'
multiple: false
supervised: false
allowmanualinstall: false
userenrollment:
mode: allowed
watchOS:
introduced: n/a
content: As of iOS 15.0 this payload can be installed on unsupervised devices via
MDM and can only be installed via MDM. As of iOS 16.0, this can be installed on
User Enrollments via MDM if DNSProxyUUID is specified.
mdm/profiles/com.apple.dnsSettings.managed.yaml
+65 -45
View File
@@ -24,6 +24,17 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: '1.0'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: forbidden
watchOS:
introduced: n/a
payloadkeys:
- key: DNSSettings
title: DNS Settings
@@ -44,18 +55,18 @@ payloadkeys:
type: <string>
presence: optional
content: The URI template of a DNS-over-HTTPS server, as defined in RFC 8484.
This URL must use the 'https://' scheme, and the hostname or address in the
URL will be used to validate the server certificate. If no 'ServerAddresses'
are provided, the hostname or address in the URL will be used to determine the
server addresses. This key must be present only if the 'DNSProtocol' is 'HTTPS'.
This URL needs to use the 'https://' scheme, and the system uses the hostname
or address in the URL to validate the server certificate. If no 'ServerAddresses'
are provided, the system uses the hostname or address in the URL to determine
the server addresses. Required if 'DNSProtocol' is 'HTTPS'.
- key: ServerName
title: Server Name
type: <string>
presence: optional
content: The hostname of a DNS-over-TLS server used to validate the server certificate,
as defined in RFC 7858. If no 'ServerAddresses' are provided, the hostname will
be used to determine the server addresses. This key must be present only if
the DNSProtocol is 'TLS'.
as defined in RFC 7858. If no 'ServerAddresses' are provided, the system uses
the hostname to determine the server addresses. This key must be present only
if the DNSProtocol is 'TLS'.
- key: ServerAddresses
title: DNS Server Addresses
type: <array>
@@ -71,8 +82,8 @@ payloadkeys:
type: <array>
presence: optional
content: |-
A list of domain strings used to determine which DNS queries will use the DNS server. If this array is not provided, all domains will use the DNS server.
A single wildcard '*' prefix is supported, but is not required. For example, both '*.example.com' and 'example.com' match against 'mydomain.example.com' and 'your.domain.example.com', but do not match against 'mydomain-example.com'.
A list of domain strings used to determine which DNS queries use the DNS server. If not set, all domains use the DNS server.
The system supports a single wildcard ('*') prefix, but it's not required. For example, both '*.example.com' and 'example.com' match against 'mydomain.example.com' and 'your.domain.example.com', but don't match against 'mydomain-example.com'.
subkeys:
- key: SupplementalMatchDomainsElement
title: Supplemental Match Domains Element
@@ -81,8 +92,8 @@ payloadkeys:
title: On Demand Rules
type: <array>
presence: optional
content: An array of rules defining the DNS settings. If rules aren't present, the
system always applies the DNS settings. These rules are identical to the 'OnDemandRules'
content: An array of rules that define the DNS settings. If not set, the system
always applies the DNS settings. These rules are identical to the 'OnDemandRules'
array in VPN payloads.
subkeytype: OnDemandRulesElement
subkeys:
@@ -99,45 +110,54 @@ payloadkeys:
- Disconnect
- EvaluateConnection
content: |-
The action to take if this dictionary matches the current network. Possible values are:
The action to take if this dictionary matches the current network. Allowed values:
* 'Connect': Apply DNS Settings when the dictionary matches.
* 'Disconnect': Do not apply DNS Settings when the dictionary matches.
* 'Disconnect': Don't apply DNS Settings when the dictionary matches.
* 'EvaluateConnection': Apply DNS Settings with per-domain exceptions when the dictionary matches.
- key: ActionParameters
title: Action Parameters
type: <dictionary>
type: <array>
presence: optional
content: |-
A dictionary that provides per-connection rules.
This array is used only for settings where the 'Action' value is'EvaluateConnection'.
content: An array of dictionaries that provides per-connection rules. The system
uses this array only for settings where the 'Action' value is'EvaluateConnection'.
subkeys:
- key: Domains
title: Domains
type: <array>
presence: required
content: The domains for which this evaluation applies.
subkeys:
- key: DomainsElement
title: Domains Element
type: <string>
- key: DomainAction
title: Domain Action
type: <string>
presence: required
rangelist:
- NeverConnect
- ConnectIfNeeded
- key: ActionParameter
title: Action Parameter
type: <dictionary>
presence: optional
content: |-
The DNS settings behavior for the specified domains. Allowed values are:
* 'NeverConnect': Do not use the DNS Settings for the specified domains.
* 'ConnectIfNeeded': Allow using the DNS Settings for the specified domains.
A dictionary that provides per-connection rules.
The keys allowed in each dictionary are described below. Note: This array is used only for dictionaries in which EvaluateConnection is the Action value.
subkeys:
- key: Domains
title: Domains
type: <array>
presence: required
content: The domains for which this evaluation applies.
subkeys:
- key: DomainsElement
title: Domains Element
type: <string>
- key: DomainAction
title: Domain Action
type: <string>
presence: required
rangelist:
- NeverConnect
- ConnectIfNeeded
content: |-
The DNS settings behavior for the specified domains. Allowed values:
* 'NeverConnect': Don't use the DNS Settings for the specified domains.
* 'ConnectIfNeeded': Allow using the DNS Settings for the specified domains.
- key: DNSDomainMatch
title: DNS Domain Match
type: <array>
presence: optional
content: |-
An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list.
A single wildcard '*' prefix is supported, but is not required. For example, both '*.example.com' and 'example.com' match against 'mydomain.example.com' and 'your.domain.example.com', but do not match against 'mydomain-example.com'.
The system supports a single wildcard ('*') prefix, but it's not required. For example, both '*.example.com' and 'example.com' match against 'mydomain.example.com' and 'your.domain.example.com', but don't match against 'mydomain-example.com'.
subkeys:
- key: DNSDomainMatchElement
title: DNS Domain Match Element
@@ -148,7 +168,7 @@ payloadkeys:
presence: optional
content: |-
An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array.
Matching with a single wildcard is supported. For example, 17.* matches any DNS server in the 17.0.0.0/8 subnet.
The system supports matching with a single wildcard. For example, '17.*' matches any DNS server in the 17.0.0.0/8 subnet.
subkeys:
- key: DNSServerAddressMatchElement
title: DNS Server Address Match Element
@@ -167,9 +187,9 @@ payloadkeys:
title: SSID Match
type: <array>
presence: optional
content: |-
An array of SSIDs to match against the current network. If the network is not a Wi-Fi network or if the SSID does not appear in this array, the match fails.
Omit this key and the corresponding array to match against any SSID.
content: An array of SSIDs to match against the current network. If the network
isn't a Wi-Fi network or if the SSID doesn't appear in this array, the match
fails. Omit this key and the corresponding array to match against any SSID.
subkeys:
- key: SSIDMatchElement
title: SSID Match Element
@@ -178,15 +198,15 @@ payloadkeys:
title: URL String Probe
type: <string>
presence: optional
content: A URL to probe. If this URL is successfully fetched (returning a 200
HTTP status code) without redirection, this rule matches.
content: A URL to probe. This rule matches if this URL is successfully fetched
and returns a 200 HTTP status code without redirection.
- key: ProhibitDisablement
title: Prohibit Disablement
type: <boolean>
presence: optional
default: false
content: If 'true', prohibits users from disabling DNS settings. This key is only
available on supervised devices.
content: If 'true', the system prohibits users from disabling DNS settings. This
key is only available on supervised devices.
- key: PayloadCertificateUUID
title: Certificate UUID
supportedOS:
mdm/profiles/com.apple.dock.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.dock
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: tilesize
type: <integer>
mdm/profiles/com.apple.domains.yaml
+6
View File
@@ -24,6 +24,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This payload defines web domains that are under an enterprise's management.
payloadkeys:
- key: EmailDomains
mdm/profiles/com.apple.eas.account.yaml
+75 -57
View File
@@ -14,6 +14,19 @@ payload:
userchannel: true
userenrollment:
mode: allowed
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: '1.1'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: n/a
content: |-
This payload configures an Exchange Active Sync account on an iOS device for Mail, Contacts, Calendars, Reminders, and Notes.
Updating this payload overrides any settings that the user customized, such as EnableMail/Contacts/Calendars/Reminders/Notes and MailNumberOfPastDaysToSync.
@@ -36,7 +49,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables SSL for authentication.
content: If 'true', the system enables SSL for authentication.
- key: OAuth
title: Use OAuth
supportedOS:
@@ -52,8 +65,8 @@ payloadkeys:
title: User
type: <string>
presence: optional
content: This user name for this Exchange account. The user name is required for
noninteractive installations like MDM in iOS.
content: This user name for this Exchange account. Required for noninteractive installations
like MDM in iOS.
- key: Password
title: Password
type: <string>
@@ -90,9 +103,9 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', prevents messages from being moved out of this email account
content: If 'true', the system prevents moving messages from out of this email account
into another account. This setting also prevents forwarding or replying from an
account other than the one the message was sent to.
account other than the recipient of the message.
- key: PreventAppSheet
title: Prevent App Sheet
supportedOS:
@@ -108,8 +121,8 @@ payloadkeys:
type: <string>
presence: optional
format: ^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$
content: The UUID of of the certificate payload within the same profile to use for
the identity credential. If this field is present, the Certificate field is not
content: The UUID of the certificate payload within the same profile to use for
the identity credential. If this field is present, the Certificate field isn't
used.
- key: SMIMEEnabled
title: S/MIME Enabled
@@ -117,11 +130,13 @@ payloadkeys:
iOS:
introduced: '5.0'
deprecated: '10.0'
visionOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', enables S/MIME encryption. In iOS 10.0 and later, this key is
ignored. Use 'SMIMESigningEnabled' instead.
content: If 'true', the system enables S/MIME encryption. In iOS 10.0 and later,
this key is ignored. Use 'SMIMESigningEnabled' instead.
- key: SMIMESigningEnabled
title: S/MIME Signing Enabled
supportedOS:
@@ -130,8 +145,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables S/MIME signing for this account. Available in iOS 10.0
and later.
content: If 'true', the system enables S/MIME signing for this account. Available
in iOS 10.0 and later.
- key: SMIMESigningCertificateUUID
title: S/MIME Signing Certificate
supportedOS:
@@ -148,12 +163,14 @@ payloadkeys:
iOS:
introduced: '10.3'
deprecated: '12.0'
visionOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', enables S/MIME encryption for this account. Available in iOS
10.0 and later. As of iOS 12.0, this key is deprecated. It is recommended to use
'SMIMEEncryptByDefault' instead.
content: If 'true', the system enables S/MIME encryption for this account. Available
in iOS 10.0 and later. As of iOS 12.0, this key is deprecated. Use 'SMIMEEncryptByDefault'
instead.
- key: SMIMEEncryptionCertificateUUID
title: S/MIME Encryption Certificate
supportedOS:
@@ -163,28 +180,30 @@ payloadkeys:
presence: optional
format: ^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$
content: The payload UUID of the identity certificate used to decrypt messages sent
to this account. The public certificate is attached to outgoing mail to allow
encrypted mail to be sent to this user. When the user sends encrypted mail, the
public certificate is used to encrypt the copy of the mail in the user's Sent
mailbox.
to this account. The system attaches the public certificate to outgoing mail to
allow the user to receive encrypted mail. When the user sends encrypted mail,
the system uses the public certificate to encrypt the copy of the mail in the
user's Sent mailbox.
- key: SMIMEEnablePerMessageSwitch
title: S/MIME Enable Per-Message Switch
supportedOS:
iOS:
introduced: '8.0'
deprecated: '12.0'
visionOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: |-
If 'true', displays the per-message encryption switch in the Mail Compose UI.
If 'true', the system displays the per-message encryption switch in the Mail Compose UI.
Available in iOS 8.0 and later. As of iOS 12.0, this key is deprecated. Use 'SMIMEEnableEncryptionPerMessageSwitch' instead.
- key: disableMailRecentsSyncing
title: Disable Mail Recents Syncing
type: <boolean>
presence: optional
default: false
content: If 'true', excludes this account from Recent Addresses syncing.
content: If 'true', the system excludes this account from Recent Addresses syncing.
- key: MailNumberOfPastDaysToSync
title: Past Days of Mail to Sync
type: <integer>
@@ -201,6 +220,8 @@ payloadkeys:
supportedOS:
iOS:
deprecated: '7.0'
visionOS:
introduced: n/a
type: <string>
presence: optional
content: The value of the 'X-Apple-Config-Magic' header in each EAS HTTP request.
@@ -220,7 +241,7 @@ payloadkeys:
introduced: '10.0'
type: <dictionary>
presence: optional
content: The default handlers to be used for contacts from this account.
content: The default handlers to use for contacts from this account.
subkeys:
- key: AudioCall
title: App for audio calls
@@ -239,7 +260,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables this account to use Mail Drop.
content: If 'true', the system enables this account to use Mail Drop.
- key: SMIMESigningUserOverrideable
supportedOS:
iOS:
@@ -265,9 +286,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If set to true, S/MIME encryption is enabled by default. If 'SMIMEEnableEncryptionPerMessageSwitch'
is false, this default cannot be changed by the user. Available in iOS 12.0 and
later.
content: If 'true', the system enables S/MIME encryption by default. If 'SMIMEEnableEncryptionPerMessageSwitch'
is 'false', the user can't change this default. Available in iOS 12.0 and later.
- key: SMIMEEncryptByDefaultUserOverrideable
supportedOS:
iOS:
@@ -275,8 +295,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', the user can turn encryption by default on/off, and encryption
is on. Available in iOS 12.0 and later.
content: If 'true', the system enables encryption by default and the user can't
change it. Available in iOS 12.0 and later.
- key: SMIMEEncryptionCertificateUUIDUserOverrideable
supportedOS:
iOS:
@@ -293,8 +313,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', displays the per-message encryption switch in the Mail Compose
UI. Available in iOS 12.0 and later.
content: If 'true', the system displays the per-message encryption switch in the
Mail Compose UI. Available in iOS 12.0 and later.
- key: EnableMail
supportedOS:
iOS:
@@ -303,8 +323,8 @@ payloadkeys:
presence: optional
default: true
content: |-
If 'false', disables the Mail service for this account. The Mail service may be re-enabled in Settings unless 'EnableMailUserOverridable' is 'false'.
'EnableMail', 'EnableContacts', 'EnableCalendars', 'EnableReminders', and 'EnableNotes' can't all be set to 'false'.
If 'false', the system disables the Mail service for this account. The user can reenable Mail service in Settings unless 'EnableMailUserOverridable' is 'false'.
At least of the following fields needs to be 'true': 'EnableMail', 'EnableContacts', 'EnableCalendars', 'EnableReminders', and 'EnableNotes'.
- key: EnableContacts
supportedOS:
iOS:
@@ -313,8 +333,8 @@ payloadkeys:
presence: optional
default: true
content: |-
If 'false', disables the Contacts service for this account. The Contacts service may be re-enabled in Settings unless 'EnableContactsUserOverridable' is 'false'.
'EnableMail', 'EnableContacts', 'EnableCalendars', 'EnableReminders', and 'EnableNotes' can't all be set to 'false'.
If 'false', the system disables the Contacts service for this account. The user can reenable Contacts service in Settings unless 'EnableContactsUserOverridable' is 'false'.
At least of the following fields needs to be 'true': 'EnableMail', 'EnableContacts', 'EnableCalendars', 'EnableReminders', and 'EnableNotes'.
- key: EnableCalendars
supportedOS:
iOS:
@@ -323,8 +343,8 @@ payloadkeys:
presence: optional
default: true
content: |-
If 'false', disables the Calendars service for this account. The Calendars service may be re-enabled in Settings unless 'EnableCalendarsUserOverridable' is 'false'.
'EnableMail', 'EnableContacts', 'EnableCalendars', 'EnableReminders', and 'EnableNotes' can't all be set to 'false'.
If 'false', the system disables the Calendars service for this account. The user can reenable Calendars service in Settings unless 'EnableCalendarsUserOverridable' is 'false'.
At least of the following fields needs to be 'true': 'EnableMail', 'EnableContacts', 'EnableCalendars', 'EnableReminders', and 'EnableNotes'.
- key: EnableReminders
supportedOS:
iOS:
@@ -333,8 +353,8 @@ payloadkeys:
presence: optional
default: true
content: |-
If 'false', disables the Reminders service for this account. The Reminders service may be re-enabled in Settings unless 'EnableRemindersUserOverridable' is false.
'EnableMail', 'EnableContacts', 'EnableCalendars', 'EnableReminders', and 'EnableNotes' can't all be set to 'false'.
If 'false', the system disables the Reminders service for this account. The user can reenable Reminders service in Settings unless 'EnableRemindersUserOverridable' is 'false'.
At least of the following fields needs to be 'true': 'EnableMail', 'EnableContacts', 'EnableCalendars', 'EnableReminders', and 'EnableNotes'.
- key: EnableNotes
supportedOS:
iOS:
@@ -343,8 +363,8 @@ payloadkeys:
presence: optional
default: true
content: |-
If 'false', disables the Notes service for this account. The Notes service may be re-enabled in Settings unless 'EnableNotesUserOverridable' is 'false'.
'EnableMail', 'EnableContacts', 'EnableCalendars', 'EnableReminders', and 'EnableNotes' can't all be set to 'false'.
If 'false', the system disables the Notes service for this account. The user can reenable Notes service in Settings unless 'EnableNotesUserOverridable' is 'false'.
At least of the following fields needs to be 'true': 'EnableMail', 'EnableContacts', 'EnableCalendars', 'EnableReminders', and 'EnableNotes'.
- key: EnableMailUserOverridable
supportedOS:
iOS:
@@ -352,8 +372,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: If 'false', prevents the user from changing the state of the Mail service
for this account in Settings.
content: If 'false', the system prevents the user from changing the state of the
Mail service for this account in Settings.
- key: EnableContactsUserOverridable
supportedOS:
iOS:
@@ -361,8 +381,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: If 'false', prevents the user from changing the state of the Contacts service
for this account in Settings.
content: If 'false', the system prevents the user from changing the state of the
Contacts service for this account in Settings.
- key: EnableCalendarsUserOverridable
supportedOS:
iOS:
@@ -370,8 +390,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: If 'false', prevents the user from changing the state of the Calendars
service for this account in Settings.
content: If 'false', the system prevents the user from changing the state of the
Calendars service for this account in Settings.
- key: EnableRemindersUserOverridable
supportedOS:
iOS:
@@ -379,8 +399,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: If 'false', prevents the user from changing the state of the Reminders
service for this account in Settings.
content: If 'false', the system prevents the user from changing the state of the
Reminders service for this account in Settings.
- key: EnableNotesUserOverridable
supportedOS:
iOS:
@@ -396,18 +416,17 @@ payloadkeys:
introduced: '13.0'
type: <string>
presence: optional
content: |-
The URL that this account should use for signing in via OAuth. When this URL is specified, auto-discovery is not used for this account so you must also specify a host.
This field is ignored unless 'OAuth' is 'true'.
content: The URL that this account should use for signing in through OAuth. Ignored
unless 'OAuth' is 'true'. If you specify this URL, auto-discovery isn't used for
this account, so you need to also specify a host.
- key: OAuthTokenRequestURL
supportedOS:
iOS:
introduced: '13.0'
type: <string>
presence: optional
content: |-
The URL that this account should use for token requests via OAuth.
This field is ignored unless 'OAuth' is 'true'.
content: The URL that this account should use for token requests through OAuth.
Ignored unless 'OAuth' is 'true'.
- key: OverridePreviousPassword
supportedOS:
iOS:
@@ -415,8 +434,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', overrides the previous user/EAS password with the new EAS password
in the payload. Available in iOS 14 and later.
content: If 'true', the system overrides the previous user/EAS password with the
new EAS password in the payload. Available in iOS 14 and later.
- key: VPNUUID
title: VPNUUID
supportedOS:
@@ -424,6 +443,5 @@ payloadkeys:
introduced: '14.0'
type: <string>
presence: optional
content: |-
The VPNUUID of the per-app VPN the account uses for network communication.
content: The VPNUUID of the per-app VPN the account uses for network communication.
Available in iOS 14 and later.
mdm/profiles/com.apple.education.yaml
+45 -41
View File
@@ -24,6 +24,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This payload is used to configure Classroom students, Classroom instructors,
and the Shared iPad login screen. These do not necessarily require the same set
of keys to be present in their payloads, so make sure to include all keys that
@@ -39,20 +45,21 @@ payloadkeys:
- key: OrganizationName
type: <string>
presence: required
content: The organization's display name. This name is shown in the iOS login screen.
content: The organization's display name. The system displays this name in the iOS
login screen.
- key: PayloadCertificateUUID
type: <string>
presence: optional
content: |-
The UUID of an identity certificate payload within the same profile to use for performing client authentication with other devices. This property supports PKCS12 certificates.
This key is required to configure Classroom. It does not impact the configuration of the Shared iPad login screen.
Required to configure Classroom. Has no effect on the configuration of the Shared iPad login screen.
- key: LeaderPayloadCertificateAnchorUUID
type: <array>
presence: optional
content: |-
The array of UUIDs referring to certificate payloads within the same profile that are used to authorize leader peer certificate identities. This array must contain all certificates needed to validate the entire chain of trust. Leader certificates must have the common name prefix leader (case insensitive).
Note: This property doesn't support identity payloads or PKCS12 certificates.
This key is required when configuring a student device for Classroom, and is ignored when configuring an instructor device. It does not impact the configuration of the Shared iPad login screen.
The array of UUIDs referring to certificate payloads within the same profile that the system uses to authorize leader peer certificate identities. This array needs to contain all necessary certificates to validate the entire chain of trust. Leader certificates needs to have the common name prefix leader, which is case insensitive.
This property doesn't support identity payloads or PKCS12 certificates.
Required when configuring a student device for Classroom, and ignored when configuring an instructor device. Has no effect on the configuration of the Shared iPad login screen.
subkeys:
- key: LeaderPayloadCertificateAnchorUUIDItem
type: <string>
@@ -62,9 +69,9 @@ payloadkeys:
type: <array>
presence: optional
content: |-
The array of UUIDs referring to certificate payloads within the same profile that are used to authorize group member peer certificate identities. This array must contain all certificates needed to validate the entire chain of trust. Member certificates must have the common name prefix member (case insensitive).
Note: This property doesn't support identity payloads or PKCS12 certificates.
This key is required when configuring an instructor device for Classroom, and is ignored when configuring a student device. It does not impact the configuration of the Shared iPad login screen.
The array of UUIDs referring to certificate payloads within the same profile that the system uses to authorize group member peer certificate identities. This array must contain all certificates needed to validate the entire chain of trust. Member certificates must have the common name prefix member (case insensitive).
This property doesn't support identity payloads or PKCS12 certificates.
Required when configuring a student device for Classroom, and ignored when configuring an instructor device. Has no effect on the configuration of the Shared iPad login screen.
subkeys:
- key: MemberPayloadCertificateAnchorUUIDItem
type: <string>
@@ -74,20 +81,20 @@ payloadkeys:
type: <string>
presence: optional
content: |-
The UUID of an identity certificate payload within the same profile that is used to perform client authentication when fetching additional resources, such as student images. If not specified, the MDM client identity is used.
If present, this key is used to configure both Classroom and the Shared iPad login screen.
The UUID of an identity certificate payload within the same profile that the system uses to perform client authentication when fetching additional resources, such as student images.
If set, the system uses this key to configure both Classroom and the Shared iPad login screen. If not set, the system uses MDM client identity.
- key: UserIdentifier
type: <string>
presence: required
content: |-
The unique string that identifies the user of this device within the organization.
If this payload is intended to configure the Shared iPad login screen, this value must not be set.
Don't set this value in payloads intended to configure the Shared iPad login screen.
- key: Departments
type: <array>
presence: optional
content: |-
For shared iPad profiles: The array of dictionaries that defines which departments are shown in the Shared iPad login screen.
If present, this key is used to configure both Classroom and the Shared iPad login screen.
content: 'For shared iPad profiles: The array of dictionaries that defines which
departments the system displays in the Shared iPad login screen. If set, the system
uses this key to configure both Classroom and the Shared iPad login screen.'
subkeys:
- key: DepartmentsItem
type: <dictionary>
@@ -102,7 +109,7 @@ payloadkeys:
content: The group beacon identifiers that are members of this department.
subkeys:
- key: GroupBeaconIDsItem
type: <string>
type: <integer>
presence: required
content: A group beacon identifier.
- key: Groups
@@ -110,9 +117,7 @@ payloadkeys:
presence: required
content: |-
For shared iPad profiles: The array of dictionaries that defines which groups the user can select in the login window.
For leader/teacher profiles: The array of dictionaries that defines the groups that the user can control.
For member/student profiles: The array of dictionaries that defines the groups where the user is a member.
subkeys:
- key: GroupsItem
@@ -142,8 +147,7 @@ payloadkeys:
- key: ConfigurationSource
type: <string>
presence: optional
content: The source that provided this group; for example, iTunesU, SIS, or
MDM.
content: The source that provided this group, such as SIS, or MDM.
- key: LeaderIdentifiers
type: <array>
presence: optional
@@ -166,8 +170,8 @@ payloadkeys:
type: <array>
presence: optional
content: |-
The identifiers that refer to entries in the DeviceGroups array to which the instructor can assign users from this class.
The presence/value of this key does not impact the configuration of the Shared iPad login screen.
The identifiers that refer to entries in the 'DeviceGroups' array to which the instructor can assign users from this class.
Has no effect on the configuration of the Shared iPad login screen.
subkeys:
- key: DeviceGroupIdentifiersItem
type: <string>
@@ -177,11 +181,9 @@ payloadkeys:
type: <array>
presence: required
content: |-
For shared iPad profiles: The array of dictionaries that define the users that are shown in the iOS login window.
For shared iPad profiles: The array of dictionaries that define the users that the system displays in the iOS login window.
For leader/teacher profiles: The array of dictionaries that define users that are members of the teacher's groups.
For member/student profiles: The array of dictionaries that must contain the definition of the user specified in the 'UserIdentifier' key. With one-to-one member devices, this key should include only the device user and the teacher but not other class members.
For member/student profiles: The array of dictionaries that needs to contain the definition of the user specified in the 'UserIdentifier' key. With one-to-one member devices, this key should include only the device user and the teacher but not other class members.
subkeys:
- key: UsersItem
type: <dictionary>
@@ -205,19 +207,22 @@ payloadkeys:
- key: PhoneticGivenName
type: <string>
presence: optional
content: The user's phonetic given name. This name is used to sort users in
the Classroom app and the Shared iPad Login Screen.
content: The user's phonetic given name. The system uses this name to sort users
in the Classroom app and the Shared iPad Login Screen.
- key: PhoneticFamilyName
type: <string>
presence: optional
content: The user's phonetic family name. This name is used to sort users in
the Classroom app and the shared iPad login screen.
content: The user's phonetic family name. The system uses this name to sort
users in the Classroom app and the shared iPad login screen.
- key: ImageURL
type: <string>
presence: optional
content: |-
A string containing a URL pointing to an image of the user. This image will be displayed in the iOS login screen and in the Classroom app. The recommended resolution is 256 x 256 pixels (512 x 512 pixels on a 2x device). The recommended formats are JPEG, PNG, and TIFF.
The 'ResourcePayloadCertificateUUID' identity certificate or the MDM client identity will be used to perform authentication when fetching the image.
content: A string that contains a URL pointing to an image of the user. The
system displays this image in the iOS login screen and in the Classroom app.
The recommended resolution is 256 x 256 pixels (512 x 512 pixels on a 2x device).
The recommended formats are JPEG, PNG, and TIFF. The system uses the 'ResourcePayloadCertificateUUID'
identity certificate or the MDM client identity to perform authentication
when fetching the image.
- key: FullScreenImageURL
supportedOS:
iOS:
@@ -227,16 +232,16 @@ payloadkeys:
type: <string>
presence: optional
content: Deprecated in iOS 9.3.1 and later. The URL pointing to an image of
the user. The 'ResourcePayloadCertificateUUID' identity certificate or the
MDM client identity will be used to perform authentication when fetching the
specified resource.
the user. The system uses the 'ResourcePayloadCertificateUUID' identity certificate
or the MDM client identity to perform authentication when fetching the specified
resource.
- key: AppleID
type: <string>
presence: optional
content: |-
The managed Apple ID for this user.
This key is not required to configure Classroom, but it is used by Classroom if it is present.
This key is required when configuring the Shared iPad login screen.
Not required to configure Classroom, but if set the system uses it.
Required to configure the Shared iPad login screen.
- key: PasscodeType
type: <string>
presence: optional
@@ -249,8 +254,7 @@ payloadkeys:
type: <array>
presence: optional
content: 'For leader/teacher profiles: The array of dictionaries that defines which
device groups the leader can assign devices to. This key is not included in member
payloads.'
device groups the leader can assign devices to. Not included in member payloads.'
subkeys:
- key: DeviceGroupsItem
type: <dictionary>
@@ -279,5 +283,5 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', allows students enrolled in managed classes to modify their
teacher's permissions for screen observation on their device.
content: If 'true', the system allows students enrolled in managed classes to modify
their teacher's permissions for screen observation on their device.
mdm/profiles/com.apple.ews.account.yaml
+20 -15
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.ews.account
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: For macOS 10.9 and higher, an Exchange Web services (EWS) account is configured
with support for Mail, Contacts, Calendar, Notes and Reminders. macOS 10.7-10.8
only supported Contacts.
@@ -25,14 +33,12 @@ payloadkeys:
- key: Host
type: <string>
presence: optional
content: |-
The Exchange server host name or IP address.
If using OAuth, the host name is ignored..
content: The Exchange server host name or IP address. Ignored if using OAuth.
- key: SSL
type: <boolean>
presence: optional
default: true
content: If 'true', enables SSL.
content: If 'true', the system enables SSL.
- key: OAuth
title: Use OAuth
supportedOS:
@@ -41,9 +47,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: |-
If 'true', enables OAuth for authentication. If OAuth is enabled, don't specify a password.
Available in macOS 10.14 and later
content: If 'true', the system enables OAuth for authentication. Don't specify a
password if 'OAuth' is 'true'. Available in macOS 10.14 and later
- key: OAuthSignInURL
title: URL for OAuth sign-in
supportedOS:
@@ -51,14 +56,14 @@ payloadkeys:
introduced: '10.14'
type: <string>
presence: optional
content: The URL to load into a web view for authentication via OAuth when autodiscovery
content: The URL to load into a web view for authentication through OAuth when autodiscovery
isn't used. This setting requires a 'Host' value.
- key: UserName
type: <string>
presence: optional
content: The user name for this Exchange account. This string is required for noninteractive
(for example, MDM) installation. If it's missing, the device prompts for it during
interactive profile installation.
content: The user name for this Exchange account. Required for noninteractive installation,
such as through MDM. If missing, the system prompts the user for it during interactive
profile installation.
- key: Password
type: <string>
presence: optional
@@ -71,7 +76,7 @@ payloadkeys:
type: <string>
presence: optional
format: ^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$
content: The UUID of of the certificate payload within the same profile to use for
content: The UUID of the certificate payload within the same profile to use for
the identity credential. Supported on macOS 10.12 or later.
- key: AuthenticationCertificateUUID
supportedOS:
@@ -79,7 +84,7 @@ payloadkeys:
introduced: '10.11'
type: <string>
presence: optional
content: The UUID of of the certificate payload within the same profile to use for
content: The UUID of the certificate payload within the same profile to use for
the identity credential. Supported on macOS 10.11 or later. On macOS 10.12 or
later use the PayloadCertificateUUID.
- key: allowMailDrop
@@ -90,7 +95,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables Mail Drop.
content: If 'true', the system enables Mail Drop.
- key: Path
type: <string>
presence: optional
@@ -107,7 +112,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: If 'true', enables SSL for connections to the external server.
content: If 'true', the system enables SSL for connections to the external server.
- key: ExternalPath
type: <string>
presence: optional
mdm/profiles/com.apple.extensiblesso(kerberos).yaml
+75 -62
View File
@@ -24,6 +24,12 @@ payload:
allowmanualinstall: false
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Configures the included Kerberos extension that performs SSO on behalf
of specified hosts. User channel support was added in macOS 11.0.
payloadkeys:
@@ -32,25 +38,24 @@ payloadkeys:
presence: required
rangelist:
- com.apple.AppSSOKerberos.KerberosExtension
content: This value must be 'com.apple.AppSSOKerberos.KerberosExtension' for this
extension.
content: Set this to 'com.apple.AppSSOKerberos.KerberosExtension' for this extension.
- key: TeamIdentifier
type: <string>
presence: required
rangelist:
- apple
content: This value must be 'apple' for the Kerberos extension.
content: Set this to 'apple' for this extension.
- key: Type
type: <string>
presence: required
rangelist:
- Credential
content: This value must be 'Credential' for the Kerberos extension.
content: Set this to 'Credential' for this extension.
- key: Realm
type: <string>
presence: required
content: The Kerberos realm, which should be properly capitalized. If in an Active
Directory forest, this is the realm where the user logs in.
content: The Kerberos realm. Use proper capitalization for this value. If in an
Active Directory forest, this is the realm where the user logs in.
- key: ExtensionData
type: <dictionary>
presence: optional
@@ -68,12 +73,12 @@ payloadkeys:
- key: principalName
type: <string>
presence: optional
content: The principal (aka username) to use. You do not need to include the realm.
content: The principal (username) to use. You don't need to include the realm.
- key: siteCode
type: <string>
presence: optional
content: The name of the Active Directory site the Kerberos extension should use.
Most administrators will never need to modify this value, as the Kerberos extension
Most administrators don't need to modify this value, as the Kerberos extension
can normally find the site automatically.
- key: certificateUUID
type: <string>
@@ -93,7 +98,7 @@ payloadkeys:
- key: credentialBundleIdACLItem
type: <string>
presence: optional
content: Bundle IDs allowed to access the TGT. These values are case sensitive.
content: Bundle IDs allowed to access the TGT. These values are case sensitive.
- key: includeManagedAppsInBundleIdACL
supportedOS:
iOS:
@@ -105,7 +110,7 @@ payloadkeys:
default: false
content: If 'true', the Kerberos extension allows only managed apps to access
and use the credential. This is in addition to the 'credentialBundleIDACL',
if it is specified. Available in iOS 14 and later, and macOS 12 and later.
if you specify that value. Available in iOS 14 and later, and macOS 12 and later.
- key: includeKerberosAppsInBundleIdACL
supportedOS:
iOS:
@@ -115,15 +120,16 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: |-
If 'true', the Kerberos extension allows the standard kerberos utilities including 'TicketViewer' and 'klist' to access and use the credential. This is in addition to 'includeManagedAppsInBundleIdACL' or the 'credentialBundleIdACL', if it is specified.
Available in macOS 12 and later.
content: If 'true', the Kerberos extension allows the standard Kerberos utilities
including 'TicketViewer' and 'klist' to access and use the credential. This
is in addition to 'includeManagedAppsInBundleIdACL' or the 'credentialBundleIdACL',
if you specify those values. Available in macOS 12 and later.
- key: domainRealmMapping
type: <dictionary>
presence: optional
content: A custom domain-realm mapping for Kerberos. This is used when the DNS
name of hosts do not match the realm name. Most administrators will not need
to customize this.
content: A custom domain-realm mapping for Kerberos. The system uses this when
the DNS name of hosts doesn't match the realm name. Most administrators don't
need to customize this.
subkeys:
- key: Realm
type: <array>
@@ -139,8 +145,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: This property specifies it is the default realm if there is more than
one Kerberos extension configuration.
content: Specifies whether this is the default realm if there's more than one
Kerberos extension configuration.
- key: customUsernameLabel
supportedOS:
iOS:
@@ -150,7 +156,7 @@ payloadkeys:
type: <string>
presence: optional
content: The custom user name label used in the Kerberos extension instead of
“Username”. For example, “Company ID”. Available in macOS 11 and later.
“Username,” such as “Company ID”. Available in macOS 11 and later.
- key: helpText
supportedOS:
iOS:
@@ -159,9 +165,9 @@ payloadkeys:
introduced: '11.0'
type: <string>
presence: optional
content: The text to be displayed to the user at the bottom of the Kerberos login
window. It can be used to display help information or disclaimer text. Available
in iOS 14 and later and macOS 11 and later.
content: The text to display to the user at the bottom of the Kerberos login window.
You can also use this to display help information or disclaimer text. Available
in iOS 14 and later, and macOS 11 and later.
- key: allowPasswordChange
supportedOS:
iOS:
@@ -169,18 +175,19 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: If 'false', disables password changes. Available in macOS 10.15 and later.
content: If 'false', the system disables password changes. Available in macOS
10.15 and later.
- key: allowAutomaticLogin
type: <boolean>
presence: optional
default: true
content: If 'false', passwords are not allowed to be saved to the keychain.
content: If 'false', the system doesn't allow saving passwords in the keychain.
- key: requireUserPresence
type: <boolean>
presence: optional
default: false
content: If 'true', requires the user to provide Touch ID, Face ID or their passcode
to access the keychain entry.
content: If 'true', the system requires the user to provide Touch ID, Face ID
or their passcode to access the keychain entry.
- key: pwExpireOverride
supportedOS:
iOS:
@@ -189,8 +196,8 @@ payloadkeys:
deprecated: '12.0'
type: <integer>
presence: optional
content: The number of days that passwords can be used on this domain. For most
domains, this can be calculated automatically. Available in macOS 10.15 and
content: The number of days that the system allows using passwords on this domain.
For most domains, this calculation is automatic. Available in macOS 10.15 and
later.
- key: pwNotificationDays
supportedOS:
@@ -199,8 +206,9 @@ payloadkeys:
type: <integer>
presence: optional
default: 15
content: The number of days prior to password expiration when a notification of
password expiration will be sent to the user. Available in macOS 10.15 and later.
content: The number of days prior to password expiration when the system sends
a notification of password expiration to the user. Available in macOS 10.15
and later.
- key: pwReqLength
supportedOS:
iOS:
@@ -216,24 +224,24 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', passwords must meet Active Directory's definition of 'complex'.Available
in macOS 10.15 and later.
content: If 'true', the system requires passwords to meet Active Directory's definition
of 'complex'. Available in macOS 10.15 and later.
- key: pwReqMinAge
supportedOS:
iOS:
introduced: n/a
type: <integer>
presence: optional
content: The minimum age of passwords before they can be changed on this domain.
Available in macOS 10.15 and later.
content: The minimum age of passwords before the system allows changing them on
this domain. Available in macOS 10.15 and later.
- key: pwReqHistory
supportedOS:
iOS:
introduced: n/a
type: <integer>
presence: optional
content: The number of prior passwords that cannot be re-used on this domain.Available
in macOS 10.15 and later.
content: The number of prior passwords that the system disallows reuse on this
domain. Available in macOS 10.15 and later.
- key: pwReqText
supportedOS:
iOS:
@@ -258,8 +266,9 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'false', disables password sync. Note that this will not work if the
user is logged in with a mobile account. Available in macOS 10.15 and later.
content: If 'false', the system disables password sync. Note that this will not
work if the user is logged in with a mobile account. Available in macOS 10.15
and later.
- key: replicationTime
supportedOS:
iOS:
@@ -271,8 +280,8 @@ payloadkeys:
presence: optional
default: 900
content: The time, in seconds, required to replicate changes in the Active Directory
domain. The Kerberos extension will use this when checking password age after
a change. Available in macOS 11 and later.
domain. The Kerberos extension uses this when checking password age after a
change. Available in macOS 11 and later.
- key: delayUserSetup
supportedOS:
iOS:
@@ -282,9 +291,9 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', doesn't prompt the user to setup the Kerberos extension until
either the administrator enables it with the 'app-sso' tool or a Kerberos challenge
is received. Available in macOS 11 and later.
content: If 'true', the system doesn't prompt the user to setup the Kerberos extension
until either the administrator enables it with the 'app-sso' tool or the system
receives a Kerberos challenge. Available in macOS 11 and later.
- key: monitorCredentialsCache
supportedOS:
iOS:
@@ -294,9 +303,9 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: |-
If 'false', the credential is requested on the next matching Kerberos challenge or network state change.
If the credential is expired or missing, a new one will be created. Available in macOS 11 and later.
content: If 'false', the system requests the credential on the next matching Kerberos
challenge or network state change. If the credential is expired or missing,
the system creates a new one. Available in macOS 11 and later.
- key: requireTLSForLDAP
supportedOS:
iOS:
@@ -321,10 +330,12 @@ payloadkeys:
- kerberosDefault
default: always
content: |-
This setting affects how the Kerberos Extension credential is used by other processes. Use of the following:
* 'always -' The extension credential will always be used if the SPN matches the Kerberos Extension 'Hosts' array. The credential will not be used if the calling app is not in the 'credentialBundleIDACL'.
* 'whenNotSpecified -' The credential will only be used when another credential has not been specified by the caller and the SPN matches the Kerberos Extensions 'Hosts' array. The credential will not be used if the calling app is not in the 'credentialBundleIDACL'.
* 'kerberosDefault - 'The default Kerberos processes for selecting credentials is used which normally uses the default Kerberos credential. This is the same as turning off this capability.
This setting affects how other processes use the Kerberos Extension credential. Allowed values:
* 'always': The system always uses the credential if the SPN matches the Kerberos Extension 'Hosts' array and the caller hasn't specified another credential. However, the system won't use the credential if the calling app isn't in the 'credentialBundleIDACL'.
* 'whenNotSpecified': The system only uses the extension credential if the SPN matches the Kerberos Extension 'Hosts' array. However, the system won't use the credential if the calling app isn't in the 'credentialBundleIDACL'.
* 'kerberosDefault': The system uses the default Kerberos processes to select credentials, and normally uses the default Kerberos credential. This is the same as turning off this capability.
Available in macOS 11 and later.
- key: preferredKDCs
supportedOS:
@@ -335,7 +346,7 @@ payloadkeys:
type: <array>
presence: optional
content: |-
The ordered list of preferred Key Distribution Centers (KDCs) to use for Kerberos traffic. Use this if the servers are not discoverable via DNS. If the servers are specified, then they are used for both connectivity checks and attempted first for Kerberos traffic. If the servers do not respond, then the device falls back to DNS discovery. Each entry is formatted the same as it would be in a 'krb5.conf' file. Examples of entries are:
The ordered list of preferred Key Distribution Centers (KDCs) to use for Kerberos traffic. Use this if the servers aren't discoverable through DNS. If the servers are specified, then the system uses them for both connectivity checks and attempts to use them first for Kerberos traffic. If the servers don't respond, the device falls back to DNS discovery. Format each entry the same as it would be in a 'krb5.conf' file, for example:
* 'adserver1.example.com'
* 'tcp/adserver1.example.com:88'
* 'kkdcp://kerberosproxy.example.com:443/kkdcp'
@@ -353,9 +364,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: |-
If 'true', requires this configuration uses a TGT from Platform SSO instead of requesting a new one.
Available in macOS 13 and later.
content: If 'true', the system requires this configuration uses a TGT from Platform
SSO instead of requesting a new one. Available in macOS 13 and later.
- key: allowPlatformSSOAuthFallback
supportedOS:
iOS:
@@ -365,9 +375,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: |-
If 'true' and 'usePlatformSSOTGT' is 'true', allows the user to manually sign in.
Available in macOS 13 and later.
content: If 'true' and 'usePlatformSSOTGT' is 'true', the system allows the user
to manually sign in. Available in macOS 13 and later.
- key: performKerberosOnly
supportedOS:
iOS:
@@ -377,15 +386,19 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: |-
If 'true', the Kerberos Extension handles Kerberos requests only. It doesn't check for password expiration, show the password expiration in the menu, check for external password changes, perform password sync, or retrieve the home directory.
Available in macOS 13 and later.
content: If 'true', the Kerberos Extension handles Kerberos requests only. It
doesn't check for password expiration, show the password expiration in the menu,
check for external password changes, perform password sync, or retrieve the
home directory. Available in macOS 13 and later.
- key: Hosts
type: <array>
presence: optional
content: |-
One or more host or domain names for which the app extension performs SSO. Host or domain names are matched case-insensitively, and all the host/domain names of all installed Extensible SSO payloads must be unique.
Hosts that begin with a “.” are wildcard suffixes and will match all subdomains, otherwise the host must be an exact match.
One or more host or domain names for which the app extension performs SSO.
The system:
* Matches host or domain names case-insensitively
* Requires that all the host and domain names of all installed Extensible SSO payloads are unique
Host names that begin with a “.” are wildcard suffixes that match all subdomains; otherwise the host name needs be an exact match.
subkeys:
- key: hostname
type: <string>
mdm/profiles/com.apple.extensiblesso.yaml
+42 -24
View File
@@ -24,6 +24,17 @@ payload:
allowmanualinstall: false
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: '1.1'
multiple: true
supervised: false
allowmanualinstall: false
userenrollment:
mode: allowed
watchOS:
introduced: n/a
content: Configures an app extension that performs SSO on behalf of certain URLs.
User channel support was added in macOS 11.0.
payloadkeys:
@@ -38,9 +49,8 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: |-
The team identifier of the app extension.
This key is required on macOS and ignored elsewhere.
content: The team identifier of the app extension. This key is required on macOS
and ignored elsewhere.
- key: Type
type: <string>
presence: required
@@ -51,9 +61,8 @@ payloadkeys:
- key: Realm
type: <string>
presence: optional
content: |-
The realm name for 'Credential' payloads. Use proper capitalization for this value.
This key is ignored for 'Redirect' payloads.
content: The realm name for 'Credential' payloads. Use proper capitalization for
this value. Ignored for 'Redirect' payloads.
- key: ExtensionData
type: <dictionary>
presence: optional
@@ -69,7 +78,11 @@ payloadkeys:
content: |-
An array of URL prefixes of identity providers where the app extension performs SSO.
Required for 'Redirect' payloads. Ignored for 'Credential' payloads.
The URLs must begin with 'http://' or 'https://', the scheme and host name are matched case-insensitively, query parameters and URL fragments are not allowed, and the URLs of all installed Extensible SSO payloads must be unique.
The URLs need to begin with 'http://' or 'https://'.
The system:
* Matches scheme and host name case-insensitively
* Doesn't allow query parameters and URL fragments
* Requires that the URLs of all installed Extensible SSO payloads are unique
subkeys:
- key: URL
type: <string>
@@ -79,10 +92,12 @@ payloadkeys:
type: <array>
presence: optional
content: |-
An array of host names or domain names that apps can authenticate through the app extension.
An array of host or domain names that apps can authenticate through the app extension.
Required for 'Credential' payloads. Ignored for 'Redirect' payloads.
Host or domain names are matched case-insensitively, and all the host/domain names of all installed Extensible SSO payloads must be unique.
Hosts that begin with a “.” are wildcard suffixes and match all subdomains; otherwise the host must be an exact match.
The system:
* Matches host or domain names case-insensitively
* Requires that all the host and domain names of all installed Extensible SSO payloads are unique
Host names that begin with a “.” are wildcard suffixes that match all subdomains; otherwise the host name needs be an exact match.
subkeys:
- key: hostname
type: <string>
@@ -100,9 +115,11 @@ payloadkeys:
- Cancel
- DoNotHandle
default: Cancel
content: |-
If set to 'Cancel', the system cancels authentication requests when the screen is locked. If set to 'DoNotHandle', the request continues without SSO instead. This does not apply to requests where 'userInterfaceEnabled' is set to 'false' or background NSURLSession requests.
Available in iOS 15 and later and macOS 12 and later.
content: If set to 'Cancel', the system cancels authentication requests when the
screen is locked. If set to 'DoNotHandle', the request continues without SSO instead.
This doesn't apply to requests where 'userInterfaceEnabled' is 'false', or for
background NSURLSession requests. Available in iOS 15 and later, and macOS 12
and later.
- key: DeniedBundleIdentifiers
supportedOS:
iOS:
@@ -111,9 +128,8 @@ payloadkeys:
introduced: '12.0'
type: <array>
presence: optional
content: |-
An array of bundle identifiers of apps that don't use SSO provided by this extension.
Available in iOS 15 and later and macOS 12 and later.
content: An array of bundle identifiers of apps that don't use SSO provided by this
extension. Available in iOS 15 and later, and macOS 12 and later.
subkeys:
- key: bundleIdentifier
type: <string>
@@ -131,9 +147,9 @@ payloadkeys:
rangelist:
- Password
- UserSecureEnclaveKey
content: |-
The Platform SSO authentication method the extension uses. Requires that the SSO Extension also supports the method.
Available in macOS 13 and later and deprecated in macOS 14.
content: The Platform SSO authentication method the extension uses. Requires that
the SSO Extension also supports the method. Available in macOS 13 and later, and
deprecated in macOS 14.
- key: RegistrationToken
supportedOS:
iOS:
@@ -142,9 +158,9 @@ payloadkeys:
introduced: '13.0'
type: <string>
presence: optional
content: |-
The token this device uses for registration with Platform SSO. Use it for silent registration with the Identity Provider. Requires that 'PlatformSSO' 'AuthenticationMethod' isn't empty.
Available in macOS 13 and later.
content: The token this device uses for registration with Platform SSO. Use it for
silent registration with the Identity Provider. Requires that 'PlatformSSO.AuthenticationMethod'
isn't empty. Available in macOS 13 and later.
- key: PlatformSSO
supportedOS:
iOS:
@@ -222,7 +238,8 @@ payloadkeys:
- Admin
- Groups
content: |-
The permission to apply to newly created accounts at login, which has the following values:
The permission to apply to newly created accounts at login. Allowed values:
* 'Standard': The account is a standard user.
* 'Admin': The system adds the account to the local administrators group.
* 'Groups': The system assigns group to the account using 'AdministratorGroups', 'AdditionalGroups', or 'AuthorizationGroups'.
@@ -234,7 +251,8 @@ payloadkeys:
- Admin
- Groups
content: |-
The permission to apply to an account each time the user authenticates, which has the following values:
The permission to apply to an account each time the user authenticates. Allowed values:
* 'Standard': The account is a standard user.
* 'Admin': The system adds the account to the local administrators group.
* 'Groups': The system assigns group to the account using 'AdministratorGroups', 'AdditionalGroups', or 'AuthorizationGroups'.
mdm/profiles/com.apple.familycontrols.contentfilter.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.familycontrols.contentfilter
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Parental controls web filter.
payloadkeys:
- key: restrictWeb
mdm/profiles/com.apple.familycontrols.timelimits.v2.yaml
+12 -3
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.familycontrols.timelimits.v2
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Parental controls time limits.
payloadkeys:
- key: familyControlsEnabled
@@ -41,9 +49,10 @@ payloadkeys:
- 0
- 1
content: |-
The type of day range:
0 = Weekday
1 = Weekend
The type of day range, which has the following possible values:
* '0': Weekday
* '1': Weekend
- key: start
type: <string>
presence: optional
mdm/profiles/com.apple.fileproviderd.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.fileproviderd
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: false
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: AllowManagedFileProvidersToRequestAttribution
type: <boolean>
mdm/profiles/com.apple.finder.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.finder
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: ProhibitBurn
type: <boolean>
mdm/profiles/com.apple.firstactiveethernet.managed.yaml
+9 -1
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.firstactiveethernet.managed
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,10 +15,16 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: ANY
type: <any>
presence: optional
content: Keys relevant to 802.1x configuration. User enrollment payloads do not
content: Keys relevant to 802.1x configuration. User enrollment payloads do not
support the various proxy keys including ProxyType, ProxyServer, ProxyServerPort,
ProxyUsername, ProxyPassword,, ProxyPACURL and ProxyPACFallbackAllowed.
mdm/profiles/com.apple.firstethernet.managed.yaml
+9 -1
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.firstethernet.managed
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,10 +15,16 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: ANY
type: <any>
presence: optional
content: Keys relevant to 802.1x configuration. User enrollment payloads do not
content: Keys relevant to 802.1x configuration. User enrollment payloads do not
support the various proxy keys including ProxyType, ProxyServer, ProxyServerPort,
ProxyUsername, ProxyPassword,, ProxyPACURL and ProxyPACFallbackAllowed.
mdm/profiles/com.apple.font.yaml
+6
View File
@@ -22,6 +22,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
Each payload may contain one font file. Font files may be in TrueType (.ttf) or OpenType (.otf) file format. Collection types (.ttc or .otc) formats are not supported.
Fonts are uniquely identified internally by their embedded PostScript name. Two fonts with the same PostScript name will be considered the same font, even if their contents differ. Installing two different fonts with the same PostScript name is not supported, and it is undefined which font will remain installed.
mdm/profiles/com.apple.gamed.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.gamed
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Parental controls Game Center restrictions.
payloadkeys:
- key: GKFeatureGameCenterAllowed
mdm/profiles/com.apple.globalethernet.managed.yaml
+7 -3
View File
@@ -29,10 +29,14 @@ payload:
multiple: false
supervised: false
allowmanualinstall: true
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: ANY
type: <any>
presence: optional
content: Keys relevant to 802.1X configuration. User enrollment payloads do not
support the various proxy keys including ProxyType, ProxyServer, ProxyServerPort,
ProxyUsername, ProxyPassword, ProxyPACURL and ProxyPACFallbackAllowed.
content: Keys relevant to 802.1X configuration. User enrollment payloads don't support
the various proxy keys, including 'ProxyType', 'ProxyServer', 'ProxyServerPort',
'ProxyUsername', 'ProxyPassword', 'ProxyPACURL' and 'ProxyPACFallbackAllowed'.
mdm/profiles/com.apple.google-oauth.yaml
+17 -5
View File
@@ -15,6 +15,19 @@ payload:
userchannel: true
userenrollment:
mode: allowed
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: '1.1'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: n/a
content: A Google account payload sets up a Google email address as well as any
other Google services the user enables after authentication. Google accounts must
be installed via MDM or by Apple Configurator 2 (if the device is supervised).
@@ -57,7 +70,7 @@ payloadkeys:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary defining which app to use for audio calls made from this
content: A dictionary that defines which app to use for audio calls from this
account.
subkeys:
- key: AudioCall
@@ -69,8 +82,8 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: A string containing the bundle identifier for the default application
that handles audio calls made to contacts from this account.
content: The bundle identifier for the default application that handles audio
calls to contacts from this account.
- key: VPNUUID
title: VPNUUID
supportedOS:
@@ -78,6 +91,5 @@ payloadkeys:
introduced: '14.0'
type: <string>
presence: optional
content: |-
The VPNUUID of the per-app VPN the account uses for network communication.
content: The VPNUUID of the per-app VPN the account uses for network communication.
Available in iOS 14 and later.
mdm/profiles/com.apple.homescreenlayout.yaml
+6
View File
@@ -14,11 +14,17 @@ payload:
userchannel: true
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: '11.0'
multiple: false
supervised: true
allowmanualinstall: true
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: The payload defines a layout of apps, folders, & web clips for the Home
screen.
payloadkeys:
mdm/profiles/com.apple.ironwood.support.yaml
+8
View File
@@ -3,6 +3,8 @@ description: Parental controls for restricting Siri, Dictation and Profanity
payload:
payloadtype: com.apple.ironwood.support
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
deprecated: '10.13'
@@ -14,6 +16,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: Profanity Allowed
type: <boolean>
mdm/profiles/com.apple.jabber.account.yaml
+8
View File
@@ -4,6 +4,8 @@ description: Use this section to define settings for configuration access to Jab
payload:
payloadtype: com.apple.jabber.account
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
deprecated: '10.14'
@@ -16,6 +18,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: A Jabber payload creates a Jabber account on the device.
payloadkeys:
- key: JabberAccountDescription
mdm/profiles/com.apple.ldap.account.yaml
+19 -8
View File
@@ -25,6 +25,17 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: '1.1'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: n/a
payloadkeys:
- key: LDAPAccountDescription
title: Account Description
@@ -45,13 +56,13 @@ payloadkeys:
title: Account Password
type: <string>
presence: optional
content: The user's password. The password is enabled only with encrypted profiles.
content: The user's password. Only use this with encrypted profiles.
- key: LDAPAccountUseSSL
title: Use SSL
type: <boolean>
presence: optional
default: true
content: If 'true', enables SSL.
content: If 'true', the system enables SSL.
- key: LDAPSearchSettings
title: Search Settings
type: <array>
@@ -82,10 +93,11 @@ payloadkeys:
- LDAPSearchSettingScopeSubtree
default: LDAPSearchSettingScopeSubtree
content: |-
The type of recursion to use in the search. It is one of the following values:
* 'LDAPSearchSettingScopeBase': Only the immediate node that the search base points to.
* 'LDAPSearchSettingScopeOneLevel': The node plus its immediate children.
* 'LDAPSearchSettingScopeSubtree': The node plus all children, regardless of depth.
The type of recursion to use in the search. Allowed values:
* 'LDAPSearchSettingScopeBase': Only the immediate node that the search base points to
* 'LDAPSearchSettingScopeOneLevel': The node plus its immediate children
* 'LDAPSearchSettingScopeSubtree': The node plus all children, regardless of depth
- key: VPNUUID
title: VPNUUID
supportedOS:
@@ -95,6 +107,5 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: |-
The VPNUUID of the per-app VPN the account uses for network communication.
content: The VPNUUID of the per-app VPN the account uses for network communication.
Available in iOS 14 and later.
mdm/profiles/com.apple.loginitems.managed.yaml
+10 -1
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.loginitems.managed
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This payload handles login items usage on macOS.
payloadkeys:
- key: AutoLaunchedApplicationDictionary-managed
@@ -33,4 +41,5 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', hide this item in the Users & Groups login items list.
content: If 'true', the system hides this item in the Users & Groups login items
list.
mdm/profiles/com.apple.loginwindow.yaml
+41 -29
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.loginwindow
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: The com.apple.loginwindow payload creates managed preferences on macOS
for system/device profiles.
payloadkeys:
@@ -20,28 +28,29 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', shows the name and password dialog; if 'false', displays a list
of users.
content: If 'true', the system shows the name and password dialog. If 'false', the
system displays a list of users.
- key: HideLocalUsers
type: <boolean>
presence: optional
default: false
content: If 'true', shows only network and system users when showing a user list.
content: If 'true', the system shows only network and system users when showing
a user list.
- key: IncludeNetworkUser
type: <boolean>
presence: optional
default: false
content: If 'true', shows network users when showing a user list.
content: If 'true', the system shows network users when showing a user list.
- key: HideAdminUsers
type: <boolean>
presence: optional
default: false
content: If 'true', hides administrator users when showing a user list.
content: If 'true', the system hides administrator users when showing a user list.
- key: SHOWOTHERUSERS_MANAGED
type: <boolean>
presence: optional
default: false
content: If 'true', displays Other... when showing a list of users.
content: If 'true', the system displays “Other...” when it shows a list of users.
- key: AdminHostInfo
type: <string>
presence: optional
@@ -49,16 +58,16 @@ payloadkeys:
- HostName
- SystemVersion
- IPAddress
content: If this key is included in the payload, its value is displayed in the login
window as additional computer information. Before macOS 10.10, this string could
contain only certain information (host name, system version, or IP address). After
content: The admin host info. If present in the payload, the system displays its
value in the login window as additional computer information. Before macOS 10.10,
this string could only contain host name, system version, or IP address. After
macOS 10.10, setting this key to any value allows the user to click the time area
of the menu bar to toggle through various computer information values.
- key: AllowList
type: <array>
presence: optional
content: The list of user GUIDs or group GUIDs of users that are allowed to log
in. An asterisk '*' string specifies all users or groups.
content: The list of user GUIDs or group GUIDs of users that the system allows to
log in. An asterisk ('*') string specifies all users or groups.
subkeys:
- key: AllowListItem
type: <string>
@@ -67,8 +76,8 @@ payloadkeys:
- key: DenyList
type: <array>
presence: optional
content: The list of user GUIDs or group GUIDs of users that cannot log in. This
list takes priority over the list in the 'AllowList' key.
content: The list of user GUIDs or group GUIDs of users that the system disallows
to log in. This list takes priority over the list in the 'AllowList' key.
subkeys:
- key: DenyListItem
type: <string>
@@ -78,29 +87,29 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', hides mobile account users in a user list. In some cases, mobile
users show up as network users.
content: If 'true', the system hides mobile account users in a user list. In some
cases, mobile users show up as network users.
- key: ShutDownDisabled
type: <boolean>
presence: optional
default: false
content: If 'true', disables the Shut Down button.
content: If 'true', the system disables the Shut Down button.
- key: RestartDisabled
type: <boolean>
presence: optional
default: false
content: If 'true', disables the Restart item.
content: If 'true', the system disables the Restart item.
- key: SleepDisabled
type: <boolean>
presence: optional
default: false
content: If 'true', disables the Sleep button.
content: If 'true', the system disables the Sleep button.
- key: DisableConsoleAccess
type: <boolean>
presence: optional
default: false
content: If 'true', disregards the '>console' special user name, which will provide
a command line UI.
content: If 'true', the system disregards the '>console' special user name, which
provides a command line UI.
- key: LoginwindowText
type: <string>
presence: optional
@@ -109,17 +118,20 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', disables the Shut Down menu item when the user is logged in.
content: If 'true', the system disables the Shut Down menu item when the user is
logged in.
- key: RestartDisabledWhileLoggedIn
type: <boolean>
presence: optional
default: false
content: If 'true', disables the Restart menu item when the user is logged in.
content: If 'true', the system disables the Restart menu item when the user is logged
in.
- key: PowerOffDisabledWhileLoggedIn
type: <boolean>
presence: optional
default: false
content: If 'true', disables the Power Off menu item when the user is logged in.
content: If 'true', the system disables the Power Off menu item when the user is
logged in.
- key: LogOutDisabledWhileLoggedIn
supportedOS:
macOS:
@@ -127,8 +139,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', disables the Log Out menu item when the user is logged in. Available
in macOS 10.13 and later.
content: If 'true', the system disables the Log Out menu item when the user is logged
in. Available in macOS 10.13 and later.
- key: DisableScreenLockImmediate
supportedOS:
macOS:
@@ -136,8 +148,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', disables the immediate Screen Lock functions. Available in macOS
10.13 and later.
content: If 'true', the system disables the immediate Screen Lock functions. Available
in macOS 10.13 and later.
- key: showInputMenu
supportedOS:
macOS:
@@ -145,7 +157,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', shows the Input Menu in the login window.
content: If 'true', the system shows the Input Menu in the login window.
- key: DisableFDEAutoLogin
supportedOS:
macOS:
@@ -153,7 +165,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', disables the automatic login option when using FileVault.
content: If 'true', the system disables the automatic login option when using FileVault.
- key: AutologinUsername
supportedOS:
macOS:
mdm/profiles/com.apple.lom.yaml
+10 -2
View File
@@ -4,6 +4,8 @@ description: Configures a computer to send or receive "PowerON". "PowerOFF", "Re
payload:
payloadtype: com.apple.lom
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
multiple: false
@@ -14,6 +16,12 @@ payload:
allowmanualinstall: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Configures a computer to send or receive "PowerON". "PowerOFF", "Reset"
requests.
payloadkeys:
@@ -37,7 +45,7 @@ payloadkeys:
title: CA certificate payload UUIDs
type: <array>
presence: optional
content: Array of payload UUIDs containing CA certificates that controllers use
content: An array of payload UUIDs containing CA certificates that controllers use
to evaluate trust of device certificates.
subkeys:
- key: DeviceCACertificateUUIDsItem
@@ -47,7 +55,7 @@ payloadkeys:
type: <array>
presence: optional
content: |-
Array of payload UUIDs containing CA certificates that devices use to evaluate trust of controller certificates.
An array of payload UUIDs containing CA certificates that devices use to evaluate trust of controller certificates.
This key configures the device to accept the LOMDeviceRequestCommand from MDM and then send it to the target device. This certificate must contain the Key Usage attributes of Digital Signature, Key Encipherment and Data Encipherment. As well as the Extended Key Usage attributes of Server Authentication and Client Authentication.
subkeys:
- key: ControllerCACertificateUUIDsItem
mdm/profiles/com.apple.mail.managed.yaml
+57 -44
View File
@@ -24,6 +24,17 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: '1.1'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: n/a
content: An email payload creates an email account on the device.
payloadkeys:
- key: EmailAccountDescription
@@ -36,7 +47,8 @@ payloadkeys:
title: Account Name
type: <string>
presence: optional
content: The full user name for the account. This name is shown in sent messages.
content: The full user name for the account. The system displays this name in sent
messages.
- key: EmailAccountType
title: Account Type
type: <string>
@@ -44,14 +56,14 @@ payloadkeys:
rangelist:
- EmailTypeIMAP
- EmailTypePOP
content: Defines the protocol to be used for the account.
content: Defines the protocol to use for the account.
- key: EmailAddress
title: Email Address
type: <string>
presence: optional
content: The full email address for the account. If this string isn't present in
the payload, the device prompts for this string during interactive profile installation
in Settings or System Preferences.
the payload, the device prompts the user for this string during interactive profile
installation in Settings or System Preferences.
- key: IncomingMailServerAuthentication
title: Incoming Mail Server Authentication
type: <string>
@@ -72,42 +84,43 @@ payloadkeys:
title: Port
type: <integer>
presence: optional
content: The incoming mail server port number. If no port number is specified, the
default port for a given protocol is used.
content: The incoming mail server port number. If not set, the system uses the default
port for a given protocol.
- key: IncomingMailServerUseSSL
title: Use SSL
type: <boolean>
presence: optional
default: false
content: If 'true', enables SSL for authentication on the incoming mail server.
content: If 'true', the system enables SSL for authentication on the incoming mail
server.
- key: IncomingMailServerUsername
title: Username
type: <string>
presence: optional
content: The user name for the email account, usually the same as the email address
up to the @ character. If the user name isn't present in the payload and the account
is set up to require authentication for incoming email, the device prompts for
this string during interactive profile installation in Settings or System Preferences.
up to the “@” character. If not set and the account requires authentication for
incoming email, the device prompts the user for this string during interactive
profile installation in Settings or System Preferences.
- key: IncomingPassword
title: Password
type: <string>
presence: optional
content: The password for the incoming mail server. This password is used only with
encrypted profiles.
content: The password for the incoming mail server. Only use this with encrypted
profiles.
- key: OutgoingPassword
title: Password
type: <string>
presence: optional
content: The password for the outgoing mail server. This password is used only with
encrypted profiles.
content: The password for the outgoing mail server. Only uses this with encrypted
profiles.
- key: OutgoingPasswordSameAsIncomingPassword
title: Outgoing Password Same As Incoming
type: <boolean>
presence: optional
default: false
content: |-
If 'true', the user is prompted only once for the password, which is used for both outgoing and incoming mail.
This setting is only supported by interactive profile installations. Not supported by non-interactive installations (like MDM on iOS).
If 'true', the system prompts the user only once for the password, which it uses for both outgoing and incoming mail.
This setting is only supported by interactive profile installations. Not supported by non-interactive installations, such as MDM on iOS.
- key: OutgoingMailServerAuthentication
title: Authentication Type
type: <string>
@@ -128,22 +141,22 @@ payloadkeys:
title: Port
type: <integer>
presence: optional
content: The outgoing mail server port number. If no port number is specified, ports
25, 587, and 465 are used, in that order.
content: The outgoing mail server port number. If not set, the system uses ports
25, 587, and 465, in that order.
- key: OutgoingMailServerUseSSL
title: Use SSL
type: <boolean>
presence: optional
default: false
content: If 'true', enables SSL authentication on the outgoing mail server.
content: If 'true', the system enables SSL authentication on the outgoing mail server.
- key: OutgoingMailServerUsername
title: Username
type: <string>
presence: optional
content: The user name for the email account, usually the same as the email address
up to the @ character. If the user name isn't present in the payload and the account
is set up to require authentication for outgoing email, the device prompts for
this string during interactive profile installation in Settings or System Preferences.
up to the “@” character. If not set and the account requires authentication for
outgoing email, the device prompts the user for this string during interactive
profile installation in Settings or System Preferences.
- key: PreventMove
title: Prevent Move
supportedOS:
@@ -154,9 +167,9 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', prevents messages from being moved out of this email account
content: If 'true', the system prevents moving messages out of this email account
and into another account. It also prevents forwarding or replying from an account
other than one the message was sent to.
other than the recipient of the message.
- key: PreventAppSheet
title: Prevent App Sheet
supportedOS:
@@ -167,8 +180,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', prevents this account from sending mail in any app other than
the Apple Mail app.
content: If 'true', the system prevents this account from sending mail in any app
other than the Apple Mail app.
- key: SMIMEEnabled
title: S/MIME Enabled
supportedOS:
@@ -179,8 +192,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables S/MIME encryption. In iOS 10.0 and later, this key is
ignored.
content: If 'true', the system enables S/MIME encryption. The system ignores this
key in iOS 10.0 and later.
- key: SMIMESigningEnabled
title: S/MIME Signing Enabled
supportedOS:
@@ -191,7 +204,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables S/MIME signing for this account.
content: If 'true', the system enables S/MIME signing for this account.
- key: SMIMESigningCertificateUUID
title: S/MIME Signing Certificate
supportedOS:
@@ -214,7 +227,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables S/MIME encryption for this account.
content: If 'true', the system enables S/MIME encryption for this account.
- key: SMIMEEncryptionCertificateUUID
title: S/MIME Encryption Certificate
supportedOS:
@@ -226,9 +239,9 @@ payloadkeys:
presence: optional
format: ^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$
content: The UUID of the identity certificate used to decrypt messages sent to this
account. The public certificate is attached to outgoing mail to allow encrypted
mail to be sent to this user. When the user sends encrypted mail, the public certificate
is used to encrypt the copy of the mail in their Sent mailbox.
account. The system attaches the public certificate to outgoing mail to allow
the user to receive encrypted mail. When the user sends encrypted mail, the system
uses the public certificate to encrypt the copy of the mail in their Sent mailbox.
- key: SMIMEEnablePerMessageSwitch
title: S/MIME Enable Per-Message Switch
supportedOS:
@@ -237,13 +250,14 @@ payloadkeys:
deprecated: '10.0'
macOS:
introduced: n/a
visionOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: |-
If 'true', displays the per-message encryption switch in the Mail Compose UI.
As of iOS 12.0, this key is deprecated. Use 'SMIMEEnableEncryptionPerMessageSwitch' instead.
content: If 'true', the system displays the per-message encryption switch in the
Mail Compose UI. Deprecated in iOS 12.0. Use 'SMIMEEnableEncryptionPerMessageSwitch'
instead.
- key: disableMailRecentsSyncing
title: Disable Mail Recents Syncing
supportedOS:
@@ -252,7 +266,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', excludes this account from Recent Addresses syncing.
content: If 'true', the system excludes this account from Recent Addresses syncing.
- key: allowMailDrop
title: Allow Mail Drop
supportedOS:
@@ -263,7 +277,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables this account to use Mail Drop.
content: If 'true', the system enables this account to use Mail Drop.
- key: IncomingMailServerIMAPPathPrefix
title: Path Prefix
type: <string>
@@ -298,7 +312,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables S/MIME encryption by default.
content: If 'true', the system enables S/MIME encryption by default.
- key: SMIMEEncryptByDefaultUserOverrideable
supportedOS:
iOS:
@@ -330,8 +344,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', displays the per-message encryption switch in the Mail Compose
UI.
content: If 'true', the system displays the per-message encryption switch in the
Mail Compose UI.
- key: VPNUUID
title: VPNUUID
supportedOS:
@@ -341,6 +355,5 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: |-
The VPNUUID of the per-app VPN the account uses for network communication.
content: The VPNUUID of the per-app VPN the account uses for network communication.
Available in iOS 14 and later.
mdm/profiles/com.apple.mcxMenuExtras.yaml
+8
View File
@@ -2,6 +2,8 @@ title: Managed Menu Extras
payload:
payloadtype: com.apple.mcxMenuExtras
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -12,6 +14,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
Specified menu extras will be added or removed from the menu bar
after user login. Standard menu extra may be specified by file
mdm/profiles/com.apple.mcxloginscripts.yaml
+10 -2
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.mcxloginscripts
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Login and logout managed script handling
payloadkeys:
- key: loginscripts
@@ -42,9 +50,9 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', doesn't execute the login scripts during login.
content: If 'true', the system doesn't execute the login scripts during login.
- key: skipLogoutHook
type: <boolean>
presence: optional
default: false
content: If 'true', doesn't execute the logout scripts during logout.
content: If 'true', the system doesn't execute the logout scripts during logout.
mdm/profiles/com.apple.mcxprinting.yaml
+8
View File
@@ -2,6 +2,8 @@ title: Printing
payload:
payloadtype: com.apple.mcxprinting
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -12,6 +14,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: RequireAdminToAddPrinters
type: <boolean>
mdm/profiles/com.apple.mdm.yaml
+51 -38
View File
@@ -29,6 +29,13 @@ payload:
multiple: false
supervised: false
allowmanualinstall: true
visionOS:
introduced: '1.1'
multiple: false
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
multiple: false
@@ -64,7 +71,7 @@ payloadkeys:
format: ^https://.*$
content: The URL that the device should use to check in during installation. The
URL must begin with the 'https://' URL scheme and may contain a port number (':1234',
for example). If this URL isn't given, 'ServerURL' is used for both purposes.
for example). If not set, the system uses 'ServerURL'.
- key: SignMessage
title: Sign Message
type: <boolean>
@@ -81,25 +88,29 @@ payloadkeys:
macOS:
userenrollment:
mode: ignored
visionOS:
userenrollment:
mode: ignored
type: <integer>
presence: optional
content: |-
Logical OR of the following bit flags:
'1': Allow inspection of installed configuration profiles.
'2': Allow installation and removal of configuration profiles.
'4': Allow device lock and passcode removal.
'8': Allow device erase.
'16': Allow query of device information (device capacity, serial number).
'32': Allow query of network information (phone/SIM numbers, MAC addresses).
'64': Allow inspection of installed provisioning profiles.
'128': Allow installation and removal of provisioning profiles.
'256': Allow inspection of installed applications.
'512': Allow restriction-related queries.
'1024': Allow security-related queries.
'2048': Allow manipulation of settings.
'4096': Allow app management.
The value can't be '0'. If '2' is specified, '1' must also be specified. If '128' is specified, '64' must also be specified.
If the 'ManagedAppleID' is included, then 'AccessRights' are ignored.
* '1': Allow inspection of installed configuration profiles.
* '2': Allow installation and removal of configuration profiles.
* '4': Allow device lock and passcode removal.
* '8': Allow device erase.
* '16': Allow query of device information (device capacity, serial number).
* '32': Allow query of network information (phone/SIM numbers, MAC addresses).
* '64': Allow inspection of installed provisioning profiles.
* '128': Allow installation and removal of provisioning profiles.
* '256': Allow inspection of installed applications.
* '512': Allow restriction-related queries.
* '1024': Allow security-related queries.
* '2048': Allow manipulation of settings.
* '4096': Allow app management.
Don't set to '0'. Specify '1' if you specify '2'. Specify '64' if you specify '128'. Ignored if you set a value for 'ManagedAppleID'.
- key: UseDevelopmentAPNS
title: Use Development APNS
type: <boolean>
@@ -107,7 +118,7 @@ payloadkeys:
default: false
content: |-
If 'true', the device uses the development APNS servers. Otherwise, the device uses the production servers.
Note that this property must be set to 'false' if your Apple Push Notification Service certificate was issued by the Apple Push Certificate Portal ('https://identity.apple.com/pushcert'). That portal only issues certificates for the production push environment.
Set to 'false' if your Apple Push Notification Service certificate was issued by the Apple Push Certificate Portal ('https://identity.apple.com/pushcert'). That portal only issues certificates for the production push environment.
- key: ManagedAppleID
title: Managed Apple ID
supportedOS:
@@ -123,15 +134,16 @@ payloadkeys:
mode: required
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The Managed Apple ID of the user. Available in iOS 13.1 and later, and
macOS 10.15 and later. This is only used with the profile-driven BYOD enrollment
flow, and must not be present in the BYOD and ADDE account-driven enrollment flows.
As of iOS 17 and macOS 14, profile-driven user enrollments are deprecated and
will be removed in a future release.
content: The Managed Apple ID of the user. Required for profile-driven user enrollment.
Don't set for account-driven enrollment. Available in iOS 13.1 and later, and
macOS 10.15 and later. As of iOS 17 and macOS 14, profile-driven user enrollment
is deprecated and will be removed in a future release.
- key: AssignedManagedAppleID
title: Assigned Managed Apple ID
supportedOS:
@@ -145,9 +157,9 @@ payloadkeys:
introduced: n/a
type: <string>
presence: optional
content: The Managed Apple ID pre-assigned to the authenticated user. This is required
for the BYOD and ADDE account-driven enrollment flows, and must not be present
in other enrollment flows. Available in iOS 15 and macOS 14, and later.
content: The Managed Apple ID pre-assigned to the authenticated user. The system
only uses this value with account-driven enrollment. Don't set this value for
profile-driven user enrollment. Available in iOS 15 and later.
- key: EnrollmentMode
title: Enrollment Mode
supportedOS:
@@ -164,10 +176,9 @@ payloadkeys:
rangelist:
- BYOD
- ADDE
content: The enrollment mode the server indicates must be used when enrolling. This
key must be present for BYOD and ADDE account-driven enrollments, and must not
be present in the profile-driven user enrollment flow. Available in iOS 15 and
macOS 14, and later.
content: The enrollment mode the server indicates to use when enrolling. Required
for account-driven enrollment. Don't set for profile-driven user enrollment. Available
in iOS 15 and macOS 14, and later.
- key: ServerURLPinningCertificateUUIDs
supportedOS:
iOS:
@@ -178,8 +189,8 @@ payloadkeys:
introduced: '13.4'
type: <array>
presence: optional
content: An array of strings, each containing the UUID of a certificate to be used
when evaluating trust to the '.../connect/' URLs of MDM servers.
content: An array of strings, each containing the UUID of a certificate to use when
evaluating trust to the '.../connect/' URLs of MDM servers.
subkeys:
- key: ServerURLPinningCertificateUUIDsItem
type: <string>
@@ -196,7 +207,7 @@ payloadkeys:
type: <array>
presence: optional
content: An array of strings, each containing the payload UUID of a certificate
to be used when evaluating trust to the '.../checkin/' URLs of MDM servers.
to use when evaluating trust to the '.../checkin/' URLs of MDM servers.
subkeys:
- key: CheckInURLPinningCertificateUUIDsItem
type: <string>
@@ -214,14 +225,14 @@ payloadkeys:
presence: optional
default: false
content: |-
If 'true', fails the connection attempt unless a verified positive response is obtained during certificate revocation checks.
If 'false', revocation checks are done on a best-attempt basis, where failure to reach the server isn't considered fatal.
If 'true', the system fails the connection attempt unless it obtains a verified positive response during certificate revocation checks.
If 'false', the system performs revocation checks on a best-attempt basis, where failure to reach the server isn't considered fatal.
- key: ServerCapabilities
type: <array>
presence: optional
content: |-
A unique array of strings indicating server capabilities. If the server manages macOS devices or a Shared iPad, this field is mandatory and must contain the value 'com.apple.mdm.per-user-connections', which indicates that the server supports both device and user connections.
Starting with macOS 11, it is also recommended that macOS device enrollment profiles contain the value 'com.apple.mdm.bootstraptoken' to ensure the Bootstrap Token is created and escrowed with the MDM server at enrollment time.
Starting with macOS 11, it's also recommended that macOS device enrollment profiles contain the value 'com.apple.mdm.bootstraptoken' to ensure the Bootstrap Token is created and escrowed with the MDM server at enrollment time.
If the server supports the "GetToken" CheckIn message type, then this key must be present and must include "com.apple.mdm.token" as one of its values.
subkeys:
- key: ServerCapabilitiesItems
@@ -249,8 +260,8 @@ payloadkeys:
type: <integer>
presence: optional
content: |-
This property specifies an iTunes Store ID for an app the system can install with the InstallApplicationCommand, without any approval from the user. The MDM vendor or managing organization generally provides this app, which enhances the management experience for the user. The device shows the user details about this app in the account-driven enrollment process prior to installing the MDM profile. Use this property with account-driven MDM enrollments that normally require user approval for app installs through MDM.
Only account-driven user enrollments support this property and other enrollment types ignore it.
This property specifies an iTunes Store ID for an app the system can install with the InstallApplicationCommand, without any approval from the user. The MDM vendor or managing organization generally provides this app, which enhances the management experience for the user. The device shows the user details about this app in the account-driven enrollment process prior to installing the MDM profile. Use this property with account-driven MDM enrollment that normally requires user approval for app installs through MDM.
Only account-driven enrollment supports this property and other enrollment types ignore it.
Available in iOS 15.1 and later.
- key: PromptUserToAllowBootstrapTokenForAuthentication
supportedOS:
@@ -260,13 +271,15 @@ payloadkeys:
introduced: '11.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: |-
If 'true', warns the user that they need to reboot into RecoveryOS and allow the MDM to use the Bootstrap Token for authentication for certain sensitive operations such as enabling kernel extensions or installing some types of software updates. If the MDM doesn't need to perform these operations, it can leave this key set to 'false', and the user won't be notified.
If 'true', the system warns the user that they need to reboot into RecoveryOS and allow the MDM to use the Bootstrap Token for authentication for certain sensitive operations such as enabling kernel extensions or installing some types of software updates. If the MDM doesn't need to perform these operations, it can leave this key set to 'false', and the user isn't notified.
The SettingsCommand.Command.Settings.MDMOptions.MDMOptions command overrides this default value.
This setting only applies to devices that have 'BootstrapTokenRequiredForSoftwareUpdate' or 'BootstrapTokenRequiredForKernelExtensionApproval' set to 'true' in their SecurityInfoResponse.SecurityInfo.
DEP-enrolled devices are automatically allowed to use the Bootstrap Token for authentication.
mdm/profiles/com.apple.mobiledevice.passwordpolicy.yaml
+4
View File
@@ -22,6 +22,10 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: '10.0'
multiple: true
mdm/profiles/com.apple.networkusagerules.yaml
+12 -1
View File
@@ -14,6 +14,14 @@ payload:
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Network Usage Rules allow enterprises to specify how devices use networks,
such as cellular data networks. iOS 9-12 support only ApplicationRules. In iOS
13, ApplicationRules, SIMRules, or both must be present.
@@ -78,6 +86,9 @@ payloadkeys:
- 2
- 3
content: |-
The Wi-Fi Assist policy to apply to the SIM cards specified in the ICCIDs. See About Wi-Fi Assist <https://support.apple.com/en-us/HT205296> to learn more.
The Wi-Fi Assist policy to apply to the SIM cards specified in the ICCIDs. Allowed values:
* '2': Use the default system policy for the specified SIM card(s).
* '3': Make Wi-Fi Assist switch more aggressively from a poor Wi-Fi connection to cellular data for the specified SIM card(s). This setting may increase cellular data use and may impact battery life.
For more information, see About Wi-Fi Assist <https://support.apple.com/en-us/HT205296>.
mdm/profiles/com.apple.notificationsettings.yaml
+6
View File
@@ -23,6 +23,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: A notification settings payload specifies the restriction enforced notification
settings for apps using their bundle identifier. The profile specifies notification
settings by bundle identifier (even for apps that aren’t installed on the device
mdm/profiles/com.apple.osxserver.account.yaml
+8
View File
@@ -14,6 +14,14 @@ payload:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: HostName
title: Account Hostname
mdm/profiles/com.apple.preference.security.yaml
+8
View File
@@ -2,6 +2,8 @@ title: Security Preferences
payload:
payloadtype: com.apple.preference.security
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.10'
multiple: false
@@ -12,6 +14,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: dontAllowPasswordResetUI
type: <boolean>
mdm/profiles/com.apple.preferences.users.yaml
+8
View File
@@ -2,6 +2,8 @@ title: User Preferences
payload:
payloadtype: com.apple.preference.users
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.12'
multiple: false
@@ -12,6 +14,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: DisableUsingiCloudPassword
type: <boolean>
mdm/profiles/com.apple.profileRemovalPassword.yaml
+5 -1
View File
@@ -27,9 +27,13 @@ payload:
multiple: false
supervised: true
allowmanualinstall: true
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: RemovalPassword
title: Removal Password
type: <string>
presence: optional
content: The password for allowing the profile to be removed.
content: The password to allow removing the profile.
mdm/profiles/com.apple.proxy.http.global.yaml
+4
View File
@@ -29,6 +29,10 @@ payload:
multiple: false
supervised: true
allowmanualinstall: true
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: PEM-encoded cer
payloadkeys:
- key: ProxyType
mdm/profiles/com.apple.relay.managed.yaml
+11
View File
@@ -24,6 +24,17 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: '1.0'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: forbidden
watchOS:
introduced: n/a
payloadkeys:
- key: Relays
title: Relays
mdm/profiles/com.apple.screensaver.user.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.screensaver.user
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Specifies *user* screensaver settings. (Settings for loginwindow screensaver
use a different payload)
payloadkeys:
mdm/profiles/com.apple.screensaver.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.screensaver
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Specifies grace period for screensaver locking
payloadkeys:
- key: askForPassword
mdm/profiles/com.apple.secondactiveethernet.managed.yaml
+9 -1
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.secondactiveethernet.managed
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,10 +15,16 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: ANY
type: <any>
presence: optional
content: Keys relevant to 802.1x configuration. User enrollment payloads do not
content: Keys relevant to 802.1x configuration. User enrollment payloads do not
support the various proxy keys including ProxyType, ProxyServer, ProxyServerPort,
ProxyUsername, ProxyPassword,, ProxyPACURL and ProxyPACFallbackAllowed.
mdm/profiles/com.apple.secondethernet.managed.yaml
+9 -1
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.secondethernet.managed
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.7'
multiple: false
@@ -13,10 +15,16 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: ANY
type: <any>
presence: optional
content: Keys relevant to 802.1x configuration. User enrollment payloads do not
content: Keys relevant to 802.1x configuration. User enrollment payloads do not
support the various proxy keys including ProxyType, ProxyServer, ProxyServerPort,
ProxyUsername, ProxyPassword,, ProxyPACURL and ProxyPACFallbackAllowed.
mdm/profiles/com.apple.security.FDERecoveryKeyEscrow.yaml
+13 -6
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.security.FDERecoveryKeyEscrow
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
multiple: false
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
If FileVault is enabled after this payload is installed on the system, the FileVault PRK will be encrypted with the specified certificate, wrapped with a CMS envelope and stored at:
/var/db/FileVaultPRK.dat
@@ -27,18 +35,17 @@ payloadkeys:
- key: Location
type: <string>
presence: required
content: The description of the location where the recovery key will be escrowed.
This text will be inserted into the message the user sees when enabling FileVault.
content: The description of the location where the system escrows the recovery key.
The system inserts this text into the message the user sees when it enables FileVault.
- key: EncryptCertPayloadUUID
type: <string>
presence: required
content: The UUID of a payload within the same profile that contains the certificate
that will be used to encrypt the recovery key. The referenced payload must be
of type 'com.apple.security.pkcs1'.
that the system uses to encrypt the recovery key. The referenced payload must
be of type 'com.apple.security.pkcs1'.
- key: DeviceKey
type: <string>
presence: optional
content: |-
The string that's included in help text if the user appears to have forgotten the password. Site admins can use this key to look up the escrowed key for the particular computer.
This key replaces the 'RecordNumber' key used in the previous escrow mechanism. If the key is missing, the device serial number is used instead.
This key replaces the 'RecordNumber' key used in the previous escrow mechanism. If the key is missing, the system uses the device serial number instead.
mdm/profiles/com.apple.security.FDERecoveryRedirect.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.security.FDERecoveryRedirect
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
deprecated: '10.13'
@@ -14,6 +16,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
*** This payload will be ignored on macOS 10.13 and later. See "com.apple.security.FDERecoveryKeyEscrow" payload. ***
Old notes:
mdm/profiles/com.apple.security.acme.yaml
+19 -6
View File
@@ -30,6 +30,13 @@ payload:
multiple: true
supervised: false
allowmanualinstall: true
visionOS:
introduced: '1.0'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: '9.0'
multiple: true
@@ -77,9 +84,11 @@ payloadkeys:
- RSA
- ECSECPrimeRandom
content: |-
The type of key pair to generate.
* 'RSA': Specifies an RSA key pair. RSA key pairs must have a KeySize in the range [1024..4096] inclusive and a multiple of 8, and 'HardwareBound' must be false.
* 'ECSECPrimeRandom': Specifies a key pair on the P-192, P-256, P-384 or P-521 curves as defined in FIPS Pub 186-4. KeySize defines the particular curve, which must be 192, 256, 384 or 521. Hardware bound keys only support values of 256 and 384. Note that the key size is 521, not 512, even though the other key sizes are multiples of 64.
The type of key pair to generate. Allowed values:
* 'RSA': Specifies an RSA key pair. RSA key pairs need to have a 'KeySize' that's a multiple of 8 in the range of 1024 through 4096 (inclusive), and 'HardwareBound' needs to be 'false'.
* 'ECSECPrimeRandom': Specifies a key pair on the P-192, P-256, P-384, or P-521 curves as defined in FIPS Pub 186-4. 'KeySize' defines the particular curve, which needs to be '192', '256', '384', or '521'. Hardware bound keys only support values of '256' and '384'.
Note that the key size is '521', not '512', even though the other key sizes are multiples of 64.
- key: HardwareBound
title: Hardware Bound
type: <boolean>
@@ -88,7 +97,7 @@ payloadkeys:
If 'false', the private key isn't bound to the device.
If 'true', the private key is bound to the device. The Secure Enclave generates the key pair, and the private key is cryptographically entangled with a system key. This prevents the system from exporting the private key.
If 'true', 'KeyType' must be 'ECSECPrimeRandom' and 'KeySize' must be 256 or 384.
This key is supported as of macOS 14 on Apple Silicon and Intel devices that have a T2 chip. Older macOS versions or other Mac devices require this key but it must have a value of false.
Setting this key to 'true' is supported as of macOS 14 on Apple Silicon and Intel devices that have a T2 chip. Older macOS versions or other Mac devices require this key but it must have a value of 'false'.
- key: Subject
title: Subject
type: <array>
@@ -170,8 +179,8 @@ payloadkeys:
presence: optional
default: false
content: |-
If 'true', the device provides attestations describing the device and the generated key to the ACME server. The server can use the attestations as strong evidence that the key is bound to the device, and that the device has properties listed in the attestation. The server can use that as part of a trust score to decide whether to issue the requested certificate.
When 'Attest' is 'true', 'HardwareBound' must also be 'true'.
If 'true', the device provides attestations that describe the device and the generated key to the ACME server. The server can use the attestations as strong evidence that the key is bound to the device, and that the device has properties listed in the attestation. The server can use that as part of a trust score to decide whether to issue the requested certificate.
When 'Attest' is 'true', 'HardwareBound' also needs to be 'true'.
This key is supported as of macOS 14 on Apple Silicon and Intel devices that have a T2 chip. If this key is specified for older macOS versions or other Mac devices, it must have a value of 'false'.
- key: KeyIsExtractable
supportedOS:
@@ -179,6 +188,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -193,6 +204,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
mdm/profiles/com.apple.security.certificatepreference.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.security.certificatepreference
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.12'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Defines a Certificate Preference item in the user's keychain that references
a certificate payload included in the same profile. Can only appear in a user
profile (not a device profile). See also "com.apple.security.identitypreference"
mdm/profiles/com.apple.security.certificaterevocation.yaml
+14 -1
View File
@@ -14,6 +14,19 @@ payload:
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: '1.1'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: n/a
content: Policies that affect system-wide certificate revocation checking.
payloadkeys:
- key: EnabledForCerts
@@ -23,7 +36,7 @@ payloadkeys:
content: |-
An array of certificates that the system checks for revocation.
Specifying a certificate authority (CA) enables revocation checking for all certificates chaining up to that CA.
It is not necessary to specify trusted root certificates because they are implicitly specified. See <https://support.apple.com/en-us/HT209143> for the available trusted root certificates for Apple operating systems.
It's not necessary to specify trusted root certificates because they're implicitly specified. See <https://support.apple.com/en-us/HT209143> for the available trusted root certificates for Apple operating systems.
subkeys:
- key: SubjectPublicKeyInfoHashDict
type: <dictionary>
mdm/profiles/com.apple.security.certificatetransparency.yaml
+14 -6
View File
@@ -29,6 +29,13 @@ payload:
multiple: true
supervised: false
allowmanualinstall: true
visionOS:
introduced: '1.0'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: 5.1.1
multiple: true
@@ -41,10 +48,10 @@ payloadkeys:
type: <array>
presence: optional
content: |-
An array of certificates for which certificate transparency is disabled. For Certificate Transparency enforcement to be disabled when this policy is set, one of the following conditions must be met:
An array of certificates for which certificate transparency is disabled. One of the following conditions needs to be met to disable certificate transparency enforcement when this policy is set:
* The hash is of the server certificate's 'subjectPublicKeyInfo'.
* The hash is of a 'subjectPublicKeyInfo' that appears in a CA certificate in the certificate chain; the CA certificate is constrained through the X.509v3 'nameConstraints' extension; one or more 'directoryName' 'nameConstraints' are present in the 'permittedSubtrees;' and the 'directoryName' contains an 'organizationName' attribute.
* The hash is of a 'subjectPublicKeyInfo' that appears in a CA certificate in the certificate chain; the CA certificate has one or more 'organizationName' attributes in the certificate 'Subject;' and the server's certificate contains the same number of 'organizationName' attributes, in the same order, and with byte-for-byte identical values.
* The hash is of a 'subjectPublicKeyInfo' that appears in a CA certificate in the certificate chain; the CA certificate is constrained through the X.509v3 'nameConstraints' extension. One or more 'directoryName' 'nameConstraints' are present in the 'permittedSubtrees', and the 'directoryName' contains an 'organizationName' attribute.
* The hash is of a 'subjectPublicKeyInfo' that appears in a CA certificate in the certificate chain. The CA certificate has one or more 'organizationName' attributes in the certificate 'Subject', and the server's certificate contains the same number of 'organizationName' attributes, in the same order, and with byte-for-byte identical values.
subkeys:
- key: SubjectPublicKeyInfoHashDict
type: <dictionary>
@@ -65,9 +72,10 @@ payloadkeys:
title: Disabled domains
type: <array>
presence: optional
content: |-
An array of strings representing the domains to be excluded from certificate transparency enforcement. A leading period (.) is supported to signify subdomains.
Wildcard domains are not supported. If a leading period (.) is specified, the domain cannot be a top-level domain (for example, '.com' and '.co.uk' are disallowed).
content: An array of strings that represent the domains to exclude from certificate
transparency enforcement. The system supports using a leading period ('.') to
signify subdomains. However, the system doesn't support wildcards. If you include
a leading period, the domain can't be a top-level domain, such as '.com' and '.co.uk'.
subkeys:
- key: domain
type: <string>
mdm/profiles/com.apple.security.firewall.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.security.firewall
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.12'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
Manages the Application Firewall settings (e.g. Security pref pane -> Firewall).
Notes:
mdm/profiles/com.apple.security.identitypreference.yaml
+8
View File
@@ -3,6 +3,8 @@ description: ''
payload:
payloadtype: com.apple.security.identitypreference
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.12'
multiple: true
@@ -13,6 +15,12 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: Defines an Identity Preference item in the user's keychain that references
a identity payload included in the same profile. Can only appear in a user profile
(not a device profile). See also "com.apple.security.certificatepreference" for
mdm/profiles/com.apple.security.pem.yaml
+7
View File
@@ -29,6 +29,13 @@ payload:
multiple: true
supervised: false
allowmanualinstall: true
visionOS:
introduced: '1.0'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: '3.0'
multiple: true
mdm/profiles/com.apple.security.pkcs1.yaml
+7
View File
@@ -29,6 +29,13 @@ payload:
multiple: true
supervised: false
allowmanualinstall: true
visionOS:
introduced: '1.0'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: '3.0'
multiple: true
mdm/profiles/com.apple.security.pkcs12.yaml
+15 -3
View File
@@ -29,6 +29,13 @@ payload:
multiple: true
supervised: false
allowmanualinstall: true
visionOS:
introduced: '1.0'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: '3.0'
multiple: true
@@ -59,13 +66,15 @@ payloadkeys:
introduced: '10.10'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', allows apps access to the private key. Available in macOS 10.10
and later.
content: If 'true', the system allows apps access to the private key. Available
in macOS 10.10 and later.
- key: KeyIsExtractable
supportedOS:
iOS:
@@ -74,9 +83,12 @@ payloadkeys:
introduced: '10.15'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: true
content: If 'false', doesn't tag the private key data as extractable in the keychain.
content: If 'false', the system doesn't tag the private key data as extractable
in the keychain.
mdm/profiles/com.apple.security.root.yaml
+7
View File
@@ -29,6 +29,13 @@ payload:
multiple: true
supervised: false
allowmanualinstall: true
visionOS:
introduced: '1.0'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: '3.0'
multiple: true
mdm/profiles/com.apple.security.scep.yaml
+11 -3
View File
@@ -30,6 +30,13 @@ payload:
multiple: true
supervised: false
allowmanualinstall: true
visionOS:
introduced: '1.0'
multiple: true
supervised: false
allowmanualinstall: true
userenrollment:
mode: allowed
watchOS:
introduced: '3.0'
multiple: true
@@ -66,7 +73,6 @@ payloadkeys:
content: |-
The representation of an X.500 name as an array of OID and value.
For example, '/C=US/O=Apple Inc./CN=foo/1.2.5.3=bar' translates to '[ [ [“C”, “US”] ], [ [“O”, “Apple Inc.'] ], …, [ [ “1.2.5.3”, “bar” ] ] ]'.
OIDs can be represented as dotted numbers, with shortcuts for country (C), locality (L), state (ST), organization (O), organizational unit (OU), and common name (CN).
subkeys:
- key: SCEPSubjectArrayInnerArray
@@ -113,9 +119,11 @@ payloadkeys:
presence: optional
default: 0
content: |-
A bitmask indicating the use of the key.
A bitmask indicating the use of the key. Possible values:
* 1: Signing
* 4: Encryption
Some certificate authorities, such as Windows CA, support only encryption or signing, but not both at the same time.
- key: CAFingerprint
title: Fingerprint
@@ -180,7 +188,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: If 'false', disables exporting the private key from the keychain.
content: If 'false', the system disables exporting the private key from the keychain.
- key: AllowAllAppsAccess
title: Allow All Apps Access
supportedOS:

Some files were not shown because too many files have changed in this diff Show More