CalvinBackup/apple_device-management
1
0
Fork 0
mirror of https://github.com/apple/device-management.git synced 2026-08-12 03:20:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

Release_iOS-15_macOS-12

Browse Source
This commit is contained in:
Cyrus Daboo
2022-06-03 16:23:58 -04:00
commit 4e8e108dbb
233 changed files with 25461 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mdm/checkin/authenticate.yaml
+157
View File
@@ -0,0 +1,157 @@
title: Authenticate
description: Check-in protocol authenticate request keys.
payload:
requesttype: Authenticate
supportedOS:
iOS:
introduced: '4.0'
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '10.7'
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: '10.2'
supervised: false
content: Check-in protocol authenticate request and response.
payloadkeys:
- key: DeviceName
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
type: <string>
presence: required
content: The device's name.
- key: ModelName
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
type: <string>
presence: required
content: The device's model name.
- key: Model
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
type: <string>
presence: required
content: The device's model.
- key: MessageType
type: <string>
presence: required
rangelist:
- Authenticate
content: The message type, which must have a value of 'Authenticate'.
- key: Topic
type: <string>
presence: required
content: The topic to which the device subscribes.
- key: UDID
supportedOS:
iOS:
userenrollment:
mode: forbidden
macOS:
userenrollment:
mode: forbidden
type: <string>
presence: required
content: The device's UDID (Unique Device ID).
- key: EnrollmentID
supportedOS:
iOS:
introduced: '13.0'
userenrollment:
mode: required
macOS:
introduced: '10.15'
userenrollment:
mode: required
tvOS:
introduced: n/a
type: <string>
presence: required
content: The per-enrollment identifier for the device. Available in macOS 10.15
and iOS 13.0 and later.
- key: OSVersion
supportedOS:
iOS:
introduced: '9.0'
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The device's OS version.
- key: BuildVersion
supportedOS:
iOS:
introduced: '9.0'
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The device's build version.
- key: ProductName
supportedOS:
iOS:
introduced: '9.0'
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The device's product name ('iPhone3,1').
- key: SerialNumber
supportedOS:
iOS:
introduced: '9.0'
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
macOS:
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
type: <string>
presence: optional
content: The device's serial number.
- key: IMEI
supportedOS:
iOS:
introduced: '9.0'
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <string>
presence: optional
content: The device's IMEI (International Mobile Station Equipment Identity).
- key: MEID
supportedOS:
iOS:
introduced: '9.0'
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <string>
presence: optional
content: The device's MEID (Mobile Equipment Identifier).
mdm/checkin/checkout.yaml
+61
View File
@@ -0,0 +1,61 @@
title: Check Out
description: Check-in protocol check out request keys.
payload:
requesttype: CheckOut
supportedOS:
iOS:
introduced: '4.0'
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '10.7'
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: '10.2'
supervised: false
content: Check-in protocol check out request and response.
payloadkeys:
- key: MessageType
type: <string>
presence: required
rangelist:
- CheckOut
content: The message type, which must have a value of 'CheckOut'.
- key: Topic
type: <string>
presence: required
content: The topic to which the device subscribed.
- key: UDID
supportedOS:
iOS:
userenrollment:
mode: forbidden
type: <string>
presence: required
content: The device's UDID (Unique Device ID).
- key: EnrollmentID
supportedOS:
iOS:
introduced: '13.0'
userenrollment:
mode: required
macOS:
introduced: '10.15'
userenrollment:
mode: required
tvOS:
introduced: n/a
type: <string>
presence: required
content: The per-enrollment identifier for the device. Available in macOS 10.15
and iOS 13.0 and later.
mdm/checkin/declarativemanagement.yaml
+38
View File
@@ -0,0 +1,38 @@
title: Declarative Management
description: Declarative Management request keys.
payload:
requesttype: DeclarativeManagement
supportedOS:
iOS:
introduced: '15.0'
supervised: false
requiresdep: false
sharedipad:
mode: forbidden
userenrollment:
mode: required
content: Check-in protocol declarative management request and response.
payloadkeys:
- key: MessageType
type: <string>
presence: required
rangelist:
- DeclarativeManagement
content: The message type, which must have a value of 'DeclarativeManagement'.
- key: EnrollmentID
type: <string>
presence: required
content: The per-enrollment identifier for the device.
- key: Endpoint
type: <string>
presence: required
content: |-
The type of operation the declaration is requesting. This key must be one of these values:
* 'tokens': For fetching synchronization tokens from the server
* 'declaration-items': For fetching the declaration manifest from the server
* 'status': For sending a status report to the server
* 'declaration/…/…': For fetching a specific declaration from the server. Include the declaration type and identifier separated by forward slashes ('/)'.
- key: Data
type: <data>
presence: optional
content: A Base64-encoded JSON object using the SynchronizationTokens schema.
mdm/checkin/getbootstraptoken.yaml
+32
View File
@@ -0,0 +1,32 @@
title: Get Bootstrap Token
description: Check-in protocol get bootstrap token data.
payload:
requesttype: GetBootstrapToken
supportedOS:
macOS:
introduced: '10.15'
devicechannel: true
userchannel: false
supervised: true
requiresdep: false
userenrollment:
mode: forbidden
content: Check-in protocol get bootstrap token data request and response.
payloadkeys:
- key: MessageType
type: <string>
presence: required
rangelist:
- GetBootstrapToken
content: The message type, which must have a value of 'GetBootstrapToken'.
- key: AwaitingConfiguration
type: <boolean>
presence: optional
default: false
content: If 'true', the device is awaiting a DeviceConfigured MDM command before
proceeding through Setup Assistant.
responsekeys:
- key: BootstrapToken
type: <data>
presence: optional
content: The current bootstrap token data for the device.
mdm/checkin/setbootstraptoken.yaml
+32
View File
@@ -0,0 +1,32 @@
title: Set Bootstrap Token
description: Check-in protocol set bootstrap token data.
payload:
requesttype: SetBootstrapToken
supportedOS:
macOS:
introduced: '10.15'
devicechannel: true
userchannel: false
supervised: true
requiresdep: false
userenrollment:
mode: forbidden
content: Check-in protocol set bootstrap token data request and response.
payloadkeys:
- key: MessageType
type: <string>
presence: required
rangelist:
- SetBootstrapToken
content: The message type, which must have a value of 'SetBootstrapToken'.
- key: BootstrapToken
type: <data>
presence: optional
content: The device's bootstrap token data. If this field is missing or zero length,
the bootstrap token should be removed for this device.
- key: AwaitingConfiguration
type: <boolean>
presence: optional
default: false
content: If 'true', the device is awaiting a DeviceConfigured MDM command before
proceeding through Setup Assistant.
mdm/checkin/tokenupdate.yaml
+164
View File
@@ -0,0 +1,164 @@
title: Token Update
description: Check-in protocol token update request keys.
payload:
requesttype: TokenUpdate
supportedOS:
iOS:
introduced: '4.0'
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
macOS:
introduced: '10.7'
devicechannel: true
userchannel: true
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: '10.2'
supervised: false
content: Check-in protocol token update request and response.
payloadkeys:
- key: NotOnConsole
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
devicechannel: false
type: <boolean>
presence: required
content: If true, the device is not on console.
- key: MessageType
type: <string>
presence: required
rangelist:
- TokenUpdate
content: The message type, which must have a value of 'TokenUpdate'.
- key: Topic
type: <string>
presence: required
content: The topic the device subscribes to.
- key: UDID
supportedOS:
iOS:
userenrollment:
mode: forbidden
macOS:
userenrollment:
mode: forbidden
type: <string>
presence: required
content: The device's UDID.
- key: EnrollmentID
supportedOS:
iOS:
introduced: '13.0'
userenrollment:
mode: required
macOS:
introduced: '10.15'
userenrollment:
mode: required
tvOS:
introduced: n/a
type: <string>
presence: required
content: The per-enrollment identifier for the device. Available in macOS 10.15
and iOS 13.0 and later.
- key: EnrollmentUserID
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.15'
devicechannel: false
userenrollment:
mode: required
tvOS:
introduced: n/a
type: <string>
presence: required
content: The per-enrollment identifier for the user. Available in macOS 10.15 and
iOS 13.0 and later.
- key: UserShortName
supportedOS:
iOS:
introduced: '9.3'
sharedipad:
mode: required
macOS:
devicechannel: false
tvOS:
introduced: n/a
type: <string>
presence: optional
content: |-
On Shared iPad: This is the Managed Apple ID of the user on Shared iPad. It indicates that the token is for the user channel.
On macOS, this is the short name of the user.
- key: UserID
supportedOS:
iOS:
introduced: '9.3'
sharedipad:
mode: required
macOS:
devicechannel: false
tvOS:
introduced: n/a
type: <string>
presence: optional
content: |-
On macOS: This is the ID of the user.
On Shared iPad: This is always 'FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF' to indicate that no authentication will occur.
- key: UserLongName
supportedOS:
iOS:
introduced: n/a
macOS:
devicechannel: false
tvOS:
introduced: n/a
type: <string>
presence: required
content: The full name of the user.
- key: Token
type: <data>
presence: required
content: The Push token for the device.
- key: PushMagic
type: <string>
presence: required
content: The magic string that has to be included in the push notification message.
- key: UnlockToken
supportedOS:
iOS:
accessrights: AllowPasscodeRemovalAndLock
sharedipad:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: n/a
type: <data>
presence: optional
content: The data that can be used to unlock the device. If provided, the server
should remember this data and send it with when trying to Clear the Passcode.
- key: AwaitingConfiguration
supportedOS:
iOS:
introduced: '9.0'
macOS:
introduced: '10.11'
userchannel: false
type: <boolean>
presence: optional
default: false
content: If 'true', the device is awaiting a Release Device from Await Configuration
MDM command before proceeding through Setup Assistant.
mdm/checkin/userauthenticate.yaml
+34
View File
@@ -0,0 +1,34 @@
title: UserAuthenticate
description: Authenticate network or mobile users with MDM.
payload:
requesttype: UserAuthenticate
supportedOS:
macOS:
introduced: '10.7'
devicechannel: false
userchannel: true
requiresdep: false
userenrollment:
mode: forbidden
content: Authenticate network or mobile users with MDM.
payloadkeys:
- key: MessageType
type: <string>
presence: required
rangelist:
- UserAuthenticate
content: The message type, which must have a value of 'UserAuthenticate'.
- key: UDID
type: <string>
presence: required
content: The device's UDID (Unique Device ID).
- key: UserID
type: <string>
presence: required
content: Local mobile user's GUID or network user's GUID from an Open Directory
record.
- key: DigestResponse
type: <string>
presence: required
content: A string provided by the client on second UserAuthenticate request after
receiving 'DigestChallenge' from server on first UserAuthenticate request.
mdm/commands/account.configuration.yaml
+117
View File
@@ -0,0 +1,117 @@
title: Account Configuration Command
description: This command can be sent to the device to have it create the local administrator
account (thereby skipping the page to create this account in Setup Assistant)
payload:
requesttype: AccountConfiguration
supportedOS:
macOS:
introduced: '10.11'
accessrights: None
devicechannel: true
userchannel: false
requiresdep: true
userenrollment:
mode: forbidden
content: When a macOS (v10.11 and later) device is configured via DEP to enroll
in an MDM server and the DEP profile has the await_device_configuration flag set
to true, the AccountConfiguration command can be sent to the device to have it
create the local administrator account (thereby skipping the page to create this
account in Setup Assistant). This command can only be sent to a macOS device that
is in the AwaitingConfiguration state.
payloadkeys:
- key: SkipPrimarySetupAccountCreation
type: <boolean>
presence: optional
default: false
content: If 'true', Setup Assistant skips the user interface for setting up primary
accounts and disables autologin. If 'true', you must specify a value for 'AutoSetupAdminAccounts'.
- key: SetPrimarySetupAccountAsRegularUser
type: <boolean>
presence: optional
default: false
content: If 'true', Setup Assistant creates the primary accounts as regular users,
and you must specify a value for 'AutoSetupAdminAccounts'.
- key: PrimaryAccountFullName
supportedOS:
macOS:
introduced: '10.15'
type: <string>
presence: optional
content: The full name for the primary account. If present, Setup Assistant uses
this value to prefill the Full Name field. However, Setup Assistant ignores this
value if 'DontAutoPopulatePrimaryAccountInfo' is 'true'. This value is available
in macOS 10.15 and later.
- key: PrimaryAccountUserName
supportedOS:
macOS:
introduced: '10.15'
type: <string>
presence: optional
content: The account name for the primary account. If present, Setup Assistant uses
this value to prefill the User Name field. However, Setup Assistant ignores this
value if 'DontAutoPopulatePrimaryAccountInfo' is 'true'. This value is available
in macOS 10.15 and later.
- key: DontAutoPopulatePrimaryAccountInfo
supportedOS:
macOS:
introduced: '10.15'
type: <boolean>
presence: optional
default: false
content: If 'true', Setup Assistant ignores the primary account information and
requires the user to enter that information. If 'false', Setup Assistant prefills
the Full Name field with 'PrimaryAccountFullName' and the User Name field with
'PrimaryAccountUserName'. This value is available in macOS 10.15 and later.
- key: LockPrimaryAccountInfo
supportedOS:
macOS:
introduced: '10.15'
type: <boolean>
presence: optional
default: false
content: |-
If 'true', and you provide values for 'PrimaryAccountFullName' or 'PrimaryAccountUserName', Setup Assistant disables editing for the corresponding fields. 'DontAutoPopulatePrimaryAccountInfo' must also be 0 (or missing).
If the user's password is also available from authentication via ConfigurationURL, Setup Assistant automatically creates the primary account with that information and skips showing the user interface to view or edit these fields.
This value is available in macOS 10.15 and later.
- key: AutoSetupAdminAccounts
type: <array>
presence: optional
content: A dictionary that describes the administrator account to create with Setup
Assistant, which uses the first element and ignores additional elements.
subkeys:
- key: AutoSetupAdminAccountItem
type: <dictionary>
subkeys:
- key: shortName
title: shortName
type: <string>
presence: required
content: The short name of the user.
- key: fullName
title: fullName
type: <string>
presence: optional
content: The full name of the user. This defaults to shortName if not specified.
- key: passwordHash
title: passwordHash
type: <data>
presence: optional
content: Contains the pre-created salted PBKDF2 SHA512 password hash for the
account.
- key: hidden
title: hidden
type: <boolean>
presence: optional
default: false
content: If true, this sets the account attribute to make the account hidden
to loginwindow and Users&Groups. OD attribute dsAttrTypeNative:IsHidden.
- key: ManagedLocalUserShortName
supportedOS:
macOS:
introduced: '11.0'
type: <string>
presence: optional
content: If present, this is the short name of the local account to manage, which
can also be the account that results from setting 'AutoSetupAdminAccounts' to
'true'. Otherwise, only the local account that Setup Assistant creates is a managed
account. This value is available in macOS 11 and later.
mdm/commands/application.extensions.listactive.yaml
+73
View File
@@ -0,0 +1,73 @@
title: Application:List Active NSExtensions
description: Returns information about the active NSExtensions for a particular user.
payload:
requesttype: ActiveNSExtensions
supportedOS:
macOS:
introduced: '10.13'
accessrights: QueryInstalledApps
devicechannel: false
userchannel: true
requiresdep: false
userenrollment:
mode: forbidden
content: |-
Returns information about the active NSExtensions for a particular user.
NSExtensions are installed and enabled at the user level. There is no concept of "device" NSExtensions.
Requires "Query Installed Apps" right; supported on user channel only.
payloadkeys:
- key: FilterExtensionPoints
type: <array>
presence: optional
content: An array of extension points. If you choose to provide this value, the
response only includes the app extensions for the extension points you specify.
subkeys:
- key: FilterExtensionPointsItem
type: <string>
responsekeys:
- key: Extensions
type: <array>
presence: required
content: An array of dictionaries that contains information about active extensions
on the device.
subkeys:
- key: ExtensionsItem
type: <dictionary>
subkeys:
- key: Identifier
type: <string>
presence: required
content: The identifier of the extension.
- key: ExtensionPoint
type: <string>
presence: required
content: The NSExtensionPointIdentifier for the extension.
- key: DisplayName
type: <string>
presence: required
content: The extension's display name.
- key: ContainerDisplayName
type: <string>
presence: optional
content: The display name of the container.
- key: ContainerIdentifier
type: <string>
presence: optional
content: The identifier of the container.
- key: Path
type: <string>
presence: required
content: The path to the extension.
- key: Version
type: <string>
presence: required
content: The version of the extension.
- key: UserElection
type: <string>
presence: required
rangelist:
- Default
- Use
- Ignore
content: The user-selected state of the extension, which a user sets in the
Extensions preference pane in System Preferences.
mdm/commands/application.extensions.mappings.yaml
+41
View File
@@ -0,0 +1,41 @@
title: NSExtensions Mappings NSExtensions
description: This command returns information about installed extensions for a user.
payload:
requesttype: NSExtensionMappings
supportedOS:
macOS:
introduced: '10.13'
accessrights: QueryInstalledApps
devicechannel: false
userchannel: true
requiresdep: false
userenrollment:
mode: forbidden
content: |-
This command returns information about installed extensions for a user.
The purpose of this command is to allow the server to build a mapping of
extension identifiers to extension points to provide a UI for generating
"com.apple.NSExtension" payloads.
Requires "Query Installed Apps" right; supported on user channel only
responsekeys:
- key: Extensions
type: <array>
presence: required
content: An array of dictionaries that contains information about extensions on
the device.
subkeys:
- key: ExtensionsItem
type: <dictionary>
subkeys:
- key: Identifier
type: <string>
presence: required
content: The identifier of the extension.
- key: ExtensionPoint
type: <string>
presence: required
content: The NSExtensionPointIdentifier for the extension.
- key: DisplayName
type: <string>
presence: required
content: The display name of the extension.
mdm/commands/application.install.enterprise.yaml
+118
View File
@@ -0,0 +1,118 @@
title: Install Enterprise Application Command
description: This command allows the server to install enterprise applications on
a device. It provides a more secure version of 'InstallApplication' that specifies
a 'ManifestURL'.
payload:
requesttype: InstallEnterpriseApplication
supportedOS:
macOS:
introduced: 10.13.6
accessrights: AllowAppInstallation
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: allowed
content: This command allows the server to install an application on a device. It
provides a more secure version of 'InstallApplication' that specifies a 'ManifestURL'.
payloadkeys:
- key: Manifest
type: <dictionary>
presence: optional
content: A dictionary that specifies where to download the app. This value is backward-compatible
with the manifest for the InstallApplicationCommand; however, it also allows you
to specify 'sha256s' and 'sha256'-size for SHA-256 hashes.
subkeys:
- key: ANY
type: <any>
presence: optional
content: A manifest, which is backward-compatible with the manifest for the 'InstallApplication'
command; however, it also allows you to specify 'sha256s' and 'sha256-size'
for SHA-256 hashes.
- key: ManifestURL
type: <string>
presence: optional
content: The URL of the app manifest, which must begin with 'https:'.
- key: ManifestURLPinningCerts
type: <array>
presence: optional
content: An array of DER-encoded certificates to pin the connection when fetching
the 'ManifestURL'.
subkeys:
- key: ManifestURLPinningCertsItem
type: <data>
presence: required
content: A certificate in DER-encoded format.
- key: PinningRevocationCheckRequired
type: <boolean>
presence: optional
default: false
content: If 'true', certificate revocation checks require a positive response when
using certificate pinning with 'ManifestURLPinningCerts'.
- key: InstallAsManaged
supportedOS:
macOS:
introduced: '11.0'
userenrollment:
mode: forbidden
type: <boolean>
presence: optional
default: false
content: |-
If 'true', install the app as a managed app. For manifest-based installation, if this value is 'true', but the package doesn't meet the criteria for management, the installation fails. Reinstall a managed app with this value set to 'false' to change the app to an unmanaged app.
To satisfy the criteria for management, the pkg must contain a single, signed application installed into '/Applications'.
This value is available in macOS 11 and later.
- key: ManagementFlags
supportedOS:
macOS:
introduced: '11.0'
userenrollment:
mode: forbidden
type: <integer>
presence: optional
rangelist:
- 1
content: |-
The management flags. The only supported flag is:
* '1': Remove the app upon removal of the MDM profile. This also requires that you pass 'true' for 'InstallAsManaged'.
This value is available in macOS 11 and later.
- key: Configuration
supportedOS:
macOS:
introduced: '11.0'
type: <dictionary>
presence: optional
content: A dictionary that contains the initial configuration of the app, if you
choose to provide it. This value is available in macOS 11 and later.
subkeys:
- key: ANY
type: <any>
presence: optional
content: An app configuration key.
- key: ChangeManagementState
supportedOS:
macOS:
introduced: '11.0'
userenrollment:
mode: forbidden
type: <string>
presence: optional
rangelist:
- Managed
content: |-
The change management state. The only supported state is:
* 'Managed': Take management of the app if the user installed it already. This also requires that you pass 'true' for 'InstallAsManaged'.
This value is available in macOS 11 and later.
- key: iOSApp
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', the app is an iOS app that can run on an Apple silicon in macOS
11 and later.
mdm/commands/application.install.yaml
+231
View File
@@ -0,0 +1,231 @@
title: Install Application Command
description: This command allows the server to install an application on a device.
If the app is already being managed, this command will update the app.
payload:
requesttype: InstallApplication
supportedOS:
iOS:
introduced: '5.0'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '10.9'
accessrights: AllowAppInstallation
devicechannel: true
userchannel: true
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
content: This command allows the server to install an application on a device. If
the app is already being managed, this command will update the app. macOS change
- 10.9 user channel for VPP, 10.10 device channel, 10.11 both.
payloadkeys:
- key: iTunesStoreID
type: <integer>
presence: optional
content: The app's iTunes Store identifier.
- key: Identifier
supportedOS:
iOS:
introduced: '7.0'
type: <string>
presence: optional
content: The app's bundle identifier.
- key: Options
supportedOS:
iOS:
introduced: '7.0'
type: <dictionary>
presence: optional
content: A dictionary that contains the app installation options.
subkeys:
- key: PurchaseMethod
type: <integer>
presence: optional
rangelist:
- 0
- 1
default: 0
content: |-
The app's purchase type, which must be one of the following values:
* '0': Free apps and Legacy Volume Purchase Program (VPP) with a redemption code. This option is only available in iOS.
* '1': Volume Purchase Program (VPP) app assignment.
Set this value to '1' to install first-party apps without user login to the iTunes Store, such as Mail or Safari, or to install an iOS app with user enrollment.
- key: ManifestURL
supportedOS:
iOS:
introduced: '7.0'
type: <string>
presence: optional
content: The URL of the app manifest, which must begin with 'https:'.
- key: ManagementFlags
supportedOS:
macOS:
introduced: '11.0'
userenrollment:
mode: forbidden
type: <integer>
presence: optional
rangelist:
- 1
- 4
- 5
content: |-
The bitwise OR of the following management flags:
* '1': Remove app upon removal of MDM profile. This also requires that you pass 'true' for 'InstallAsManaged'.
* '4': Prevent backup of app data.
This value is available in iOS 5 and later, macOS 11 and later, and tvOS 10.2 and later.
- key: Configuration
supportedOS:
iOS:
introduced: '7.0'
macOS:
introduced: '11.0'
type: <dictionary>
presence: optional
content: A dictionary that contains the initial configuration of the app, if you
choose to provide it. This value is available in iOS 7 and later, macOS 11 and
later, and tvOS 10.2 and later.
subkeys:
- key: ANY
type: <any>
presence: optional
content: An app configuration key.
- key: Attributes
supportedOS:
iOS:
introduced: '7.0'
macOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains the initial attributes of the app, if you choose
to provide it. This value is available in iOS 7 and later, and tvOS 10.2 and later.
subkeys:
- key: VPNUUID
type: <string>
presence: optional
content: A per-app VPN unique identifier for this app. This value is available
in iOS 7 and later, and tvOS 10.2 and later.
- key: AssociatedDomains
supportedOS:
iOS:
introduced: '13.0'
tvOS:
introduced: n/a
type: <array>
presence: optional
content: An array that contains the associated domains to add to this app. This
value is available in iOS 13 and later.
subkeys:
- key: AssociatedDomain
type: <string>
- key: AssociatedDomainsEnableDirectDownloads
supportedOS:
iOS:
introduced: '14.0'
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: true
content: If 'true', perform claimed site association verification directly at
the domain instead of on Apple's servers. Only set this to 'true' for domains
that can't access the internet. This value is available in iOS 14 and later.
- key: Removable
supportedOS:
iOS:
introduced: '14.0'
tvOS:
introduced: '14.0'
type: <boolean>
presence: optional
default: true
content: If 'false', this app isn't removable while it's a managed app. This value
is available in iOS 14 and later, and tvOS 14 and later.
- key: ChangeManagementState
supportedOS:
iOS:
introduced: '9.0'
userenrollment:
mode: forbidden
macOS:
introduced: '11.0'
userenrollment:
mode: forbidden
type: <string>
presence: optional
rangelist:
- Managed
content: |-
The change management state. The only supported state is:
* 'Managed': Take management of the app if the user installed it already. This also requires that you pass 'true' for 'InstallAsManaged'.
This value doesn't work with the User Enrollment feature introduced in iOS 13.
Available in iOS 9 and later, macOS 11 and later, and tvOS 10.2 and later.
- key: InstallAsManaged
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', install the app as a managed app. For manifest-based installation,
if this value is 'true', but the package doesn't meet the criteria for management,
the installation fails. Reinstall a managed app with this value set to 'false'
to change the app to an unmanaged app. This value is available in macOS 11 and
later.
- key: iOSApp
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', the app is an iOS app that can run on an Apple silicon in macOS
11 and later.
responsekeys:
- key: Identifier
type: <string>
presence: optional
content: The app's bundle identifier, if the user accepted the request.
- key: State
type: <string>
presence: optional
content: The app's installation state, if the user accepted the request. If this
value is 'NeedsRedemption', the server must send a redemption code to complete
the app installation.
- key: RejectionReason
type: <string>
presence: optional
rangelist:
- AppAlreadyInstalled
- AppAlreadyQueued
- AppStoreDisabled
- CouldNotVerifyAppID
- ManagementChangeNotSupported
- NotAnApp
- NotSupported
- PurchaseMethodNotSupported
- PurchaseMethodNotSupportedInMultiUser
content: The reason, if installation fails.
mdm/commands/application.installed.list.yaml
+247
View File
@@ -0,0 +1,247 @@
title: Application List Command
description: This command allows the server to query for installed 3rd party applications.
payload:
requesttype: InstalledApplicationList
supportedOS:
iOS:
introduced: '5.0'
accessrights: AllowQueryApplications
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '10.7'
accessrights: AllowQueryApplications
devicechannel: true
userchannel: true
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: '10.2'
accessrights: AllowQueryApplications
supervised: false
content: This command allows the server to query for installed 3rd party applications.
payloadkeys:
- key: Identifiers
supportedOS:
iOS:
introduced: '7.0'
macOS:
introduced: '10.15'
type: <array>
presence: optional
content: An array of app identifiers. Provide this value to limit the response to
only include these apps. This value is available in iOS 7 and later, macOS 10.15
and later, and tvOS 10.2 and later.
subkeys:
- key: IdentifiersItem
type: <string>
- key: ManagedAppsOnly
supportedOS:
iOS:
introduced: '7.0'
macOS:
introduced: '10.15'
type: <boolean>
presence: optional
default: false
content: If 'true', only get a list of managed apps. This value is available in
iOS 7 and later, macOS 10.15 and later, and tvOS 10.2 and later.
- key: Items
supportedOS:
iOS:
introduced: '14.0'
macOS:
introduced: n/a
tvOS:
introduced: '14.0'
type: <array>
presence: optional
content: An array of strings representing keys in the InstalledApplicationListItem
dictionary. If provided, the response will contain only the keys listed here.
The "Identifier" key is always included. If not present, the response will contain
all keys. Always request just the set of keys that will actually be used, as some
key values can take significant time and power to calculate on the device.
subkeys:
- key: ItemsItem
type: <string>
rangelist:
- AdHocCodeSigned
- AppStoreVendable
- BetaApp
- BundleSize
- DeviceBasedVPP
- DynamicSize
- ExternalVersionIdentifier
- HasUpdateAvailable
- Identifier
- Installing
- IsValidated
- Name
- ShortVersion
- Version
responsekeys:
- key: InstalledApplicationList
type: <array>
presence: required
content: An array of dictionaries that describes each installed app.
subkeys:
- key: InstalledApplicationListItem
type: <dictionary>
subkeys:
- key: Identifier
type: <string>
presence: optional
content: The app's identifier. This key will always be present on iOS/tvOS but
may be missing on macOS.
- key: ExternalVersionIdentifier
supportedOS:
iOS:
introduced: '11.0'
macOS:
introduced: '10.13'
tvOS:
introduced: '11.0'
type: <integer>
presence: optional
content: |-
The app's external version identifier, which you can use in the iTunes Search API to determine if an updated version of the app is available. Compare this value to the 'externalId' value in the 'contentMetadataLookupUrl' response from the 'VPPServiceConfigSrv' endpoint. If these values don't match, an updated version of the app may be available.
A newer version of an app may not be available for installation on the device for a variety of reasons, including that the device's operating system version or hardware is incompatible with the available version of the app.
- key: Version
type: <string>
presence: optional
content: The app's version.
- key: ShortVersion
supportedOS:
iOS:
introduced: '5.0'
type: <string>
presence: optional
content: The app's short version.
- key: Name
type: <string>
presence: optional
content: The app's name.
- key: BundleSize
supportedOS:
macOS:
introduced: '10.7'
type: <integer>
presence: optional
content: The app's static bundle size, in bytes. This value is available in
iOS 5 and later, and macOS 10.7 and later, and tvOS 10.2 and later.
- key: DynamicSize
supportedOS:
iOS:
introduced: '5.0'
macOS:
introduced: n/a
type: <integer>
presence: optional
content: The size of the app's file system in bytes, including the Documents,
Library, and other directories. This value is available in iOS 5 and later,
and tvOS 10.2 and later.
- key: IsValidated
supportedOS:
iOS:
introduced: '9.2'
macOS:
introduced: n/a
type: <boolean>
presence: optional
content: If 'true', the app is valid and can run on the device. If the app is
enterprise-distributed and unvalidated, it won't be able to run until validation
has occurred. This value is available in iOS 9.2 and later, and tvOS 10.2
and later.
- key: Installing
type: <boolean>
presence: optional
content: If 'true', the app is downloading. If 'false', it's already installed.
- key: AppStoreVendable
supportedOS:
iOS:
introduced: '11.3'
macOS:
introduced: n/a
tvOS:
introduced: '11.3'
type: <boolean>
presence: optional
content: If 'true', the app came from the App Store and can participate in store
features. For device-based Volume Purchase Program (VPP) apps, this value
is 'false'. This value is available in iOS 11.3 and later, and tvOS 11.3 and
later.
- key: DeviceBasedVPP
supportedOS:
iOS:
introduced: '11.3'
macOS:
introduced: n/a
tvOS:
introduced: '11.3'
type: <boolean>
presence: optional
content: If 'true', installing the app didn't require an Apple ID. This value
is available in iOS 11.3 and later, and tvOS 11.3 and later.
- key: BetaApp
supportedOS:
iOS:
introduced: '11.3'
macOS:
introduced: n/a
tvOS:
introduced: '11.3'
type: <boolean>
presence: optional
content: If 'true', the app is part of the Apple Beta Software Program. This
value is available in iOS 11.3 and later, and tvOS 11.3 and later.
- key: AdHocCodeSigned
supportedOS:
iOS:
introduced: '11.3'
macOS:
introduced: n/a
tvOS:
introduced: '11.3'
type: <boolean>
presence: optional
content: If 'true', the app is ad-hoc code signed. This query is available in
iOS 11.3 and later, and tvOS 11.3 and later.
- key: HasUpdateAvailable
supportedOS:
iOS:
introduced: '11.3'
macOS:
introduced: 10.13.4
type: <boolean>
presence: optional
content: If 'true', the app has an update available. This key is present only
for App Store apps. In macOS, this key is present only for Volume Purchase
Program (VPP) apps. This status updates daily and isn't always up-to-date
when installing an app.
- key: DownloadFailed
type: <boolean>
presence: optional
default: false
content: If 'true', the download failed.
- key: DownloadWaiting
type: <boolean>
presence: optional
default: false
content: If 'true', the app is in the initial state, which is waiting to download.
- key: DownloadPaused
type: <boolean>
presence: optional
default: false
content: If 'true', the user paused the download.
- key: DownloadCancelled
type: <boolean>
presence: optional
default: false
content: If 'true', the user canceled the download.
mdm/commands/application.invitetoprogram.yaml
+48
View File
@@ -0,0 +1,48 @@
title: Invite To Program Command
description: This command allows a server to invite a user to join a program.
payload:
requesttype: InviteToProgram
supportedOS:
iOS:
introduced: '7.0'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: false
userchannel: true
userenrollment:
mode: forbidden
macOS:
introduced: '10.9'
accessrights: None
devicechannel: false
userchannel: true
requiresdep: false
userenrollment:
mode: forbidden
content: This command allows a server to invite a user to join a program. This command
issues the invitation, but does not allow the server to monitor whether the user
has joined the program. This command is supported in the user channel. This command
will yield a NotNow status until the user exits Setup Assistant.
payloadkeys:
- key: ProgramID
type: <string>
presence: required
rangelist:
- com.apple.cloudvpp
content: The program's identifier, which can only be 'com.apple.cloudvpp'.
- key: InvitationURL
type: <string>
presence: required
content: The Volume Purchase Program (VPP) invitation URL.
responsekeys:
- key: InvitationResult
type: <string>
presence: required
rangelist:
- Acknowledged
- InvalidProgramID
- InvalidInvitationURL
content: The result of the command.
mdm/commands/application.managed.list.yaml
+170
View File
@@ -0,0 +1,170 @@
title: Managed Application List Command
description: This command allows the server to query the status of managed apps. Certain
statuses are transient. Once they are reported to the server, the entries for the
apps are removed from the next query. macOS supports this command on the user channel
starting with macOS 11.3.
payload:
requesttype: ManagedApplicationList
supportedOS:
iOS:
introduced: '5.0'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '11.0'
accessrights: AllowAppInstallation
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
content: This command allows the server to query the status of managed apps. Certain
statuses are transient. Once they are reported to the server, the entries for
the apps are removed from the next query. macOS supports this command on the user
channel starting with macOS 11.3.
payloadkeys:
- key: Identifiers
supportedOS:
iOS:
introduced: '7.0'
type: <array>
presence: optional
content: The bundle identifiers of the managed apps to include in the response.
subkeys:
- key: IdentifiersItem
type: <string>
responsekeys:
- key: ManagedApplicationList
type: <dictionary>
presence: required
content: A dictionary that contains status information about each managed app.
subkeytype: ManagedApplicationListItem
subkeys:
- key: <app identifier>
type: <dictionary>
presence: required
content: The bundle identifier of the managed app.
subkeytype: ManagedApplicationItem
subkeys:
- key: Status
type: <string>
presence: required
rangelist:
- NeedsRedemption
- Redeeming
- Prompting
- PromptingForLogin
- ValidatingPurchase
- PromptingForUpdate
- PromptingForUpdateLogin
- PromptingForManagement
- ValidatingUpdate
- Updating
- Installing
- Managed
- ManagedButUninstalled
- Unknown
- UserInstalledApp
- UserRejected
- UpdateRejected
- ManagementRejected
- Failed
content: |-
The status of the managed app, which is one of the following values:
* 'NeedsRedemption': The app needs a redemption code to complete installation.
* 'Redeeming': The device is redeeming the redemption code for the app.
* 'Prompting': The app installation is prompting the user.
* 'PromptingForLogin' - The app installation is prompting the user for App Store credentials.
* 'ValidatingPurchase': Validation of the app purchase is occurring.
* 'PromptingForUpdate': An app update is prompting the user.
* 'PromptingForUpdateLogin': An app update is prompting the user for App Store credentials.
* 'PromptingForManagement': Changing the app to a managed app is prompting the user.
* 'ValidatingUpdate': Validation of an app update is occurring.
* 'Updating': The app is updating.
* 'Installing': The app is installing.
* 'Managed': The installed app is a managed app.
* 'ManagedButUninstalled': The app is a managed app and the user removed it. Reinstalling the app reinstates it as a managed app.
* 'Unknown': The app state is unknown.
The following statuses are transient and report only once:
* 'UserInstalledApp': The user installed the app before managed app installation could occur.
* 'UserRejected': The user rejected the offer to install the app.
* 'UpdateRejected': The user rejected the offer to update the app.
* 'ManagementRejected':The user rejected management of an installed app.
* 'Failed': The app installation failed.
- key: ManagementFlags
type: <integer>
presence: required
content: |-
The bitwise OR of the following management flags:
* '1': Remove app upon removal of MDM profile.
* '4': Prevent backup of app data.
- key: UnusedRedemptionCode
supportedOS:
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <string>
presence: required
content: If the user already purchased a paid app, this code is available for
use by another user. This code reports only once. This value is available
in iOS 5 and later.
- key: HasConfiguration
supportedOS:
iOS:
introduced: '7.0'
macOS:
introduced: '11.0'
type: <boolean>
presence: required
content: If 'true', the app has an update available. This key is present only
for App Store apps. In macOS, this key is present only for Volume Purchase
Program (VPP) apps. This status updates daily and isn't always up-to-date
when installing an app.
- key: HasFeedback
supportedOS:
iOS:
introduced: '7.0'
macOS:
introduced: '11.3'
devicechannel: false
type: <boolean>
presence: required
content: If 'true', the app has feedback for the server. This value is available
in iOS 7 and later, and tvOS 10.2 and later. On macOS 11.3 and later, this
value is available if the request was sent on the user channel.
- key: IsValidated
supportedOS:
iOS:
introduced: '9.2'
macOS:
introduced: n/a
type: <boolean>
presence: required
content: If 'true', the app is valid and can run on the device. If the app is
enterprise-distributed and unvalidated, it won't be able to run until validation
has occurred. This value is available in iOS 9.2 and later, and tvOS 10.2
and later.
- key: ExternalVersionIdentifier
supportedOS:
iOS:
introduced: '10.3'
macOS:
introduced: '11.3'
tvOS:
introduced: '10.2'
type: <integer>
presence: required
content: |-
The app's external version identifier, which you can use in the iTunes Search API to determine if an updated version of the app is available. Compare this value to the 'externalId' value in the 'contentMetadataLookupUrl' response from the 'VPPServiceConfigSrv' endpoint. If these values don't match, an updated version of the app may be available. This value is available in iOS 10.3 and later, macOS 11.3 and later, and tvOS 10.2 and later.
A newer version of an app may not be available for installation on the device for a variety of reasons, including that the device's operating system version or hardware is incompatible with the available version of the app.
mdm/commands/application.redemptioncode.yaml
+26
View File
@@ -0,0 +1,26 @@
title: Apply Redemption Code Command
description: If a redemption code is needed during app installation, the server can
use this command to complete the app installation.
payload:
requesttype: ApplyRedemptionCode
supportedOS:
iOS:
introduced: '5.0'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
sharedipad:
mode: forbidden
userenrollment:
mode: forbidden
content: If a redemption code is needed during app installation, the server can
use this command to complete the app installation.
payloadkeys:
- key: Identifier
type: <string>
presence: required
content: The bundle identifier of the app.
- key: RedemptionCode
type: <string>
presence: required
content: The redemption code that applies to the app pending installation.
mdm/commands/application.remove.yaml
+33
View File
@@ -0,0 +1,33 @@
title: Remove Application Command
description: This command allows a server to remove a managed app.
payload:
requesttype: RemoveApplication
supportedOS:
iOS:
introduced: '5.0'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '11.0'
accessrights: AllowAppInstallation
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
content: This command allows a server to remove a managed app.
payloadkeys:
- key: Identifier
type: <string>
presence: required
content: The bundle identifier of the managed app.
mdm/commands/application.validate.yaml
+32
View File
@@ -0,0 +1,32 @@
title: Validate Applications Command
description: This commands allows the server to force validation of the free developer
and universal provisioning profiles associated with an enterprise app.
payload:
requesttype: ValidateApplications
supportedOS:
iOS:
introduced: '9.2'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
content: This command allows the server to query for installed 3rd party applications.
payloadkeys:
- key: Identifiers
type: <array>
presence: optional
content: The bundle identifiers of the enterprise apps to include for validation
of associated provisioning profiles, if you choose to provide them. Otherwise,
validation occurs for the provisioning profiles for the installed managed apps.
subkeys:
- key: IdentifiersItem
type: <string>
mdm/commands/certificate.list.yaml
+70
View File
@@ -0,0 +1,70 @@
title: Certificate List Command
description: This command allows the server to retrieve the list of installed certificates
on the device. The command requires that the server has the Inspect Profile Manifest
privilege.
payload:
requesttype: CertificateList
supportedOS:
iOS:
introduced: '4.0'
accessrights: AllowInspection
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '10.7'
accessrights: AllowInspection
devicechannel: true
userchannel: true
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: '6.0'
accessrights: AllowInspection
supervised: false
content: |-
This command allows the server to retrieve the list of installed certificates on the device. The command requires that the server has the Inspect Profile Manifest privilege.
For userenrollment, this request will limit to certificates pushed via MDM
payloadkeys:
- key: ManagedOnly
supportedOS:
iOS:
introduced: '13.0'
macOS:
introduced: '10.15'
tvOS:
introduced: '13.0'
type: <boolean>
presence: optional
default: false
content: If 'true', only include certificates that MDM installed or that are in
the same profile as the MDM payload. User-enrolled devices ignore this value and
always only include managed certificates. This value is available in iOS 13 and
later, macOS 10.15 and later, and tvOS 13 and later.
responsekeys:
- key: CertificateList
type: <array>
presence: required
content: An array of certificate list items that describes each certificate.
subkeys:
- key: CertificateListItem
type: <dictionary>
subkeys:
- key: CommonName
type: <string>
presence: required
content: The certificate's common name.
- key: IsIdentity
type: <boolean>
presence: required
content: If 'true', this is an identity certificate.
- key: Data
type: <data>
presence: required
content: The certificate in DER-encoded X.509 format.
mdm/commands/declarativemanagement.yaml
+23
View File
@@ -0,0 +1,23 @@
title: Declarative Management Command
description: This command allows the server to turn on the Declarative Management
engine on the device (the first time it is used), or to trigger a Declarative Management
synchronization operation.
payload:
requesttype: DeclarativeManagement
supportedOS:
iOS:
introduced: '15.0'
supervised: false
requiresdep: false
sharedipad:
mode: forbidden
userenrollment:
mode: required
content: This command allows the server to turn on the Declarative Management engine
on the device (the first time it is used), or to trigger a Declarative Management
synchronization operation.
payloadkeys:
- key: Data
type: <data>
presence: optional
content: The base64-encoded Declarative Management JSON request using a TokensResponse.
mdm/commands/device.activationlock.bypasscode.yaml
+30
View File
@@ -0,0 +1,30 @@
title: Activation Lock Bypass Code Command
description: Retrievies the Activation Lock bypass code from the device.
payload:
requesttype: ActivationLockBypassCode
supportedOS:
iOS:
introduced: '7.1'
accessrights: None
supervised: true
requiresdep: false
sharedipad:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: '10.15'
accessrights: None
devicechannel: true
userchannel: false
supervised: true
requiresdep: false
userenrollment:
mode: forbidden
content: Retrieves the Activation Lock bypass code from the device. This bypass
code is only available for 15 days after supervision.
responsekeys:
- key: ActivationLockBypassCode
type: <string>
presence: required
content: The Activation Lock bypass code if it's available.
mdm/commands/device.activationlock.clearbypasscode.yaml
+24
View File
@@ -0,0 +1,24 @@
title: Clear Activation Lock Bypass Code Command
description: Clears the Activation Lock bypass code from the device.
payload:
requesttype: ClearActivationLockBypassCode
supportedOS:
iOS:
introduced: '7.1'
accessrights: None
supervised: true
requiresdep: false
sharedipad:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: '10.15'
accessrights: None
devicechannel: true
userchannel: false
supervised: true
requiresdep: false
userenrollment:
mode: forbidden
content: Clears the Activation Lock bypass code from the device.
mdm/commands/device.configured.yaml
+31
View File
@@ -0,0 +1,31 @@
title: Device Configured Command
description: Informs the device that it can continue past DEP enrollment. Only works
on devices in DEP that have their cloud configuration set to await configuration.
payload:
requesttype: DeviceConfigured
supportedOS:
iOS:
introduced: '9.0'
accessrights: None
supervised: true
requiresdep: true
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: '10.11'
accessrights: None
devicechannel: true
userchannel: false
requiresdep: true
userenrollment:
mode: forbidden
tvOS:
introduced: '10.2'
accessrights: None
supervised: true
content: Informs the device that it can continue past DEP enrollment. Only works
on devices in DEP that have their cloud configuration set to await configuration.
mdm/commands/device.erase.yaml
+105
View File
@@ -0,0 +1,105 @@
title: Device Erase Command
description: This command allows the server to remotely erase the device. This command
requires the Device Erase right.
payload:
requesttype: EraseDevice
supportedOS:
iOS:
introduced: '4.0'
accessrights: AllowDeviceErase
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: '10.7'
accessrights: AllowDeviceErase
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: '10.2'
accessrights: AllowDeviceErase
supervised: false
content: This command allows the server to remotely erase the device. This command
requires the Device Erase right.
payloadkeys:
- key: PreserveDataPlan
supportedOS:
iOS:
introduced: '11.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', preserve the data plan on an iPhone or iPad with eSIM functionality,
if one exists. This value is available in iOS 11 and later.
- key: DisallowProximitySetup
supportedOS:
iOS:
introduced: '11.3'
sharedipad:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', disable Proximity Setup on the next reboot and skip the pane
in Setup Assistant. This value is available in iOS 11 and later. Prior to iOS
14, don't use this option with any other option.
- key: PIN
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.8'
tvOS:
introduced: n/a
type: <string>
presence: optional
content: The six-character PIN for Find My. This value is available in macOS 10.8
and later.
- key: ObliterationBehavior
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '12.0'
tvOS:
introduced: n/a
type: <string>
presence: optional
rangelist:
- Default
- DoNotObliterate
- ObliterateWithWarning
- Always
content: |-
This key defines the fallback behavior for erasing a device.
In macOS 12 and later, this command uses Erase All Content and Settings (EACS) on Mac computers with the Apple M1 chip or the Apple T2 Security Chip. On those devices, if EACS can't run, the device can use obliteration (macOS 11.x behavior). This key has no effect on machines prior to the T2 chip. For a list of supported macs, see Mac models with the Apple T2 Security Chip <https://support.apple.com/en-us/HT208862>.
Upon receiving this command, the device performs preflight checks to determine if the device is in a state that allows EACS. The 'status' of the EraseDeviceResponse is either 'Acknowledged' or 'Error'.
The following values define the device's fallback behavior:
'DoNotObliterate':
If EACS preflight fails, the device responds to the server with an 'Error' status and doesn't attempt to erase itself.
If EACS preflight succeeds but EACS fails, then the device doesn't attempt to erase itself.
'ObliterateWithWarning':
If EACS preflight fails, the device responds with an 'Acknowledged' status and then attempts to erase itself.
If EACS preflight succeeds but EACS fails, then the device attempts to erase itself.
'Default':
If EACS preflight fails, the device responds to the server with an 'Error' status and then attempts to erase itself.
If EACS preflight succeeds but EACS fails, then the device attempts to erase itself.
mdm/commands/device.esim.yaml
+27
View File
@@ -0,0 +1,27 @@
title: eSIM Cellular Plan Management Command
description: Instructs the device to query for active cellular plan eSIM "profiles"
at the designated carrier eSIM server URL.
payload:
requesttype: RefreshCellularPlans
supportedOS:
iOS:
introduced: '13.0'
accessrights: None
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
content: |-
Instructs the device to query for active cellular plan eSIM "profiles" (not a profile in the MDM sense)
at the designated carrier eSIM server URL. This command is only supported on cellular devices, and only
a subset of those devices support eSIM configuration management. (Need details from CoreTelephony.)
payloadkeys:
- key: eSIMServerURL
type: <string>
presence: required
content: The carrier's eSIM server URL to query. Obtain this URL from each carrier
separately.
mdm/commands/device.lock.yaml
+74
View File
@@ -0,0 +1,74 @@
title: Device Lock Command
description: This command allows the server to immediately lock the device. This command
requires the Device Lock and Passcode Removal right.
payload:
requesttype: DeviceLock
supportedOS:
iOS:
introduced: '4.0'
accessrights: AllowPasscodeRemovalAndLock
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '10.7'
accessrights: AllowPasscodeRemovalAndLock
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: forbidden
content: This command allows the server to immediately lock the device. This command
requires the Device Lock and Passcode Removal right.
payloadkeys:
- key: Message
supportedOS:
iOS:
introduced: '7.0'
sharedipad:
mode: ignored
macOS:
introduced: '10.14'
type: <string>
presence: optional
content: The message to display on the Lock screen of the device. This value doesn't
apply to a shared iPad device. This value is available in iOS 4 and later, and
macOS 10.14 and later.
- key: PhoneNumber
supportedOS:
iOS:
introduced: '7.0'
sharedipad:
mode: ignored
macOS:
introduced: '11.5'
type: <string>
presence: optional
content: The phone number to display on the Lock screen. This value doesn't apply
to a shared iPad device. This value is available in iOS 7 and later and macOS
11.5 and later (for Apple silicon devices only).
- key: PIN
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.8'
type: <string>
presence: optional
content: The six-character PIN for Find My. This value is available in macOS 10.8
and later.
responsekeys:
- key: MessageResult
type: <string>
presence: optional
content: |-
The message result if the command includes a message or phone number, which is one of the following values:
* 'Success': The message displayed successfully.
* 'DeviceInLostMode': The device is in Lost Mode.
* 'NoPasscodeSet': The message didn't display because there isn't a set passcode.
* 'Unknown': An unknown error occurred.
mdm/commands/device.lostmode.disable.yaml
+17
View File
@@ -0,0 +1,17 @@
title: Disable MDM Lost Mode Location
description: This command allows the server to take the device out of MDM lost mode.
payload:
requesttype: DisableLostMode
supportedOS:
iOS:
introduced: '9.3'
accessrights: None
supervised: true
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
content: This command allows the server to take the device out of MDM lost mode.
mdm/commands/device.lostmode.enable.yaml
+35
View File
@@ -0,0 +1,35 @@
title: Enable MDM Lost Mode Location
description: This command allows the server to put the device in MDM lost mode, with
a message, phone number, and footnote text. A message or phone number must be provided.
payload:
requesttype: EnableLostMode
supportedOS:
iOS:
introduced: '9.3'
accessrights: None
supervised: true
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
content: This command allows the server to put the device in MDM lost mode, with
a message, phone number, and footnote text. A message or phone number must be
provided.
payloadkeys:
- key: Message
type: <string>
presence: optional
content: If present, display this text on the Lock screen. You must provide this
value if you don't provide a value for 'PhoneNumber'.
- key: PhoneNumber
type: <string>
presence: optional
content: If present, display this phone number on the Lock screen. You must provide
this value if you don't provide a value for 'Message'.
- key: Footnote
type: <string>
presence: optional
content: If present, display this text in place of Slide to Unlock.
mdm/commands/device.lostmode.location.yaml
+74
View File
@@ -0,0 +1,74 @@
title: Device Location Command
description: This command allows the server to ask for the device's location if it
is in MDM lost mode.
payload:
requesttype: DeviceLocation
supportedOS:
iOS:
introduced: '9.3'
accessrights: None
supervised: true
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
responsekeys:
- key: Latitude
type: <real>
presence: required
content: The latitude of the device's location.
- key: Longitude
type: <real>
presence: required
content: The longitude of the device's location.
- key: HorizontalAccuracy
supportedOS:
iOS:
introduced: '10.3'
type: <real>
presence: required
content: The radius of uncertainty for the location in meters, which is a negative
value if the horizontal accuracy is unknown.
- key: VerticalAccuracy
supportedOS:
iOS:
introduced: '10.3'
type: <real>
presence: required
content: The accuracy of the altitude value in meters, which is a negative value
if the vertical accuracy is unknown.
- key: Altitude
supportedOS:
iOS:
introduced: '10.3'
type: <real>
presence: required
content: The altitude of the device's location, which is a negative value if the
altitude is unknown.
- key: Speed
supportedOS:
iOS:
introduced: '10.3'
type: <real>
presence: required
content: The speed of the device in meters per second, which is a negative value
if the speed is unknown.
- key: Course
supportedOS:
iOS:
introduced: '10.3'
type: <real>
presence: required
content: The direction the device is traveling, which is a negative value if the
course is unknown.
- key: Timestamp
supportedOS:
iOS:
introduced: '10.3'
type: <string>
presence: required
content: The RFC 3339 timestamp of when the server determined the location of the
device.
mdm/commands/device.lostmode.playsound.yaml
+21
View File
@@ -0,0 +1,21 @@
title: Play Lost Mode Sound Command
description: This command allows the server to tell the device to play a sound if
it is in MDM Lost Mode. The sound will play until the device is either removed from
Lost Mode or a user disables the sound from the device.
payload:
requesttype: PlayLostModeSound
supportedOS:
iOS:
introduced: '10.3'
accessrights: None
supervised: true
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
content: This command allows the server to tell the device to play a sound if it
is in MDM Lost Mode. The sound will play until the device is either removed from
Lost Mode or a user disables the sound from the device.
mdm/commands/device.restart.yaml
+78
View File
@@ -0,0 +1,78 @@
title: Device Restart Command
description: This command requires the Device Lock access right. The device will restart
immediately.
payload:
requesttype: RestartDevice
supportedOS:
iOS:
introduced: '10.3'
accessrights: AllowPasscodeRemovalAndLock
supervised: true
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: '10.13'
accessrights: AllowPasscodeRemovalAndLock
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: '10.2'
accessrights: AllowPasscodeRemovalAndLock
supervised: true
content: This command requires the Device Lock access right. The device will restart
immediately.
payloadkeys:
- key: RebuildKernelCache
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', the system rebuilds the kernel cache during a device restart.
If 'BootstrapTokenAllowedForAuthentication' is 'true' in the SecurityInfoResponse.SecurityInfo
response, the device requests the bootstrap token from the MDM server prior to
executing this command. This value is available in macOS 11 and later.
- key: KextPaths
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
tvOS:
introduced: n/a
type: <array>
presence: optional
content: If 'RebuildKernelCache' is 'true', this value specifies the paths to kexts
to add to the auxiliary kernel cache since the last kernel cache rebuild. If not
present, the system only adds previously discovered kexts to the kernel cache.
This value is available in macOS 11 and later.
subkeys:
- key: KextPathsItem
type: <string>
- key: NotifyUser
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.4'
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: |-
If 'true', notifies the user to restart the device at their convenience. No forced restart occurs unless the device is at 'loginwindow' with no logged-in users. The user can dismiss the notification and ignore the request. No further notifications display unless you resend the command.
This value is available in macOS 11.3 and later.
mdm/commands/device.restrictions.clearpassword.yaml
+15
View File
@@ -0,0 +1,15 @@
title: Clear Restrictions Password Command
description: This command clears the restrictions passcode, either disabling parental
controls or allowing you to edit them.
payload:
requesttype: ClearRestrictionsPassword
supportedOS:
iOS:
introduced: '8.0'
accessrights: None
supervised: true
requiresdep: false
sharedipad:
mode: forbidden
userenrollment:
mode: forbidden
mdm/commands/device.restrictions.list.yaml
+123
View File
@@ -0,0 +1,123 @@
title: Device Restrictions Command
description: This command allows the server to determine what restrictions are being
enforced on the device, and the total sum of all restrictions. This command requires
the Restrictions Query access right.
payload:
requesttype: Restrictions
supportedOS:
iOS:
introduced: '4.0'
accessrights: AllowQueryRestrictions
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: true
userenrollment:
mode: forbidden
tvOS:
introduced: '6.1'
accessrights: AllowQueryRestrictions
supervised: false
content: This command allows the server to determine what restrictions are being
enforced on the device, and the total sum of all restrictions. This command requires
the Restrictions Query access right. This technically does work on macOS but it
returns a blank dictionary and there no plans to change this behavior.
payloadkeys:
- key: ProfileRestrictions
type: <boolean>
presence: optional
default: false
content: If 'true', the device reports restrictions from each profile. This value
is available in iOS 4 and later, and tvOS 6.1 and later.
responsekeys:
- key: GlobalRestrictions
type: <dictionary>
presence: required
content: A dictionary that contains the global restrictions in effect. This value
is available in iOS 4 and later, and tvOS 6.1 and later.
subkeytype: RestrictionsDictionary
subkeys: &id001
- key: restrictedBool
type: <dictionary>
presence: optional
content: A dictionary of Boolean restrictions.
subkeytype: BooleanDictionary
subkeys:
- key: ANY restriction name
type: <dictionary>
presence: optional
content: The Boolean restriction parameters.
subkeys:
- key: value
type: <boolean>
presence: required
content: The value of the restriction.
- key: restrictedValue
type: <dictionary>
presence: optional
content: A dictionary of numeric restrictions.
subkeytype: ValueDictionary
subkeys:
- key: ANY restriction name
type: <dictionary>
presence: optional
content: The numeric restriction parameters.
subkeys:
- key: value
type: <integer>
presence: required
content: The value of the restriction.
- key: intersection
type: <dictionary>
presence: optional
content: A dictionary of intersected restrictions. Intersected restrictions indicate
that new restrictions can only reduce the number of strings in the set.
subkeytype: IntersectionDictionary
subkeys:
- key: ANY restriction name
type: <dictionary>
presence: optional
content: The intersected restriction parameters.
subkeys:
- key: values
type: <array>
presence: required
content: The values of the restriction.
subkeys:
- key: valuesItem
type: <string>
- key: union
type: <dictionary>
presence: optional
content: A dictionary of unioned restrictions. Unioned restrictions indicate that
new restrictions can add to the set.
subkeytype: UnionDictionary
subkeys:
- key: ANY restriction name
type: <dictionary>
presence: optional
content: The unioned restriction parameters.
subkeys:
- key: values
type: <array>
presence: required
content: The values of the restriction.
subkeys:
- key: valuesItem
type: <string>
- key: ProfileRestrictions
type: <dictionary>
presence: required
content: A dictionary that contains dictionaries of restrictions from each profile.
This value is only available when 'ProfileRestrictions' is 'true' in the command.
The keys are the identifiers of the profiles. This value is available in iOS 4
and later, and tvOS 6.1 and later.
subkeys:
- key: ANY profile identifier
type: <dictionary>
presence: optional
content: The profile identifiers.
subkeytype: RestrictionsDictionary
subkeys: *id001
mdm/commands/device.shutdown.yaml
+27
View File
@@ -0,0 +1,27 @@
title: Device Shut Down Command
description: This command requires the Device Lock access right. The device will shut
down immediately.
payload:
requesttype: ShutDownDevice
supportedOS:
iOS:
introduced: '10.3'
accessrights: AllowPasscodeRemovalAndLock
supervised: true
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: '10.13'
accessrights: AllowPasscodeRemovalAndLock
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: forbidden
content: This command requires the Device Lock access right. The device will shut
down immediately.
mdm/commands/information.contentcaching.yaml
+629
View File
@@ -0,0 +1,629 @@
title: Content Caching Information Command
description: This command allows the server to query for information about Content
Caching.
payload:
requesttype: ContentCachingInformation
supportedOS:
macOS:
introduced: 10.15.4
accessrights: AllowQueryNetworkInformation
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: forbidden
content: This command allows the server to query for information about Content Caching.
responsekeys:
- key: StatusResponse
type: <dictionary>
presence: required
content: A dictionary that contains the status of content caching on a device.
subkeys:
- key: Activated
type: <boolean>
presence: optional
default: false
content: If 'true', the device has enabled content caching. Enabling content caching
doesn't guarantee service. See the 'Active' key for the readiness of content
caching to serve requests.
- key: Active
type: <boolean>
presence: optional
default: false
content: If 'true', content caching is ready to serve requests.
- key: ActualCacheUsed
type: <integer>
presence: optional
content: The actual amount of disk space, in bytes, that cached content uses.
See related values 'CacheUsed' and 'PersonalCacheUsed'.
- key: AlertsForPeerFilterRanges
type: <dictionary>
presence: optional
content: |-
The error conditions the content cache detected in the 'PeerFilterRanges' in the installed 'com.apple.AssetCache.managed' payload.
To display these alerts on the device, set 'DisplayAlerts' to 'true' in the installed ContentCaching profile.
subkeys:
- key: Index into the PeerFilterRanges in the installed com.apple.AssetCache.managed
payload
type: <dictionary>
presence: required
content: A dictionary that describes the alerts for the peer filter ranges.
subkeys:
- key: className
type: <string>
presence: required
rangelist:
- AssetCacheUnfriendlyPeersInFilterRangeAlert
content: The type of the alert.
- key: postDate
type: <date>
presence: required
content: The date of the alert.
- key: peerFilterRangeIndex
type: <integer>
presence: required
content: The index into the 'PeerFilterRanges' in the installed ContentCaching
payload.
- key: addresses
type: <array>
presence: required
content: An array of local IP addresses of peer content caches that rejected
requests from the content cache.
subkeys:
- key: address
type: <string>
presence: required
content: Local IP address of a peer Content Cache that rejected requests
from this Content Cache.
- key: Alerts
type: <array>
presence: optional
content: |-
An array that contains the error conditions the content cache detected that aren't related to peer filter ranges, parent content caches, or peer content caches.
See 'AlertsForPeerFilterRanges' for errors related to peer filter ranges.
See 'Parents' and 'Peers' for errors related to parent and peer content caches.
To display these alerts on the device, set 'DisplayAlerts' to 'true' in the installed ContentCaching profile.
subkeys:
- key: AlertsItem
type: <dictionary>
presence: required
subkeys:
- key: className
type: <string>
presence: required
rangelist:
- AssetCacheLowSpaceAlert
- AssetCacheNoSpaceAlert
- AssetCacheRegistrationRejectedAlert
- AssetCacheRegistrationUnavailableAlert
- AssetCacheResourceMissingAlert
content: The type of the alert.
- key: postDate
type: <date>
presence: required
content: The date of the alert.
- key: cacheLimit
type: <integer>
presence: optional
content: The limit, in bytes, for the content cache at the time of the alert.
This value only applies to 'AssetCacheLowSpaceAlert' and 'AssetCacheNoSpaceAlert'
types.
- key: reservedVolumeSpace
type: <integer>
presence: optional
content: The space, in bytes, that the system reserves at the time of the
alert. This value only applies to the 'AssetCacheLowSpaceAlert' and 'AssetCacheNoSpaceAlert'
types.
- key: resource
type: <string>
presence: optional
content: The resource that was missing or inaccessible at the time of the
alert. This value only applies to the 'AssetCacheResourceMissingAlert' type.
- key: pathPreventingAccess
type: <string>
presence: optional
content: The subpath of the resource that was missing or inaccessible at the
time of the alert. This value only applies to the 'AssetCacheResourceMissingAlert'
type.
- key: CacheDetails
type: <dictionary>
presence: optional
content: The amount of disk space that various categories of cached content use.
Apple defines these categories and they're subject to change.
subkeys:
- key: Category Name
type: <integer>
presence: required
content: The amount of disk space, in bytes, that this category of cached content
uses.
- key: CacheFree
type: <integer>
presence: optional
content: The amount of disk space, in bytes, available to the content cache.
- key: CacheLimit
type: <integer>
presence: optional
content: The maximum amount of disk space, in bytes, available to the content
cache. A value of '0' indicates an unlimited amount. This value corresponds
to 'CacheLimit' in the installed ContentCaching profile.
- key: CacheStatus
type: <string>
presence: optional
rangelist:
- LOWSPACE
- OK
content: The level of cache pressure. 'LowSpace' means cache pressure is high.
- key: CacheUsed
type: <integer>
presence: optional
content: The amount of disk space, in bytes, cached content uses. Content caching
allocates space in its cache for entire files even when it stores only part
of those files in its cache.
- key: DataMigrationCompleted
type: <boolean>
presence: optional
default: false
content: If 'true', the content cache finished moving from one volume to another.
- key: DataMigrationError
type: <dictionary>
presence: optional
content: The error that occurred while the content cache moved from one volume
to another.
subkeys:
- key: domain
type: <string>
presence: required
content: The error domain.
- key: code
type: <integer>
presence: required
content: The error code.
- key: userInfo
type: <dictionary>
presence: optional
content: A dictionary that contains additional information about the error.
subkeys:
- key: ANY
type: <any>
presence: optional
content: A dictionary that contains additional details about the error.
- key: DataMigrationProgress
type: <real>
presence: optional
range:
min: 0.0
max: 1.0
content: A floating-point number between '0.0' and '1.0' that indicates the percentage
of progress in moving the content cache from one volume to another. A value
of '1.0' indicates that the content cache has fully migrated.
- key: MaxCachePressureLast1Hour
type: <real>
presence: optional
range:
min: 0.0
max: 1.0
content: A floating-point number between '0.0' and '1.0' that represents how often
the cache needed more disk space over the last hour of operation. A lower value
is better.
- key: Parents
type: <array>
presence: optional
content: An array of dictionaries that describes parent content caches.
subkeys:
- key: ParentsItem
type: <dictionary>
presence: optional
subkeys:
- key: address
type: <string>
presence: required
content: The local IP address of the parent content cache.
- key: alert
type: <dictionary>
presence: optional
content: A dictionary that describes an alert related to the parent content
cache.
subkeys:
- key: className
type: <string>
presence: required
rangelist:
- AssetCacheParentCycleAlert
- AssetCacheParentDepthAlert
content: The type of the alert.
- key: postDate
type: <date>
presence: required
content: The date of the alert.
- key: addresses
type: <array>
presence: required
content: An array of local IP addresses of parent content caches.
subkeys:
- key: address
type: <string>
presence: required
content: Local IP address of a parent Content Cache.
- key: details
type: <dictionary>
presence: required
content: A dictionary that contains additional details about the parent content
cache.
subkeys:
- key: ac-power
type: <boolean>
presence: optional
default: false
content: If 'true', the parent content cache power source is AC; otherwise,
an internal battery provides its power.
- key: cache-size
type: <integer>
presence: optional
content: The maximum amount of disk space, in bytes, available to the parent
content cache.
- key: capabilities
type: <dictionary>
presence: optional
content: A dictionary that describes the capabilities of the parent content
cache.
subkeys:
- key: im
type: <boolean>
presence: optional
default: false
content: If 'true', the parent content cache is capable of imports and
uploads.
- key: ns
type: <boolean>
presence: optional
default: false
content: If 'true', the parent content cache is capable of handling namespaces,
which is an aspect of personal caching.
- key: pc
type: <boolean>
presence: optional
default: false
content: If 'true', the parent content cache is capable of caching personal
iCloud content.
- key: query-parameters
type: <boolean>
presence: optional
default: false
content: If 'true', the parent content cache is capable of handling query
parameters in URLs.
- key: sc
type: <boolean>
presence: optional
default: false
content: If 'true', the parent content cache is capable of caching shared
non-iCloud content.
- key: ur
type: <boolean>
presence: optional
default: false
content: If 'true', the parent content cache is capable of prioritizing
imports and uploads.
- key: is-portable
type: <boolean>
presence: optional
default: false
content: If 'true', the parent content cache computer is portable; for example,
a laptop.
- key: local-network
type: <dictionary>
presence: optional
content: A dictionary that describes the parent content cache's connection
to its local network.
subkeys:
- key: speed
type: <integer>
presence: optional
content: The transfer speed, in megabits per second, of the parent content
cache's connection to its local network.
- key: wired
type: <boolean>
presence: optional
default: false
content: If 'true', the parent content cache has a wired connection to
its local network. If 'false', it has a wireless connection; for example,
Wi-Fi.
- key: guid
type: <string>
presence: required
content: The unique identifier of the parent content cache.
- key: healthy
type: <boolean>
presence: required
content: If 'true,' the parent content cache is able to respond to requests
from this content cache.
- key: port
type: <integer>
presence: required
content: The IP port number the parent content cache listens to for requests.
- key: version
type: <string>
presence: required
content: The version number of the parent content cache software.
- key: Peers
type: <array>
presence: optional
content: An array of dictionaries that describes peer content caches.
subkeys:
- key: PeersItem
type: <dictionary>
presence: optional
subkeys:
- key: address
type: <string>
presence: required
content: The local IP address of the peer content cache.
- key: alert
type: <dictionary>
presence: optional
content: A dictionary that describes an alert related to the peer content
cache.
subkeys:
- key: className
type: <string>
presence: required
rangelist:
- AssetCachePeerCycleAlert
- AssetCacheUnfriendlyPeerAlert
content: The type of the alert.
- key: postDate
type: <date>
presence: required
content: The date of the alert.
- key: addresses
type: <array>
presence: optional
content: An array of local IP addresses of peer content caches.
subkeys:
- key: address
type: <string>
presence: required
content: Local IP address of a peer Content Cache.
- key: peerAddress
type: <string>
presence: optional
content: The local IP address of a peer content cache.
- key: details
type: <dictionary>
presence: required
content: A dictionary that contains additional details about the peer content
cache.
subkeys:
- key: ac-power
type: <boolean>
presence: optional
default: false
content: If 'true', the peer content cache power source is AC; otherwise,
an internal battery provides its power.
- key: cache-size
type: <integer>
presence: optional
content: The maximum amount of disk space, in bytes, available to the peer
content cache.
- key: capabilities
type: <dictionary>
presence: optional
content: A dictionary that describes the capabilities of the peer content
cache.
subkeys:
- key: im
type: <boolean>
presence: optional
default: false
content: If 'true', the peer content cache is capable of imports and uploads.
- key: ns
type: <boolean>
presence: optional
default: false
content: If 'true', the peer content cache is capable of handling namespaces,
which is an aspect of personal caching.
- key: pc
type: <boolean>
presence: optional
default: false
content: If 'true', the peer content cache is capable of caching personal
iCloud content.
- key: query-parameters
type: <boolean>
presence: optional
default: false
content: If 'true', the peer content cache is capable of handling query
parameters in URLs.
- key: sc
type: <boolean>
presence: optional
default: false
content: If 'true', the peer content cache is capable of caching shared
non-iCloud content.
- key: ur
type: <boolean>
presence: optional
default: false
content: If 'true', the peer content cache is capable of prioritizing
imports and uploads.
- key: is-portable
type: <boolean>
presence: optional
default: false
content: If 'true', the peer content cache computer is portable; for example,
a laptop.
- key: local-network
type: <dictionary>
presence: optional
content: A dictionary that describes the peer content cache's connection
to its local network.
subkeys:
- key: speed
type: <integer>
presence: optional
content: The transfer speed, in megabits per second, of the peer content
cache's connection to its local network.
- key: wired
type: <boolean>
presence: optional
default: false
content: If 'true', the peer content cache has a wired connection to its
local network. If 'false', it has a wireless connection; for example,
Wi-Fi.
- key: friendly
type: <boolean>
presence: required
content: If 'true', the peer content cache is able to respond to requests
from the content cache.
- key: guid
type: <string>
presence: required
content: The unique identifier of the peer content cache.
- key: healthy
type: <boolean>
presence: required
content: If 'true', the peer content cache is able to respond to requests
from the content cache.
- key: port
type: <integer>
presence: required
content: The IP port number the peer content cache listens to for requests.
- key: version
type: <string>
presence: required
content: The version number of the peer content cache software.
- key: PersonalCacheFree
type: <integer>
presence: optional
content: The amount of disk space, in bytes, available to the content cache for
personal iCloud content.
- key: PersonalCacheLimit
type: <integer>
presence: optional
content: The maximum amount of disk space, in bytes, available to the content
cache for personal iCloud content. A value of '0' indicates an unlimited amount.
- key: PersonalCacheUsed
type: <integer>
presence: optional
content: The amount of disk space, in bytes, available to the content cache for
personal iCloud content.
- key: Port
type: <integer>
presence: optional
content: The IP port number the content cache listens to for requests from clients,
peers, and children.
- key: PrivateAddresses
type: <array>
presence: optional
content: An array of the content cache's local IP addresses.
subkeys:
- key: PrivateAddressesItem
type: <string>
presence: required
content: Local IP address at which the Content Cache listens for requests from
clients, peers, and children.
- key: PublicAddress
type: <string>
presence: optional
content: The public IP address of the content cache.
- key: RegistrationError
type: <string>
presence: optional
content: If present, the reason the content cache failed to register itself with
Apple.
- key: RegistrationResponseCode
type: <integer>
presence: optional
content: If present, the HTTP response code the content cache received when it
failed to register itself with Apple.
- key: RegistrationStarted
type: <date>
presence: optional
content: The date when the content cache began registering itself with Apple.
This value is only available during registration attempts.
- key: RegistrationStatus
type: <integer>
presence: optional
rangelist:
- -1
- 0
- 1
content: |-
The status of the content cache's registration with Apple, which is one of the following values:
* '-1:' Failed
* ' 0:' Pending
* ' 1:' Succeeded
- key: RestrictedMedia
type: <boolean>
presence: optional
default: false
content: If 'true', a restriction prevents caching of certain content types.
- key: ServerGUID
type: <string>
presence: optional
content: The unique identifier of the content cache.
- key: StartupStatus
type: <string>
presence: optional
rangelist:
- FAILED
- MIGRATING_DATA
- OK
- PENDING
content: The status of the content cache's registration with Apple.
- key: TetheratorStatus
type: <integer>
presence: optional
rangelist:
- -1
- 0
- 1
content: |-
The status of tethered caching, which is content caching with a shared internet connection, which is one of the following values:
* '-1:' Unknown
* ' 0:' Disabled
* ' 1:' Enabled
- key: TotalBytesAreSince
type: <date>
presence: optional
content: The start date to use when collecting data for the other 'TotalBytes'
values.
- key: TotalBytesDropped
type: <integer>
presence: optional
content: The amount of data, in bytes, that the content cache downloaded, but
couldn't add to its cache, since the 'TotalBytesAreSince' date.
- key: TotalBytesImported
type: <integer>
presence: optional
content: The amount of data, in bytes, that the content cache received since the
'TotalBytesAreSince' date.
- key: TotalBytesReturnedToChildren
type: <integer>
presence: optional
content: The amount of data, in bytes, that the content cache served to its child
content cache since the 'TotalBytesAreSince' date.
- key: TotalBytesReturnedToClients
type: <integer>
presence: optional
content: The amount of data, in bytes, that the content cache served to client
iOS, macOS, and tvOS devices since the 'TotalBytesAreSince' date.
- key: TotalBytesReturnedToPeers
type: <integer>
presence: optional
content: The amount of data, in bytes, that the content cache served to peer content
caches since the 'TotalBytesAreSince' date.
- key: TotalBytesStoredFromOrigin
type: <integer>
presence: optional
content: The amount of data, in bytes, that the content cache saved from the internet
since the 'TotalBytesAreSince' date.
- key: TotalBytesStoredFromParents
type: <integer>
presence: optional
content: The amount of data, in bytes, that the content cache saved from parent
content caches since the 'TotalBytesAreSince' date.
- key: TotalBytesStoredFromPeers
type: <integer>
presence: optional
content: The amount of data, in bytes, that the content cache saved from peer
content caches since the 'TotalBytesAreSince' date.
mdm/commands/information.device.yaml
+2027
View File
File diff suppressed because it is too large Load Diff
mdm/commands/information.security.yaml
+466
View File
@@ -0,0 +1,466 @@
title: Security Information Command
description: This command queries the device for security-related information. Queries
are available if the MDM host has the Security Query right.
payload:
requesttype: SecurityInfo
supportedOS:
iOS:
introduced: '4.0'
accessrights: AllowQuerySecurity
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '10.7'
accessrights: AllowQuerySecurity
devicechannel: true
userchannel: true
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: '6.0'
accessrights: AllowQuerySecurity
supervised: false
content: This command queries the device for security-related information. Queries
are available if the MDM host has the Security Query right.
responsekeys:
- key: SecurityInfo
type: <dictionary>
presence: required
content: A dictionary that contains security-related information.
subkeys:
- key: HardwareEncryptionCaps
supportedOS:
macOS:
introduced: n/a
type: <integer>
content: |-
An integer that indicates the underlying hardware encryption capabilities of the device, which is one of the following values:
* '1': Block-level encryption
* '2': File-level encryption
* '3': Both block-level and file-level encryption
For a device to have data protection, 'HardwareEncryptionCaps' must be '3' and 'PasscodePresent' must 'true'.
This value is available in iOS 4 and later, and tvOS 6 and later.
- key: PasscodePresent
supportedOS:
iOS:
userenrollment:
mode: forbidden
macOS:
introduced: n/a
type: <boolean>
content: If 'true', the device has a passcode. This value is available in iOS
4 and later, and tvOS 6 and later.
- key: PasscodeCompliant
supportedOS:
macOS:
introduced: n/a
type: <boolean>
content: If 'true', the user's passcode is compliant with all requirements on
the device, including Exchange and other accounts. This value is available in
iOS 4 and later, and tvOS 6 and later.
- key: PasscodeCompliantWithProfiles
supportedOS:
iOS:
userenrollment:
mode: forbidden
macOS:
introduced: n/a
type: <boolean>
content: If 'true', the user's passcode is compliant with requirements from profiles.
This key does not apply to User-Enrolled devices. This value is available in
iOS 4 and later, and tvOS 6 and later.
- key: PasscodeLockGracePeriod
supportedOS:
iOS:
introduced: 9.3.2
sharedipad:
mode: required
userenrollment:
mode: forbidden
macOS:
introduced: n/a
type: <integer>
content: The user preference for the number of seconds before a locked screen
requires the device passcode to unlock it. This value is only available for
Shared iPad.
- key: PasscodeLockGracePeriodEnforced
supportedOS:
iOS:
introduced: 9.3.2
sharedipad:
mode: required
userenrollment:
mode: forbidden
macOS:
introduced: n/a
type: <integer>
content: The enforced value for the number of seconds before a locked screen requires
the device passcode to unlock it. If a device has a passcode, changing 'PasscodeLockGracePeriod'
to a larger value doesn't take effect until the user logs out or removes the
passcode. This value is only available for Shared iPad.
- key: FDE_Enabled
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
userchannel: false
tvOS:
introduced: n/a
type: <boolean>
content: If 'true', the device has enabled FileVault full disk encryption (FDE).
This value is available in macOS 10.9 and later.
- key: FDE_HasPersonalRecoveryKey
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
userchannel: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
type: <boolean>
content: If 'true', FileVault FDE has a personal recovery key. This value is available
in macOS 10.9 and later.
- key: FDE_HasInstitutionalRecoveryKey
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
userchannel: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
type: <boolean>
content: If 'true', FileVault FDE has an institutional recovery key. This value
is available in macOS 10.9 and later.
- key: FDE_PersonalRecoveryKeyCMS
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
userchannel: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
type: <data>
content: If the FileVault personal recovery key has enabled escrow with a recovery
key, this value contains the key. The certificate from the FDERecoveryKeyEscrow
profile encrypts the key and wraps it as CMS data. This value is available in
macOS 10.13 and later.
- key: FDE_PersonalRecoveryKeyDeviceKey
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
userchannel: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
type: <string>
content: If the FileVault personal recovery key has enabled escrow with a recovery
key, this value is the device serial number. This is the value that displays
to the user at the EFI login window as part of the help message if they enter
their password incorrectly three times. The server also uses this value as an
index when saving the device personal recovery key. This replaces the 'recordNumber'
that the server returned in the previous escrow mechanism. This value is available
in macOS 10.13 and later.
- key: SystemIntegrityProtectionEnabled
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.12'
userchannel: false
tvOS:
introduced: n/a
type: <boolean>
content: If 'true', System Integrity Protection (SIP) is active on the device.
This value is available in macOS 10.12 and later.
- key: FirewallSettings
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.12'
userchannel: false
tvOS:
introduced: n/a
type: <dictionary>
content: A dictionary that contains the firewall settings. This value is available
in macOS 10.12 and later.
subkeys:
- key: FirewallEnabled
type: <boolean>
content: If 'true', the firewall is on.
- key: BlockAllIncoming
type: <boolean>
content: If 'true', the firewall blocks all incoming connections.
- key: StealthMode
type: <boolean>
content: If true, stealth mode is active for the firewall.
- key: Applications
supportedOS:
macOS:
introduced: '10.12'
userenrollment:
mode: forbidden
type: <array>
content: An array of dictionaries that describes the allowed applications.
subkeys:
- key: ApplicationsItem
type: <dictionary>
subkeys:
- key: Allowed
type: <boolean>
content: If 'true', the app is an allowed app.
- key: BundleID
type: <string>
content: The app's bundle identifier.
- key: Name
type: <string>
content: The app's display name if it's determinable from the 'BundleID'.
- key: LoggingEnabled
supportedOS:
macOS:
introduced: '12.0'
type: <boolean>
content: If 'true', logging is enabled.
- key: LoggingOption
supportedOS:
macOS:
introduced: '12.0'
type: <string>
rangelist:
- throttled
- brief
- detail
content: The type of logging emitted by the firewall.
- key: FirmwarePasswordStatus
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.13'
userchannel: false
tvOS:
introduced: n/a
type: <dictionary>
content: A dictionary that contains the status of the EFI firmware password. This
value is available in macOS 10.13 and later.
subkeys:
- key: PasswordExists
type: <boolean>
content: If 'true', the device has an EFI firmware password.
- key: ChangePending
type: <boolean>
content: |-
If 'true', a firmware password change is pending. A device restart is necessary for this change to take effect. Until then, additional attempts to change the password fail.
If 'true', the other values show the current state of the device, not the state after a restart.
- key: AllowOroms
type: <boolean>
content: If 'true', enable ROMs.
- key: ManagementStatus
supportedOS:
iOS:
introduced: '13.0'
macOS:
introduced: 10.13.2
tvOS:
introduced: '13.0'
type: <dictionary>
content: A dictionary that contains the status of the device's MDM enrollment.
subkeys:
- key: EnrolledViaDEP
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
type: <boolean>
content: If 'true', the device enrolled in MDM through the Device Enrollment
Program (DEP). This value is available in macOS 10.13.2 and later.
- key: UserApprovedEnrollment
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
type: <boolean>
content: If 'true', the enrollment was user-approved. If 'false', the device
may reject certain security-sensitive payloads or commands. This value is
available in macOS 10.13.2 and later.
- key: IsUserEnrollment
supportedOS:
macOS:
introduced: '10.15'
type: <boolean>
content: If 'true', the device is user-enrolled. This value is available in
iOS 13 and later, and macOS 10.15 and later.
- key: IsActivationLockManageable
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.15'
tvOS:
introduced: n/a
type: <boolean>
content: If 'true', the type of enrollment allows the MDM to manage Activation
Lock for this device. This value is available in macOS 10.15 and later.
- key: SecureBoot
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.15'
userchannel: false
tvOS:
introduced: n/a
type: <dictionary>
content: A dictionary that contains the device's Secure Boot settings. This value
is available in macOS 10.15 and later.
subkeys:
- key: SecureBootLevel
type: <string>
rangelist:
- 'off'
- medium
- full
- not supported
content: The security level for the bootable operating system versions.
- key: ExternalBootLevel
type: <string>
rangelist:
- allowed
- disallowed
- not supported
content: The device's external boot level, which indicates whether it allows
booting from an external device, disallows it, or doesn't support it.
- key: ReducedSecurity
supportedOS:
macOS:
introduced: '11.0'
type: <array>
content: |-
Reports which security features the user disables in 'recoveryOS'. This property is only present for Apple silicon when 'SecureBootLevel' is 'medium'.
Available in iOS 11 and later.
subkeys:
- key: ReducedSecurityItems
type: <string>
subkeys:
- key: AllowsAnyAppleSignedOS
type: <string>
content: If 'true', allows any signed version of trusted system software
from Apple to run.
- key: AllowsUserKextApproval
type: <string>
content: If 'true', the user has control over kernel extensions.
- key: AllowsMDM
type: <string>
content: If 'true', the MDM server controls kernel extensions and software
updates.
- key: RemoteDesktopEnabled
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.14.4
userchannel: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
type: <boolean>
content: If 'true', Remote Desktop is active on the device. This value is available
in macOS 10.14.4 and later.
- key: AuthenticatedRootVolumeEnabled
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
userchannel: false
tvOS:
introduced: n/a
type: <boolean>
content: If 'true', the system booted using an Authenticated Root Volume. This
value is available in macOS 11 and later.
- key: BootstrapTokenAllowedForAuthentication
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
userchannel: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
type: <string>
rangelist:
- allowed
- disallowed
- not supported
content: |-
This value specifies whether the Secure Enclave Processor (SEP) supports and allows secure operations to use the Bootstrap Token. The value is automatically set for devices enrolled through the Device Enrollment Program (DEP). The user can also manually set this value in the RecoveryOS.
This value is available for Apple silicon in macOS 11 and later. Not available for user enrollment.
- key: BootstrapTokenRequiredForSoftwareUpdate
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
userchannel: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
type: <boolean>
content: |-
If 'true', the device can accept a Bootstrap Token from the MDM server instead of prompting for user authentication prior to installation. This only applies when 'BootstrapTokenAllowedForAuthentication' is 'true' in the SecurityInfoResponse.SecurityInfo response.
This value is available for Apple silicon in macOS 11 and later. Not available for user enrollment.
- key: BootstrapTokenRequiredForKernelExtensionApproval
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
userchannel: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
type: <boolean>
content: |-
If 'true', the device can accept a Bootstrap Token from the MDM server instead of prompting for user authentication prior to enabling kernel extensions. This includes enabling kexts through the 'com.apple.syspolicy.kernel-extension-policy' payload or triggering the 'RestartDevice' command with 'RebuildKernelCache' set to 'true'. This only applies when 'BootstrapTokenAllowedForAuthentication' is 'true' in the SecurityInfoResponse.SecurityInfo response.
This value is available for Apple silicon in macOS 11 and later. Not available for user enrollment.
- key: IsRecoveryLockEnabled
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.5'
userchannel: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
type: <boolean>
content: If 'true', a password is required to enter recovery (see SetRecoveryLockCommand).
Available in macOS 11.5 and later and only on Apple silicon devices.
mdm/commands/lom.devicerequest.yaml
+86
View File
@@ -0,0 +1,86 @@
title: LOM Device Request Command
description: Issues LOM requests to devices.
payload:
requesttype: LOMDeviceRequest
supportedOS:
macOS:
introduced: '11.0'
accessrights: DeviceLockAndRemovePasscode
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: forbidden
content: Used to send LOM requests ("PowerON", "PowerOFF", "Reset") to LOM Controller
which then forwards the request to LOM Devices.
payloadkeys:
- key: RequestList
type: <array>
presence: required
content: An array of requests to perform.
subkeys:
- key: RequestListItem
type: <dictionary>
presence: required
subkeys:
- key: DeviceRequestType
type: <string>
presence: required
rangelist:
- PowerON
- PowerOFF
- Reset
content: The requested action to perform on the device.
- key: DeviceRequestUUID
type: <string>
presence: required
content: The unique identifier of the request.
- key: DeviceDNSName
type: <string>
presence: required
content: The DNS name of the device. This should match the 'dNSName' in SCEP.PayloadContent.SubjectAltName.
- key: PrimaryIPv6AddressList
type: <array>
presence: required
content: An array that contains the IPv6 addresses for primary LOM-compatible
Ethernet interfaces for the device.
subkeys:
- key: PrimaryIPv6AddressListItem
type: <string>
presence: required
- key: SecondaryIPv6AddressList
type: <array>
presence: required
content: An array that contains the IPv6 addresses for secondary LOM-compatible
Ethernet interfaces for the device.
subkeys:
- key: SecondaryIPv6AddressListItem
type: <string>
presence: required
- key: LOMProtocolVersion
type: <integer>
presence: required
content: The LOM protocol version that the device supports. Provide the same
value that 'LOMProtocolVersion' receives in the LOMSetupRequestResponse.
responsekeys:
- key: ResponseList
type: <array>
presence: required
content: An array of dictionaries that describes the status of each request.
subkeys:
- key: ResponseListItem
type: <dictionary>
presence: required
subkeys:
- key: DeviceRequestSuccess
type: <boolean>
presence: required
content: If 'true', the request was successful.
- key: DeviceRequestUUID
type: <string>
presence: required
content: The unique identifier of the request for this response list item.
- key: DeviceRequestReturnError
type: <string>
presence: optional
content: If present, a description of the error for a failed request.
mdm/commands/lom.setuprequest.yaml
+40
View File
@@ -0,0 +1,40 @@
title: LOM Setup Request Command
description: Queries the device for LOM setup information such as IP addresses, protocol
version, etc.
payload:
requesttype: LOMSetupRequest
supportedOS:
macOS:
introduced: '11.0'
accessrights: DeviceLockAndRemovePasscode
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: forbidden
content: Queries the device for LOM setup information such as IP addresses, protocol
version, etc. The MDM server must send this command prior to sending the LOMDeviceRequest
command.
responsekeys:
- key: PrimaryIPv6AddressList
type: <array>
presence: required
content: An array that contains the IPv6 addresses for primary LOM-compatible Ethernet
interfaces for the device.
subkeys:
- key: PrimaryIPv6AddressListItem
type: <string>
presence: required
- key: SecondaryIPv6AddressList
type: <array>
presence: required
content: An array that contains the IPv6 addresses for secondary LOM-compatible
Ethernet interfaces for the device.
subkeys:
- key: SecondaryIPv6AddressListItem
type: <string>
presence: required
- key: LOMProtocolVersion
type: <integer>
presence: required
content: The LOM protocol version that the device supports.
mdm/commands/managed.application.attributes.yaml
+90
View File
@@ -0,0 +1,90 @@
title: App Attributes Command
description: Queries managed application attributes. Attributes can be set on managed
apps. These attributes can be changed over time.
payload:
requesttype: ManagedApplicationAttributes
supportedOS:
iOS:
introduced: '7.0'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
content: Queries managed application attributes. Attributes can be set on managed
apps. These attributes can be changed over time.
payloadkeys:
- key: Identifiers
type: <array>
presence: required
content: The bundle identifiers of the managed apps.
subkeys:
- key: IdentifiersItem
type: <string>
responsekeys:
- key: ApplicationAttributes
type: <array>
presence: required
content: An array of app attributes items.
subkeys:
- key: ApplicationAttributesItem
type: <dictionary>
subkeys:
- key: Identifier
type: <string>
presence: required
content: The app's bundle identifier.
- key: Attributes
type: <dictionary>
presence: optional
content: The app's attributes.
subkeys:
- key: VPNUUID
type: <string>
presence: optional
content: A per-app VPN unique identifier for this app.
- key: AssociatedDomains
supportedOS:
iOS:
introduced: '13.0'
tvOS:
introduced: n/a
type: <array>
presence: optional
content: This app's associated domains. This value is available in iOS 13
and later.
subkeys:
- key: AssociatedDomain
type: <string>
- key: AssociatedDomainsEnableDirectDownloads
supportedOS:
iOS:
introduced: '14.0'
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: true
content: If 'true', perform claimed site association verification directly
at the domain instead of on Apple's servers. Only set this to 'true' for
domains that can't access the internet. This value is available in iOS 14
and later.
- key: Removable
supportedOS:
iOS:
introduced: '14.0'
tvOS:
introduced: '14.0'
type: <boolean>
presence: optional
default: true
content: If 'false', this app isn't removable while it's a managed app. This
value is available in iOS 14 and later.
mdm/commands/managed.application.configuration.yaml
+64
View File
@@ -0,0 +1,64 @@
title: App Configuration Command
description: This command queries the device for the current configuration of managed
applications. This command requires the App Management right. macOS supports this
command as of 10.15, on the device channel and for User Enrollments only, because
Settings->ApplicationConfiguration is supported. Since macOS does not support Managed
Applications, this command can be used for any bundle identifier.
payload:
requesttype: ManagedApplicationConfiguration
supportedOS:
iOS:
introduced: '7.0'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '10.15'
accessrights: AllowAppInstallation
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
content: This command queries the device for the current configuration of managed
applications. This command requires the App Management right.
payloadkeys:
- key: Identifiers
type: <array>
presence: required
content: The bundle identifiers of the managed apps.
subkeys:
- key: IdentifiersItem
type: <string>
responsekeys:
- key: ApplicationConfigurations
type: <array>
presence: required
content: An array of app configurations items.
subkeys:
- key: ApplicationConfigurationsItem
type: <dictionary>
subkeys:
- key: Identifier
type: <string>
presence: required
content: The app's bundle identifier.
- key: Configuration
type: <dictionary>
presence: optional
content: The app's configurations.
subkeys:
- key: ANY
type: <any>
presence: optional
content: The app's configuration items.
mdm/commands/managed.application.feedback.yaml
+66
View File
@@ -0,0 +1,66 @@
title: App Feedback Command
description: This command queries the device for application feedback information.
This command requires the App Management right.
payload:
requesttype: ManagedApplicationFeedback
supportedOS:
iOS:
introduced: '7.0'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '11.0'
accessrights: AllowAppInstallation
devicechannel: false
userchannel: true
userenrollment:
mode: forbidden
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
content: This command queries the device for application feedback information. This
command requires the App Management right.
payloadkeys:
- key: Identifiers
type: <array>
presence: required
content: The bundle identifiers of the managed apps.
subkeys:
- key: IdentifiersItem
type: <string>
- key: DeleteFeedback
type: <boolean>
presence: optional
default: false
content: If 'true', delete the app's feedback dictionary after the server reads
it.
responsekeys:
- key: ManagedApplicationFeedback
type: <array>
presence: required
content: An array of managed app feedback items.
subkeys:
- key: ManagedApplicationFeedbackItem
type: <dictionary>
subkeys:
- key: Identifier
type: <string>
presence: required
content: The app's bundle identifier.
- key: Feedback
type: <dictionary>
presence: optional
content: The app's feedback.
subkeys:
- key: ANY
type: <any>
presence: optional
content: The app's feedback items.
mdm/commands/media.install.yaml
+150
View File
@@ -0,0 +1,150 @@
title: Install Media Command
description: This command allows the server to install a book on a device. If the
book is already being managed, this command will update the book.
payload:
requesttype: InstallMedia
supportedOS:
iOS:
introduced: '8.0'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '10.9'
accessrights: AllowAppInstallation
devicechannel: false
userchannel: true
requiresdep: false
userenrollment:
mode: forbidden
content: This command allows the server to install a book on a device. If the book
is already being managed, this command will update the book.
payloadkeys:
- key: iTunesStoreID
type: <integer>
presence: optional
content: The book's iTunes Store identifier.
- key: MediaURL
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: optional
content: The URL to retrieve the book. This value is available in iOS 8 and later.
- key: MediaType
type: <string>
presence: required
rangelist:
- Book
content: The media type, which can only be 'Book'.
- key: PersistentID
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: optional
content: The book's persistent identifier in reverse-DNS form; for example, 'com.acme.manuals.training'.
This value is available in iOS 8 and later.
- key: Kind
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: optional
rangelist:
- pdf
- epub
- ibooks
content: |-
The kind of the media, which can be one of the following values:
* 'pdf': A PDF file
* 'epub': An EPUB file in 'gzip' format.
* 'ibooks': An iBooks Author file in 'gzip' format.
If you omit this value, its value is the file extension in the URL. This value is available in iOS 8 and later.
- key: Version
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: optional
content: The book's version number. This value is available in iOS 8 and later.
- key: Author
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: optional
content: The name of the book's author. This value is available in iOS 8 and later.
- key: Title
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: optional
content: The book's title. This value is available in iOS 8 and later.
responsekeys:
- key: iTunesStoreID
type: <integer>
presence: optional
content: The book's iTunes Store identifier, if present in the command.
- key: MediaURL
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: optional
content: The URL to retrieve the book, if present in the command. This value is
available in iOS 8 and later.
- key: PersistentID
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: optional
content: The book's persistent identifier, if present in the command. This value
is available in iOS 8 and later.
- key: MediaType
type: <string>
presence: optional
content: The media type, which can only be 'Book'.
- key: State
type: <string>
presence: optional
rangelist:
- Queued
- PromptingForLogin
- Updating
- Installing
- Managed
- ManagedButUninstalled
- Installed
- Uninstalled
- Failed
- Unknown
content: The installation state of this book. The 'Failed' and 'Unknown' states
are transient and the device only reports them once. Books from the Book Store
report their state as 'Installed' instead of 'Managed'.
- key: RejectionReason
type: <string>
presence: optional
rangelist:
- CouldNotVerifyITunesStoreID
- PurchaseNotFound
- AppStoreDisabled
- WrongMediaType
- DownloadInvalid
- EnterpriseBooksNotSupportedInMultiUser
content: |-
The reason, if installation fails, which is one of the following values:
* 'CouldNotVerifyITunesStoreID': The 'iTunesStoreID' is invalid.
* 'PurchaseNotFound': The Volume Purchase Program (VPP) license isn't in the user's history.
* 'AppStoreDisabled': App Store isn't available on the device.
* 'WrongMediaType': The media type is invalid. The only valid type is 'Book'.
* 'DownloadInvalid': The URL doesn't lead to a valid book.
* 'EnterpriseBooksNotSupportedInMultiUser': Multiuser mode doesn't support enterprise books.
mdm/commands/media.managed.list.yaml
+73
View File
@@ -0,0 +1,73 @@
title: Managed Media List Command
description: This command allows the server to query for installed 3rd party applications.
payload:
requesttype: ManagedMediaList
supportedOS:
iOS:
introduced: '8.0'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
content: This command allows the server to query for installed 3rd party applications.
responsekeys:
- key: Books
type: <array>
presence: required
content: An array of dictionaries that describes managed books.
subkeys:
- key: BooksItem
type: <dictionary>
subkeys:
- key: iTunesStoreID
type: <integer>
presence: required
content: The book's iTunes Store identifier.
- key: State
type: <string>
presence: optional
content: |-
The installation state of this book, which is one of the following values:
* 'Queued'
* 'PromptingForLogin'
* 'Updating'
* 'Installing'
* 'Managed'
* 'ManagedButUninstalled'
* 'Installed'
* 'Uninstalled'
* 'Failed'
* 'Unknown'
The 'Failed' and 'Unknown' states are transient and the device only reports them once. Books from the Book Store report their state as 'Installed' instead of 'Managed'.
- key: PersistentID
type: <string>
presence: optional
content: The book's persistent identifier in reverse-DNS form; for example,
'com.acme.manuals.training'.
- key: Kind
type: <string>
presence: optional
content: |-
The kind of the media, which is one of the following values:
* 'pdf': A PDF file
* 'epub': An EPUB file in 'gzip' format
* 'ibooks': An iBooks Author file in 'gzip' format
* The file extension in the URL
This value is available in iOS 8 and later.
- key: Version
type: <string>
presence: optional
content: The book's version number.
- key: Author
type: <string>
presence: optional
content: The name of the book's author.
- key: Title
type: <string>
presence: optional
content: The book's title.
mdm/commands/media.remove.yaml
+34
View File
@@ -0,0 +1,34 @@
title: Remove Media Command
description: This command allows an MDM server to remove managed media. This command
returns Acknowledged even if the item is not found.
payload:
requesttype: RemoveMedia
supportedOS:
iOS:
introduced: '8.0'
accessrights: AllowAppInstallation
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
content: This command allows an MDM server to remove managed media. This command
returns Acknowledged even if the item is not found.
payloadkeys:
- key: MediaType
type: <string>
presence: required
rangelist:
- Book
content: The media type, which can only be 'Book'.
- key: iTunesStoreID
type: <string>
presence: optional
content: The book's iTunes Store identifier.
- key: PersistentID
type: <string>
presence: optional
content: The book's persistent identifier in reverse-DNS form; for example, 'com.acme.manuals.training'.
mdm/commands/mirroring.request.yaml
+55
View File
@@ -0,0 +1,55 @@
title: Request Mirroring Command
description: This command prompts the user to share their screen using AirPlay mirroring.
payload:
requesttype: RequestMirroring
supportedOS:
iOS:
introduced: '7.0'
accessrights: None
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '10.10'
accessrights: None
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: allowed
content: This command prompts the user to share their screen using AirPlay Mirroring.
payloadkeys:
- key: DestinationName
type: <string>
presence: optional
content: The name of the AirPlay Mirroring destination.
- key: DestinationDeviceID
type: <string>
presence: optional
content: The hardware address of the AirPlay Mirroring destination that identifies
the device, in the format 'xx:xx:xx:xx:xx'. This value isn't case-sensitive.
- key: ScanTime
type: <integer>
presence: optional
content: The number of seconds, from '10' to '300', for the device to spend searching
for the destination. The default value is '30'.
- key: Password
type: <string>
presence: optional
content: The screen-sharing password that the device uses when connecting to the
destination.
responsekeys:
- key: MirroringResult
type: <string>
presence: optional
content: |-
The result of the request. One of these values:
* 'Prompting': The user is receiving a prompt to share their screen.
* 'DestinationNotFound': The device is unable to reach the destination.
* 'Cancelled': The user canceled the request.
* 'Unknown': An unknown error occurred.
mdm/commands/mirroring.stop.yaml
+25
View File
@@ -0,0 +1,25 @@
title: Stop Mirroring Command
description: This command stops AirPlay mirroring.
payload:
requesttype: StopMirroring
supportedOS:
iOS:
introduced: '7.0'
accessrights: None
supervised: true
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: '10.10'
accessrights: None
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: forbidden
content: This command stops AirPlay mirroring.
mdm/commands/passcode.clear.yaml
+23
View File
@@ -0,0 +1,23 @@
title: Clear Passcode Command
description: This command allows the server to clear the passcode on the device. This
command requires the Device Lock and Passcode Removal right.
payload:
requesttype: ClearPasscode
supportedOS:
iOS:
introduced: '4.0'
accessrights: AllowPasscodeRemovalAndLock
supervised: false
requiresdep: false
sharedipad:
mode: forbidden
userenrollment:
mode: forbidden
content: This command allows the server to clear the passcode on the device. This
command requires the Device Lock and Passcode Removal right.
payloadkeys:
- key: UnlockToken
type: <data>
presence: required
content: The unlock token value that the device provides in its 'TokenUpdateMessage'
check-in message.
mdm/commands/passcode.firmware.set.yaml
+37
View File
@@ -0,0 +1,37 @@
title: Set Firmware Password Command
description: Changes or clears the firmware password for the device.
payload:
requesttype: SetFirmwarePassword
supportedOS:
macOS:
introduced: '10.13'
accessrights: DeviceLockAndRemovePasscode
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: forbidden
content: Changes or clears the firmware password for the device. Requires the "Device
lock and passcode removal right". This command is not available on Apple silicon
devices.
payloadkeys:
- key: CurrentPassword
type: <string>
presence: optional
content: The current password, which you must set if the device has a firmware password.
- key: NewPassword
type: <string>
presence: required
content: The new firmware password. Set to an empty string to clear the password.
The characters in this value must consist of low-ASCII, printable characters ('0x20'
through '0x7E') to ensure that all characters are enterable on the EFI login screen.
- key: AllowOroms
type: <boolean>
presence: optional
default: false
content: If 'true', enable ROMs.
responsekeys:
- key: PasswordChanged
type: <boolean>
presence: required
content: If 'true', the password change succeeded.
mdm/commands/passcode.firmware.verify.yaml
+25
View File
@@ -0,0 +1,25 @@
title: Verify Firmware Password Command
description: Verifies the device's firmware password.
payload:
requesttype: VerifyFirmwarePassword
supportedOS:
macOS:
introduced: '10.13'
accessrights: None
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: forbidden
content: Verifies the device's firmware password. This command is not available
on Apple silicon devices.
payloadkeys:
- key: Password
type: <string>
presence: required
content: The password to verify.
responsekeys:
- key: PasswordVerified
type: <boolean>
presence: required
content: If 'true', the provided password matches the firmware password on the device.
mdm/commands/passcode.recovery.set.yaml
+26
View File
@@ -0,0 +1,26 @@
title: Set Recovery Lock Command
description: Sets or clears the recovery lock password (AppleSilicon devices only)
payload:
requesttype: SetRecoveryLock
supportedOS:
macOS:
introduced: '11.5'
accessrights: DeviceLockAndRemovePasscode
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: forbidden
content: Sets or clears the recovery lock password (AppleSilicon devices only).
Requires the "Device lock and passcode removal right".
payloadkeys:
- key: CurrentPassword
type: <string>
presence: optional
content: If the device has a Recovery Lock password set, the system requires the
current password.
- key: NewPassword
type: <string>
presence: required
content: The new password for Recovery Lock. Set as an empty string to clear the
Recovery Lock password.
mdm/commands/passcode.recovery.verify.yaml
+24
View File
@@ -0,0 +1,24 @@
title: Verify Recovery Lock Command
description: Verifies the device's recovery lock password. (AppleSilicon devices only)
payload:
requesttype: VerifyRecoveryLock
supportedOS:
macOS:
introduced: '11.5'
accessrights: DeviceLockAndRemovePasscode
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: forbidden
content: Verifies the device's recovery lock password. (AppleSilicon devices only)
payloadkeys:
- key: Password
type: <string>
presence: required
content: The password to verify.
responsekeys:
- key: PasswordVerified
type: <boolean>
presence: required
content: If 'true', the device verified the password.
mdm/commands/passcode.unlocktoken.yaml
+22
View File
@@ -0,0 +1,22 @@
title: Request Unlock Token Command
description: This command requests an UnlockToken from the device.
payload:
requesttype: RequestUnlockToken
supportedOS:
iOS:
introduced: '5.0'
deprecated: 6.1.6
accessrights: None
supervised: true
requiresdep: false
sharedipad:
mode: forbidden
userenrollment:
mode: forbidden
content: This command requests an UnlockToken from the device. Pass this token to
the ClearPasscode command to unlock the device.
responsekeys:
- key: UnlockToken
type: <data>
presence: required
content: The unlock token. Erasing the user partition invalidates this token.
mdm/commands/profile.install.yaml
+41
View File
@@ -0,0 +1,41 @@
title: Install Profile Command
description: This command allows the host to install a configuration profile. The
profile may be encrypted using any installed identity certificate. The profile may
also be signed. This command requires the Profile Installation and Removal right.
It's supported in the user channel.
payload:
requesttype: InstallProfile
supportedOS:
iOS:
introduced: '4.0'
accessrights: AllowInstallationRemoval
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
macOS:
introduced: '10.7'
accessrights: AllowInstallationRemoval
devicechannel: true
userchannel: true
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: '6.0'
accessrights: AllowInstallationRemoval
supervised: false
content: This command allows the host to install a configuration profile. The profile
may be encrypted using any installed identity certificate. The profile may also
be signed. This command requires the Profile Installation and Removal right. It's
supported in the user channel.
payloadkeys:
- key: Payload
type: <data>
presence: required
content: The profile to install, which you can encrypt using any identity certificate
installed on the device. You can also sign the profile.
mdm/commands/profile.list.yaml
+154
View File
@@ -0,0 +1,154 @@
title: Profile List Command
description: This command allows the MDM server to query for the profiles installed
on the device. This command requires the Inspect Profile Manifest right. It's supported
on the user channel.
payload:
requesttype: ProfileList
supportedOS:
iOS:
introduced: '4.0'
accessrights: AllowInspection
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
macOS:
introduced: '10.7'
accessrights: AllowInspection
devicechannel: true
userchannel: true
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: '6.0'
accessrights: AllowInspection
supervised: false
content: This command allows the MDM server to query for the profiles installed
on the device. This command requires the Inspect Profile Manifest right. It's
supported on the user channel.
payloadkeys:
- key: ManagedOnly
supportedOS:
iOS:
introduced: '13.0'
macOS:
introduced: '10.15'
tvOS:
introduced: '13.0'
type: <boolean>
presence: optional
default: false
content: If 'true', only include profiles that MDM has installed. For user enrollments,
the device ignores this key and always limits the results to managed profiles.
This value is available in iOS 13 and later, macOS 10.5 and later, and tvOS 13
and later.
responsekeys:
- key: ProfileList
type: <array>
presence: required
content: An array of dictionaries that describes each installed profile.
subkeys:
- key: ProfileListItem
type: <dictionary>
subkeys:
- key: PayloadUUID
type: <string>
presence: required
content: The unique identifier for the profile.
- key: PayloadIdentifier
type: <string>
presence: required
content: The reverse-DNS-style identifier of the profile; for example, 'com.example.myprofile'.
- key: PayloadVersion
type: <integer>
presence: optional
content: The version of the configuration profile as a whole, not of the individual
profiles within it. The value should be '1'.
- key: PayloadDisplayName
type: <string>
presence: optional
content: The human-readable name of the profile.
- key: PayloadOrganization
type: <string>
presence: optional
content: The human-readable name of the organization that provided the profile.
- key: PayloadDescription
type: <string>
presence: optional
content: The description of the profile.
- key: PayloadRemovalDisallowed
type: <boolean>
presence: optional
default: false
content: If 'true', the user can't delete the profile unless it has a removal
password and the user provides it. The framework ignores this field on unsupervised
devices.
- key: HasRemovalPasscode
type: <boolean>
presence: optional
default: false
content: If 'true', the profile has a passcode for removal.
- key: IsEncrypted
type: <boolean>
presence: optional
default: false
content: If 'true', it's an encrypted profile.
- key: SignerCertificates
type: <array>
presence: optional
content: An array that contains the certificate for signing the profile, followed
by any intermediate certificates, in DER-encoded X.509 format.
subkeys:
- key: CertificateItem
type: <data>
content: DER-encoded X.509 certificate
- key: IsManaged
supportedOS:
macOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', the current MDM service installed the profile. MDM doesn't
return this value for supervised devices, and can remove or replace all profiles
on supervised devices.
- key: PayloadContent
type: <array>
presence: optional
content: An array of payload content items. This value isn't present if 'IsEncrypted'
is 'true'.
subkeys:
- key: PayloadContentItem
type: <dictionary>
subkeys:
- key: PayloadType
type: <string>
presence: required
content: The type of payload for the profile. The only supported value is
'Configuration'.
- key: PayloadVersion
type: <integer>
presence: required
content: The version of the configuration profile as a whole, not of the
individual profiles within it. The value should be '1'.
- key: PayloadIdentifier
type: <string>
presence: required
content: The reverse-DNS-style identifier of the profile; for example, 'com.example.myprofile'.
- key: PayloadDisplayName
type: <string>
presence: optional
content: The human-readable name of the profile.
- key: PayloadDescription
type: <string>
presence: optional
content: The description of the profile.
- key: PayloadOrganization
type: <string>
presence: optional
content: The human-readable name of the organization that provided the profile.
mdm/commands/profile.provisioning.install.yaml
+40
View File
@@ -0,0 +1,40 @@
title: Install Provisioning Profile Command
description: This command allows the server to install a provisioning profile. No
error occurs if the provisioning profile is already installed. This command requires
the Provisioning Profile Installation and Removal right. On macOS, this command
is for iOS and iPadOS style provisioning profiles only.
payload:
requesttype: InstallProvisioningProfile
supportedOS:
iOS:
introduced: '4.0'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '11.0'
accessrights: None
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: '10.2'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
content: This command allows the server to install a provisioning profile. No error
occurs if the provisioning profile is already installed. This command requires
the Provisioning Profile Installation and Removal right. On macOS, this command
is for iOS and iPadOS style provisioning profiles only.
payloadkeys:
- key: ProvisioningProfile
type: <data>
presence: required
content: The provisioning profile.
mdm/commands/profile.provisioning.list.yaml
+69
View File
@@ -0,0 +1,69 @@
title: Provisioning Profile List Command
description: This command allows the server to retrieve the list of installed provisioning
profiles on the device. This command requires the Inspect Provisioning Profiles
right. On macOS, this command is for iOS and iPadOS style provisioning profiles
only.
payload:
requesttype: ProvisioningProfileList
supportedOS:
iOS:
introduced: '4.0'
accessrights: AllowProvisioningInspection
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '11.0'
accessrights: None
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: '10.2'
accessrights: AllowProvisioningInspection
supervised: false
content: This command allows the server to retrieve the list of installed provisioning
profiles on the device. This command requires the Inspect Provisioning Profiles
right. On macOS, this command is for iOS and iPadOS style provisioning profiles
only.
payloadkeys:
- key: ManagedOnly
supportedOS:
iOS:
introduced: '13.0'
tvOS:
introduced: '13.0'
type: <boolean>
presence: optional
default: false
content: If 'true', only include profiles that MDM has installed. For user enrollments,
the device ignores this key and always limits the results to managed profiles.
This value is available in iOS 13 and later, and tvOS 13 and later.
responsekeys:
- key: ProvisioningProfileList
type: <array>
presence: required
content: An array of dictionaries that describes each installed profile.
subkeys:
- key: ProvisioningProfileListItem
type: <dictionary>
subkeys:
- key: Name
type: <string>
presence: required
content: The display name of the provisioning profile.
- key: UUID
type: <string>
presence: required
content: The unique identifier for the provisioning profile.
- key: ExpiryDate
type: <date>
presence: optional
content: The expiry date of the provisioning profile.
mdm/commands/profile.provisioning.remove.yaml
+38
View File
@@ -0,0 +1,38 @@
title: Remove Provisioning Profile Command
description: This command allows the server to remove a provisioning profile. This
command requires the Provisioning Profile Installation and Removal right. On macOS,
this command is for iOS and iPadOS style provisioning profiles only.
payload:
requesttype: RemoveProvisioningProfile
supportedOS:
iOS:
introduced: '4.0'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '11.0'
accessrights: None
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: '10.2'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
content: This command allows the server to remove a provisioning profile. This command
requires the Provisioning Profile Installation and Removal right. On macOS, this
command is for iOS and iPadOS style provisioning profiles only.
payloadkeys:
- key: UUID
type: <string>
presence: required
content: The unique identifier of the provisioning profile to remove.
mdm/commands/profile.remove.yaml
+36
View File
@@ -0,0 +1,36 @@
title: Remove Profile Command
description: This command allows the server to remove a profile. This command requires
the Profile Installation and Removal Right. It's supported in the user channel.
payload:
requesttype: RemoveProfile
supportedOS:
iOS:
introduced: '4.0'
accessrights: AllowInstallationRemoval
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
macOS:
introduced: '10.7'
accessrights: AllowInstallationRemoval
devicechannel: true
userchannel: true
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: '6.0'
accessrights: AllowInstallationRemoval
supervised: false
content: This command allows the server to remove a profile. This command requires
the Profile Installation and Removal Right. It's supported in the user channel.
payloadkeys:
- key: Identifier
type: <string>
presence: required
content: The identifier of the profile to remove.
mdm/commands/remotedesktop.disable.yaml
+14
View File
@@ -0,0 +1,14 @@
title: Remote Desktop Disable Command
description: Disable Remote Desktop on the device.
payload:
requesttype: DisableRemoteDesktop
supportedOS:
macOS:
introduced: 10.14.4
devicechannel: true
userchannel: false
supervised: true
requiresdep: false
userenrollment:
mode: forbidden
content: Disable Remote Desktop.
mdm/commands/remotedesktop.enable.yaml
+14
View File
@@ -0,0 +1,14 @@
title: Remote Desktop Enable Command
description: Enable Remote Desktop on the device.
payload:
requesttype: EnableRemoteDesktop
supportedOS:
macOS:
introduced: 10.14.4
devicechannel: true
userchannel: false
supervised: true
requiresdep: false
userenrollment:
mode: forbidden
content: Enable Remote Desktop.
mdm/commands/rotate.file.vault.key.yaml
+79
View File
@@ -0,0 +1,79 @@
title: Rotate FileVault Key Command
description: This command allows for changing a device's FileVaultMaster password.
payload:
requesttype: RotateFileVaultKey
supportedOS:
macOS:
introduced: '10.9'
accessrights: DeviceLockAndRemovePasscode
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: forbidden
content: This command allows for changing a device's FileVaultMaster password.
payloadkeys:
- key: KeyType
type: <string>
presence: required
rangelist:
- personal
- institutional
content: The type of FileVault key you want to change the password for. Set this
value to 'personal' and set a value for 'Password' in the 'FileVaultUnlock' dictionary
to enable unlocking a device with a password. Set this value to 'institutional'
and set values for 'PrivateKeyExport' and 'PrivateKeyExportPassword' in the 'FileVaultUnlock'
dictionary.
- key: FileVaultUnlock
type: <dictionary>
presence: required
content: A dictionary that contains FileVault unlock options.
subkeys:
- key: Password
title: Password
type: <string>
presence: optional
content: A FileVault user's password, or if using a CoreStorage volume, the personal
recovery key.
- key: PrivateKeyExport
title: PrivateKeyExport
supportedOS:
macOS:
deprecated: '10.15'
type: <data>
presence: optional
content: The data for a .p12 export of the private key for the current institutional
recovery key, which requires that 'KeyType' is 'institutional'. The system ignores
this key on APFS volumes.
- key: PrivateKeyExportPassword
title: PrivateKeyExportPassword
supportedOS:
macOS:
deprecated: '10.15'
type: <string>
presence: optional
content: The password for 'PrivateKeyExport'. Either 'Password' or both 'PrivateKeyExport'
and 'PrivateKeyExportPassword' must be present. The system ignores this key
on APFS volumes.
- key: NewCertificate
type: <data>
presence: optional
content: A DER-encoded certificate for creating a new institutional recovery key,
which the system requires if 'KeyType' is 'institutional'.
- key: ReplyEncryptionCertificate
type: <data>
presence: optional
content: A DER-encoded certificate for encrypting the new personal recovery key
in a wrapper conforming to the IETF Cryptographic Message Syntax (CMS) standard.
responsekeys:
- key: RotateResult
type: <dictionary>
presence: optional
content: The result of rotating the personal recovery key.
subkeytype: RotateResultItem
subkeys:
- key: EncryptedNewRecoveryKey
type: <data>
presence: optional
content: A new personal recovery key that is encrypted using a 'ReplyEncryptionCertificate'
as a CMS-compliant envelope.
mdm/commands/set.auto.admin.password.yaml
+33
View File
@@ -0,0 +1,33 @@
title: Set Auto Admin Password Command
description: Allows changing the password of a local admin account that was created
by Setup Assistant during DEP enrollment via the AccountConfiguration command.
payload:
requesttype: SetAutoAdminPassword
supportedOS:
macOS:
introduced: '10.11'
accessrights: None
devicechannel: true
userchannel: false
requiresdep: true
userenrollment:
mode: forbidden
content: Allows changing the password of a local admin account that was created
by Setup Assistant during DEP enrollment via the AccountConfiguration command.
payloadkeys:
- key: GUID
type: <string>
presence: required
content: The unique identifier of the local administrator account. If this value
doesn't match the GUID of an administrator account that MDM created during Device
Enrollment Program (DEP) enrollment, the command returns an error.
- key: passwordHash
type: <data>
presence: required
content: |-
The precreated salted SHA-512 PBKDF2 password hash for the account.
Create this hash on the server using the CommonCrypto libraries, or equivalent, as a salted SHA-512 PBKDF2 dictionary that contains these elements:
* 'entropy': The derived key from the password hash; for example, from 'CCKeyDerivationPBKDF()'
* 'salt': The 32-byte randomized salt; for example, from 'CCRandomCopyBytes()'
* 'iterations:' The number of iterations; for example, from 'CCCalibratePBKDF()' using a minimum hash time of 100 milliseconds, or if unknown, a number in the range of 20,000 to 40,000 iterations
Place the dictionary that contains these elements into an outer dictionary with the key 'SALTED-SHA512-PBKDF2'. Convert this dictionary to binary data before setting it as the value for 'passwordHash'.
mdm/commands/settings.yaml
+775
View File
@@ -0,0 +1,775 @@
title: Settings Command
description: This command allows the server to set settings on the device.
payload:
requesttype: Settings
supportedOS:
iOS:
introduced: '5.0'
accessrights: AllowSettings
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '10.9'
accessrights: AllowSettings
devicechannel: true
userchannel: true
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: '6.0'
accessrights: AllowSettings
supervised: false
content: This command allows the server to set settings on the device. These settings
take effect on a one-time basis. The user may still be able to change the settings
at a later time. This command requires the ApplySettings right.
payloadkeys:
- key: Settings
type: <array>
presence: required
content: An array of dictionaries that contains the settings.
subkeys:
- key: Wallpaper
supportedOS:
iOS:
introduced: '8.0'
supervised: true
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains wallpaper settings. This setting doesn't support
User Enrollment, and is available in iOS 8 and later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- Wallpaper
content: A string that identifies this setting.
- key: Image
type: <data>
presence: required
content: A Base64-encoded image in either PNG or JPG format to use for wallpaper.
- key: Where
type: <integer>
presence: required
rangelist:
- 1
- 2
- 3
content: |-
A number that indicates where to use the wallpaper, which is one of the following values:
* '1': Lock screen
* '2': Home screen
* '3': Lock and Home screens
- key: DataRoaming
supportedOS:
iOS:
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains data roaming settings. This setting requires
the Network Information access right, doesn't support User Enrollment, and is
available in iOS 5 and later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- DataRoaming
content: A string that identifies this setting.
- key: Enabled
type: <boolean>
presence: required
content: If 'true', enable data roaming, which also enables voice roaming. If
'false', disable data roaming.
- key: VoiceRoaming
supportedOS:
iOS:
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains voice roaming settings. This setting requires
the Network Information access right, doesn't support User Enrollment, and is
available in iOS 5 and later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- VoiceRoaming
content: A string that identifies this setting.
- key: Enabled
type: <boolean>
presence: required
content: If 'true', enable voice roaming. If 'false', disable voice roaming,
which also disables data roaming. The setting is only available for certain
carriers.
- key: PersonalHotspot
supportedOS:
iOS:
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains Personal Hotspot settings. This setting requires
the Network Information access right, doesn't support User Enrollment, and is
available in iOS 5 and later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- PersonalHotspot
content: A string that identifies this setting.
- key: Enabled
type: <boolean>
presence: required
content: If 'true', enable Personal Hotspot. If 'false', disable Personal Hotspot.
- key: Bluetooth
supportedOS:
iOS:
introduced: '11.3'
supervised: true
userenrollment:
mode: forbidden
macOS:
introduced: 10.13.4
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains Bluetooth settings. This setting requires
the Network Information access right, doesn't support User Enrollment, is only
available on supervised devices, and is available in iOS 11.3 and later, and
macOS 10.13.4 and later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- Bluetooth
content: A string that identifies this setting.
- key: Enabled
type: <boolean>
presence: required
content: If 'true', enable the Bluetooth setting. If 'false', disable the Bluetooth
setting.
- key: ApplicationConfiguration
supportedOS:
iOS:
introduced: '7.0'
accessrights: AllowAppInstallation
macOS:
introduced: '10.15'
accessrights: AllowAppInstallation
userchannel: false
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
type: <dictionary>
presence: optional
content: A dictionary that contains the configurations to apply to the app. Omit
this setting to remove existing configurations. This setting requires the App
Management access right, supports User Enrollment, and is available in iOS 7
and later, macOS 10.15 and later, and tvOS 10.2 and later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- ApplicationConfiguration
content: A string that identifies this setting.
- key: Identifier
type: <string>
presence: required
content: The bundle identifier of the managed app.
- key: Configuration
type: <dictionary>
presence: optional
content: A dictionary that contains the configurations to apply to the app.
Omit this setting to remove existing configurations.
subkeys:
- key: ANY
type: <any>
presence: optional
content: A dictionary that contains configurations.
- key: ApplicationAttributes
supportedOS:
iOS:
introduced: '7.0'
accessrights: AllowAppInstallation
macOS:
introduced: n/a
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
type: <dictionary>
presence: optional
content: A dictionary that contains the attributes to apply to the app. Omit this
setting to remove existing attributes. This setting supports User Enrollment,
is available in iOS 7 and later, and tvOS 10.2 and later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- ApplicationAttributes
content: A string that identifies this setting.
- key: Identifier
type: <string>
presence: required
content: The bundle identifier of the app.
- key: Attributes
type: <dictionary>
presence: optional
content: A dictionary that contains the attributes to apply to the app. Omit
this setting to remove existing attributes. This setting is available in iOS
7 and later, and tvOS 10.2 and later.
subkeys:
- key: VPNUUID
type: <string>
presence: optional
content: A per-app VPN unique identifier for this app. This value is available
in iOS 7 and later, and tvOS 10.2 and later.
- key: AssociatedDomains
supportedOS:
iOS:
introduced: '13.0'
tvOS:
introduced: n/a
type: <array>
presence: optional
content: An array that contains the associated domains to add to this app.
This setting is available in iOS 7 and later, and tvOS 10.2 and later.
subkeys:
- key: AssociatedDomain
type: <string>
- key: AssociatedDomainsEnableDirectDownloads
supportedOS:
iOS:
introduced: '14.0'
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: true
content: If 'true', perform claimed site association verification directly
at the domain, instead of on Apple's servers. Only set this to 'true' for
domains that can't access the internet. This value is available in iOS 14
and later.
- key: Removable
supportedOS:
iOS:
introduced: '14.0'
tvOS:
introduced: '14.0'
type: <boolean>
presence: optional
default: true
content: If 'false', this app isn't removable while it's managed. This value
is available in iOS 14 and later, and tvOS 14 and later.
- key: DeviceName
supportedOS:
iOS:
supervised: true
userenrollment:
mode: forbidden
macOS:
introduced: '10.10'
userenrollment:
mode: forbidden
type: <dictionary>
presence: optional
content: A dictionary that contains device name settings. This setting doesn't
support User Enrollment, and is only available on supervised devices. Available
on iOS 5 and later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- DeviceName
content: A string that identifies this setting.
- key: DeviceName
type: <string>
presence: required
content: The device's name.
- key: HostName
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains hostname settings. This setting doesn't support
User Enrollment, and is available in macOS 10.11 and later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- HostName
content: The string that defines this setting type.
- key: HostName
type: <string>
presence: required
content: The hostname for the device.
- key: OrganizationInfo
supportedOS:
macOS:
introduced: '10.9'
type: <dictionary>
presence: optional
content: A dictionary that contains settings about the organization operating
the MDM server. This setting supports User Enrollment. Available in iOS 5 and
later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- OrganizationInfo
content: The string that defines this setting type.
- key: OrganizationInfo
type: <dictionary>
presence: optional
content: A dictionary that contains information about the organization operating
the MDM server. Omit this setting to remove existing information.
subkeys:
- key: OrganizationName
type: <string>
presence: required
content: A string that describes the organization operating the MDM server
for display to the user during certain operations, such as purchasing or
installing apps.
- key: OrganizationShortName
supportedOS:
iOS:
introduced: '13.0'
macOS:
introduced: '10.15'
tvOS:
introduced: '13.0'
type: <string>
presence: optional
content: A shorter version of 'OrganizationName', preferably a single word
or abbreviation, suitable for display to the user in places where a very
short name is necessary.
- key: OrganizationAddress
type: <string>
presence: optional
content: The organization's address. Use the LF character ('&#10') to insert
line breaks.
- key: OrganizationPhone
type: <string>
presence: optional
content: The organization's phone number.
- key: OrganizationEmail
type: <string>
presence: optional
content: The orgnization's support email address.
- key: OrganizationMagic
type: <string>
presence: optional
content: A unique identifier for the various services a single organization
manages.
- key: MDMOptions
supportedOS:
iOS:
introduced: '7.0'
macOS:
introduced: '10.15'
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains settings related to the MDM protocol. This
setting doesn't support User Enrollment, and is available in iOS 7 and later,
and macOS 10.15 and later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- MDMOptions
content: The string that defines this setting type.
- key: MDMOptions
type: <dictionary>
presence: required
content: A dictionary of MDM options.
subkeys:
- key: ActivationLockAllowedWhileSupervised
type: <boolean>
presence: optional
default: false
content: If 'true', a supervised device registers itself with Activation Lock
when the user enables Find My. This setting is available for supervised
devices in iOS 7 and later, and macOS 10.15 and later.
- key: BootstrapTokenAllowed
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.15'
deprecated: '11.0'
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', the server supports the Bootstrap Token commands.
- key: PromptUserToAllowBootstrapTokenForAuthentication
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', warn the user that they need to reboot into RecoveryOS
and allow the MDM server to use the Bootstrap Token for authentication for
certain sensitive operations; for example, enabling kernel extensions or
installing certain types of software updates. Set this value to 'false'
if your MDM server doesn't need to perform these operations. The value provided
here overrides the value specified in MDM, and only applies when 'BootstrapTokenAllowedForAuthentication'
is 'true' in the SecurityInfoResponse.SecurityInfo response. This value
is available for Apple silicon in macOS 11 and later.
- key: MaximumResidentUsers
supportedOS:
iOS:
introduced: '9.3'
deprecated: '13.4'
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains settings for maximum resident users. Apple
deprecated this setting in iOS 13.4. Use 'SharedDeviceConfiguration' instead.
This setting doesn't support User Enrollment, and is only available for Shared
iPad.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- MaximumResidentUsers
content: A string that identifies this setting.
- key: MaximumResidentUsers
type: <integer>
presence: required
content: |-
The maximum number of users that can use the device. If this value is greater than the value for the maximum possible number of users that the device suports, the MDM server uses that value instead.
This setting requires that the device is in the 'AwaitingConfiguration' phase before it receives the DeviceConfigured <https://developer.apple.com/library/archive/documentation/Miscellaneous/Reference/MobileDeviceManagementProtocolRef/3-MDM_Protocol/MDM_Protocol.html#//apple_ref/doc/uid/TP40017387-CH3-SW301> message.
When a device reaches the maximum number of resident users and a new user tries to sign in, the MDM server removes a synchronized user to make space for the new user. If there are no synchronized users, the new user sign-in fails. A synchronized user is a user that has completed syncing their data.
- key: SharedDeviceConfiguration
supportedOS:
iOS:
introduced: '13.4'
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains shared device configuration settings. This
setting doesn't support User Enrollment, and is available in iOS 13.4 and later
for Shared iPad.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- SharedDeviceConfiguration
content: A string that identifies this setting.
- key: QuotaSize
type: <integer>
presence: optional
content: The quota size, in megabytes (MB), for each user on the shared device,
or if the quota size is too small, the minimum quota size.
- key: ResidentUsers
type: <integer>
presence: optional
content: The expected number of users. If this value is greater than the value
for the maximum possible number of users that the device supports, the MDM
server uses that value instead.
- key: UserSessionTimeout
supportedOS:
iOS:
introduced: '14.5'
type: <integer>
presence: optional
content: |-
The timeout, in seconds, for the user session. The user session logs out automatically after the specified period of inactivity. The minimum value is 30 seconds. Setting this value to '0' removes the timeout.
Available in iOS 14.5 and later.
- key: TemporarySessionTimeout
supportedOS:
iOS:
introduced: '14.5'
type: <integer>
presence: optional
content: |-
The timeout, in seconds, for the temporary session. The temporary session logs out automatically after the specified period of inactivity. The minimum value is 30 seconds. Setting this value to '0' removes the timeout.
Available in iOS 14.5 and later.
- key: TemporarySessionOnly
supportedOS:
iOS:
introduced: '14.5'
type: <boolean>
presence: optional
default: false
content: |-
If 'true', the user only sees the Guest Welcome pane and can only log in as a guest user.
If 'false', the user can sign in with a managed Apple ID (the existing behavior).
Available in iOS 14.5 and later.
- key: DiagnosticSubmission
supportedOS:
iOS:
introduced: '9.3'
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains diagnostic submission settings. This setting
doesn't support User Enrollment, and is only available for Shared iPad. Available
in iOS 9.3 and later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- DiagnosticSubmission
content: The string that defines this setting type.
- key: Enabled
type: <boolean>
presence: required
content: If 'true', enables diagnostic submission. If 'false', disables diagnostic
submission.
- key: AppAnalytics
supportedOS:
iOS:
introduced: 9.3.2
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains settings for sharing app analytics. This setting
doesn't support User Enrollment, and is only available for Shared iPad. Available
in iOS 9.3.2 and later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- AppAnalytics
content: A string that identifies this setting.
- key: Enabled
type: <boolean>
presence: required
content: If 'true', enable sharing app analytics with app developers. If 'false',
disable sharing app analytics.
- key: PasscodeLockGracePeriod
supportedOS:
iOS:
introduced: 9.3.2
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains password lock grace period settings. This
setting doesn't support User Enrollment, and is only available for Shared iPad.
Available in iOS 9.3.2 and later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- PasscodeLockGracePeriod
content: A string that identifies this setting.
- key: PasscodeLockGracePeriod
type: <integer>
presence: required
content: |-
The number of seconds before a locked screen requires the user to enter the device passcode to unlock it. The minimum value is '0' seconds and the maximum value is '14400' seconds.
If a device has a passcode, a change to a larger value doesn't take effect until the user logs out or removes the passcode. For this reason, it's better to set this value before the user sets a passcode.
- key: TimeZone
supportedOS:
iOS:
introduced: '14.0'
supervised: true
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: '14.0'
supervised: true
type: <dictionary>
presence: optional
content: A dictionary that contains time zone settings. This setting is only available
on supervised devices and doesn't support User Enrollment. Available in iOS
14 and later, and tvOS 14 and later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- TimeZone
content: A string that identifies this setting.
- key: TimeZone
type: <string>
presence: required
content: |-
The Internet Assigned Numbers Authority (IANA) time zone database name.
If the 'forceAutomaticDateAndTime' restriction is set in Restrictions, this setting fails with an error. Otherwise, setting this value disables automatic time zone logic. The user is still be able to change the timezone; for example, by turning automatic date and time back on. The intention is to allow setting the timezone when automatic determination isn't be available, such as when Location Services are off.
- key: SoftwareUpdateSettings
supportedOS:
iOS:
introduced: '14.5'
supervised: true
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains software update settings. This setting doesn't
support User Enrollment, and is available in iOS 14.5 and later.
subkeys:
- key: Item
type: <string>
presence: required
rangelist:
- SoftwareUpdateSettings
content: A string that represents the type of updates that should appear in
the Software Update pane in Settings. Supervised only.
- key: RecommendationCadence
type: <integer>
presence: required
rangelist:
- 0
- 1
- 2
content: |-
This value defines how the system presents software updates to the user. When there's more than one available update for the user, the system behaves as follows:
* '0': Presents both options to the user.
* '1': Presents the lower numbered (oldest) software update version.
* '2': Presents only the highest numbered (most recent) release available for the device.
This value has no effect when there's only one available update; the system shows the single available update to the user regardless of the value of this setting.
Available in iOS 14.5 and later.
responsekeys:
- key: Settings
type: <dictionary>
presence: optional
content: A dictionary that describes the results of configuring settings.
subkeys:
- key: Status
type: <string>
presence: required
content: |-
The status of the setting, which is one of the following values:
* 'Acknowledged': The device processed the command successfully.
* 'Error': An error occurred. See the 'ErrorChain' for more details.
- key: ErrorChain
type: <array>
presence: optional
content: An array of dictionaries that describes any errors that occurred.
subkeys:
- key: ErrorChainItem
type: <dictionary>
subkeys:
- key: ANY
type: <any>
presence: required
content: A dictionary that contains additional details about the error.
- key: Identifier
supportedOS:
iOS:
introduced: '7.0'
macOS:
introduced: n/a
tvOS:
introduced: '10.2'
type: <string>
presence: optional
content: The app identifier to which this error applies.
mdm/commands/system.update.available.yaml
+198
View File
@@ -0,0 +1,198 @@
title: Available OS Updates Command
description: Queries the device for a list of available OS updates. On OS X, a ScheduleOSUpdateScan
must be performed to update the results returned by this query.
payload:
requesttype: AvailableOSUpdates
supportedOS:
iOS:
introduced: '9.0'
accessrights: AllowAppInstallation
supervised: true
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: '10.11'
accessrights: None
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: '12.0'
accessrights: AllowAppInstallation
devicechannel: true
supervised: true
requiresdep: false
content: Queries the device for a list of available OS updates. On OS X, a ScheduleOSUpdateScan
must be performed to update the results returned by this query.
responsekeys:
- key: AvailableOSUpdates
type: <array>
presence: required
content: An array of dictionaries that contains only the most recent available updates
in iOS and tvOS, and possibly multiple available updates in macOS. Follow the
instructions in the Managed Apps and Updates section of the Apple Software Lookup
Service to find a complete catalog of iOS and tvOS updates.
subkeys:
- key: AvailableOSUpdatesItem
type: <dictionary>
presence: required
subkeys:
- key: ProductKey
type: <string>
presence: required
content: The product key that represents the update.
- key: HumanReadableName
type: <string>
presence: required
content: The human-readable name of the update in the current user's current
locale.
- key: HumanReadableNameLocale
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
type: <string>
presence: required
content: The locale, in IOS639-1 Alpha-2 code format, of the 'HumanReadableName'
value. This value is available in macOS 10.11 and later.
- key: MetadataURL
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
type: <string>
presence: required
content: A URL where the MDM server can request additional localized names for
this update. This value is available in macOS 10.11 and later.
- key: ProductName
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: required
content: The product name; for example, iOS. This value is available in iOS
9.0 and later, and tvOS 12.0 and later.
- key: Version
type: <string>
presence: required
content: The version of the update.
- key: Build
type: <string>
presence: required
content: The build number of the update.
- key: DownloadSize
supportedOS:
macOS:
introduced: '10.12'
type: <integer>
presence: required
content: The storage size necessary to download the software update. Prior to
macOS 10.14, this only includes major operating-system updates. In macOS 10.14
and later, this also includes minor updates.
- key: InstallSize
supportedOS:
macOS:
introduced: n/a
type: <integer>
presence: required
content: The storage size necessary to install the update. This value is available
in iOS 9.0 and later, and tvOS 12.0 and later.
- key: AppIdentifiersToClose
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
type: <array>
presence: required
content: An array that contains app identifiers of apps to close so you can
install the update. This value is available in macOS 10.11 and later.
subkeys:
- key: AppIdentifiersToCloseItem
type: <string>
- key: IsCritical
type: <boolean>
presence: optional
default: false
content: If 'true', this is a critical update.
- key: IsConfigDataUpdate
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', this is an update to a configuration file. This value is
available in macOS 10.11 and later.
- key: IsFirmwareUpdate
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', this is an update to firmware. This value is available in
macOS 10.11 and later.
- key: IsMajorOSUpdate
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.11.4
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', this is a major update; for example, 10.15.x to 11. This
value is available in macOS 10.11 and later.
- key: RestartRequired
type: <boolean>
presence: optional
default: false
content: If 'true', the device restarts after installing the update.
- key: AllowsInstallLater
type: <boolean>
presence: optional
default: false
content: If 'true', download the software update and install it later.
- key: DeferredUntil
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.12.4
tvOS:
introduced: n/a
type: <date>
presence: optional
content: If present, the date when you want the update to install. This value
is available in macOS 10.12.4 and later.
- key: RequiresBootstrapToken
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', the device can accept a Bootstrap Token from the MDM server
instead of prompting for user authentication prior to installation. This only
applies when 'BootstrapTokenAllowedForAuthentication' is 'true' in the SecurityInfoResponse.SecurityInfo
response. This value is available for Apple silicon in macOS 11 and later.
mdm/commands/system.update.scan.yaml
+27
View File
@@ -0,0 +1,27 @@
title: Schedule OS Update Scan Command
description: Requests that the device perform a background scan for OS updates.
payload:
requesttype: ScheduleOSUpdateScan
supportedOS:
macOS:
introduced: '10.11'
accessrights: None
devicechannel: true
userchannel: false
supervised: true
requiresdep: false
userenrollment:
mode: forbidden
content: Requests that the device perform a background scan for OS updates.
payloadkeys:
- key: Force
type: <boolean>
presence: optional
default: false
content: If 'true', force a scan to start immediately. Otherwise, the scan starts
at a system-determined time.
responsekeys:
- key: ScanInitiated
type: <boolean>
presence: required
content: If 'true', the scan started successfully.
mdm/commands/system.update.schedule.yaml
+168
View File
@@ -0,0 +1,168 @@
title: Schedule OS Update Command
description: This command allows the server to schedule an OS update.
payload:
requesttype: ScheduleOSUpdate
supportedOS:
iOS:
introduced: '9.0'
accessrights: AllowAppInstallation
supervised: true
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: '10.11'
accessrights: None
devicechannel: true
userchannel: false
supervised: true
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: '12.0'
accessrights: AllowAppInstallation
devicechannel: true
supervised: true
requiresdep: false
content: This command allows the server to schedule an OS update.
payloadkeys:
- key: Updates
type: <array>
presence: required
content: An array of dictionaries specifying the updates to download or install.
If this value is missing, the device applies the default behavior for handling
updates.
subkeys:
- key: UpdatesItem
type: <dictionary>
presence: required
subkeys:
- key: ProductKey
type: <string>
presence: optional
content: The product key that represents the update.
- key: ProductVersion
supportedOS:
iOS:
introduced: '11.3'
macOS:
introduced: '12.0'
tvOS:
introduced: '12.2'
type: <string>
presence: optional
content: The version of the update, which the system requires if 'ProductKey'
isn't present. This value is available in iOS 11.3 and later, macOS 12 and
later, and tvOS 12.2 and later.
- key: InstallAction
type: <string>
presence: required
rangelist:
- Default
- DownloadOnly
- InstallASAP
- NotifyOnly
- InstallLater
- InstallForceRestart
content: |-
The install action, which is one of the following values:
* 'Default': Download or install the update, depending on the current state. You can check the 'UpdateResults' dictionary to review scheduled updates. This value is available in iOS 9 and later, macOS 10.11 and later, and tvOS 12 and later.
* 'DownloadOnly': Download the software update without installing it. This value is available in iOS 9 and later, macOS 11 and later, and tvOS 12 and later.
* 'InstallASAP': In iOS and tvOS, install a previously downloaded software update. In macOS, download the software update and trigger the restart countdown notification. This value is available in iOS 9 and later, macOS 10.11 and later, and tvOS 12 and later.
* 'NotifyOnly': Download the software update and notify the user through the App Store. This value is available in macOS 10.11 and later.
* 'InstallLater': Download the software update and install it at a later time. This value is available in macOS 10.11 and later.
* 'InstallForceRestart': Perform the 'Default' action, and then force a restart if the update requires it. This value is available in macOS 11 and later.
'InstallForceRestart' may result in data loss.
- key: MaxUserDeferrals
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '12.0'
tvOS:
introduced: n/a
type: <integer>
presence: optional
content: |-
The maximum number of times the system allows the user to postpone an update before it's installed. The system prompts the user once a day.
This key is only supported when 'InstallAction' is 'InstallLater' and only supported for minor OS updates (for example, macOS 12.x to 12.y).
responsekeys:
- key: UpdateResults
type: <array>
presence: required
content: An array of dictionaries that describes the results of processing operating-system
updates.
subkeys:
- key: UpdateResultsItem
type: <dictionary>
presence: required
subkeys:
- key: ProductKey
type: <string>
presence: required
content: The product key that represents the update.
- key: InstallAction
type: <string>
presence: required
rangelist:
- Error
- DownloadOnly
- InstallASAP
- NotifyOnly
- InstallLater
- InstallForceRestart
content: |-
The install action that the device scheduled, which is one of the following values:
* 'Error': An error occurred during scheduling.
* 'DownloadOnly': Download the software update without installing it.
* 'InstallASAP': Install a previously downloaded software update.
* 'NotifyOnly': Download the software update and notify the user through the App Store. This value is available in macOS 10.11 and later.
* 'InstallLater': Download the software update and install it at a later time. This value is available in macOS 10.11 and later.
* 'InstallForceRestart': Perform the 'Default' action, and then force a restart if the update requires it. This value is available in macOS 11 and later.
- key: Status
type: <string>
presence: required
rangelist:
- Idle
- Downloading
- DownloadFailed
- DownloadRequiresComputer
- DownloadInsufficientSpace
- DownloadInsufficientPower
- DownloadInsufficientNetwork
- Installing
- InstallInsufficientSpace
- InstallInsufficientPower
- InstallPhoneCallInProgress
- InstallFailed
content: |-
The status of the update, which is one of the following values:
* 'Idle': The update is idle.
* 'Downloading': The software update is downloading.
* 'DownloadFailed': The download failed.
* 'DownloadRequiresComputer': Tether the device to download this update. This value is only available in iOS.
* 'DownloadInsufficientSpace': There isn't enough space to download the update.
* 'DownloadInsufficientPower': There isn't enough power to download the update.
* 'DownloadInsufficientNetwork': The network capacity is insufficient to download the update.
* 'Installing': The software update is installing.
* 'InstallInsufficientSpace': There isn't enough space to install the update.
* 'InstallInsufficientPower': There isn't enough power to install the update.
* 'InstallPhoneCallInProgress': Installation couldn't occur because a phone call is in progress.
* 'InstallFailed': Installation failed due to an unspecified reason.
- key: ErrorChain
type: <array>
presence: optional
content: A dictionary that describes an error chain.
subkeys:
- key: ErrorChainItem
type: <dictionary>
subkeys:
- key: ANY
type: <any>
presence: required
content: The error details.
mdm/commands/system.update.status.yaml
+63
View File
@@ -0,0 +1,63 @@
title: OS Update Status Command
description: Queries the device for the status of software updates.
payload:
requesttype: OSUpdateStatus
supportedOS:
iOS:
introduced: '9.0'
accessrights: AllowAppInstallation
supervised: true
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: 10.11.5
accessrights: None
devicechannel: true
userchannel: false
supervised: true
requiresdep: false
userenrollment:
mode: forbidden
tvOS:
introduced: '12.0'
accessrights: AllowAppInstallation
devicechannel: true
supervised: true
requiresdep: false
content: Queries the device for the status of software updates.
responsekeys:
- key: OSUpdateStatus
type: <array>
presence: required
content: An array of dictionaries that describes the statuses of software updates.
subkeys:
- key: OSUpdateStatusItem
type: <dictionary>
presence: required
subkeys:
- key: ProductKey
type: <string>
presence: required
content: The product key that represents the update.
- key: IsDownloaded
type: <boolean>
presence: required
content: If 'true', the update has finished downloading.
- key: DownloadPercentComplete
type: <real>
presence: required
content: A floating-point number between '0.0' and '1.0' that indicates the
download progress as a percentage.
- key: Status
type: <string>
presence: required
content: |-
The status of the update, which is one of the following values:
* 'Idle': The update is idle.
* 'Downloading': The software update is downloading.
* 'Installing': The software update is installing.
mdm/commands/user.delete.yaml
+55
View File
@@ -0,0 +1,55 @@
title: Delete User Command
description: This command allows the server to delete a user that has an active account
on the device.
payload:
requesttype: DeleteUser
supportedOS:
iOS:
introduced: '9.3'
accessrights: None
supervised: false
requiresdep: false
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: '10.13'
accessrights: None
devicechannel: true
userchannel: false
supervised: true
requiresdep: false
userenrollment:
mode: forbidden
content: This command allows the server to delete a user that has an active account
on the device.
payloadkeys:
- key: UserName
type: <string>
presence: required
content: The user name of the account to delete.
- key: ForceDeletion
supportedOS:
macOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', the system deletes the account even if the user has data that's
pending sync to the cloud. This value is available on iOS 9.3 and later.
- key: DeleteAllUsers
supportedOS:
iOS:
introduced: '14.0'
macOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', the system attempts to delete all users from the device. If
'ForceDeletion' is 'false', the system generates an error instead and doesn't
delete users who have data that's pending sync. This value is available in iOS
14 and later.
mdm/commands/user.list.yaml
+115
View File
@@ -0,0 +1,115 @@
title: User List Command
description: This command allows the server to query for a list of users that have
an active account on the device.
payload:
requesttype: UserList
supportedOS:
iOS:
introduced: '9.3'
accessrights: None
supervised: false
requiresdep: false
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: '10.13'
accessrights: None
devicechannel: true
userchannel: false
supervised: true
requiresdep: false
userenrollment:
mode: forbidden
content: This command allows the server to query for a list of users that have an
active account on the device.
responsekeys:
- key: Users
type: <array>
presence: required
content: An array of user dictionaries that contains information about the active
accounts.
subkeys:
- key: UsersItem
type: <dictionary>
presence: required
subkeys:
- key: UserName
type: <string>
presence: required
content: The user name for the account. In macOS, this is the short name of
the user account. This value is available in iOS 9.3 and later, and macOS
10.13 and later.
- key: FullName
supportedOS:
iOS:
introduced: n/a
type: <string>
presence: required
content: The user's full name. This value is available in macOS 10.13 and later.
- key: UID
supportedOS:
iOS:
introduced: n/a
type: <integer>
presence: required
content: The user's unique identifier. This value is available in macOS 10.13
and later.
- key: UserGUID
supportedOS:
iOS:
introduced: n/a
type: <string>
presence: required
content: The user's 'GeneratedUID'. This value is available in macOS 10.13 and
later.
- key: IsLoggedIn
type: <boolean>
presence: required
content: If 'true', the user is currently logged in on the device. This value
is available in iOS 9.3 and later, and macOS 10.13 and later.
- key: HasDataToSync
supportedOS:
macOS:
introduced: n/a
type: <boolean>
presence: required
content: If 'true', the user has data to sync to the cloud. This value is available
in iOS 9.3 and later.
- key: DataQuota
supportedOS:
macOS:
introduced: n/a
type: <integer>
presence: required
content: If present, the user's data quota in bytes. This isn't present if the
account doesn't enforce a quota. This value is available in iOS 9.3 and later.
- key: DataUsed
supportedOS:
macOS:
introduced: n/a
type: <integer>
presence: required
content: The amount of data, in bytes, that the user has used. This value is
available in iOS 9.3 and later.
- key: MobileAccount
supportedOS:
iOS:
introduced: n/a
type: <boolean>
presence: required
content: If 'true', the account is a mobile account. This value is available
in macOS 10.13 and later.
- key: HasSecureToken
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
type: <boolean>
presence: required
content: If 'true', the user currently has a secure token set. This value is
available in macOS 11 and later.
mdm/commands/user.logout.yaml
+17
View File
@@ -0,0 +1,17 @@
title: Log Out User Command
description: This command allows the server to force the current user to logout.
payload:
requesttype: LogOutUser
supportedOS:
iOS:
introduced: '9.3'
accessrights: None
supervised: false
requiresdep: false
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
content: This command allows the server to force the current user to logout.
mdm/commands/user.unlock.yaml
+22
View File
@@ -0,0 +1,22 @@
title: Unlock User Account Command
description: This command allows the server to unlock a local user account.
payload:
requesttype: UnlockUserAccount
supportedOS:
macOS:
introduced: '10.13'
accessrights: DeviceLockAndRemovePasscode
devicechannel: true
userchannel: false
requiresdep: false
userenrollment:
mode: forbidden
content: This command allows the server to unlock a local user account that has
been locked due to too many failed password attempts. Requires "Device lock and
passcode removal right".
payloadkeys:
- key: UserName
type: <string>
presence: required
content: The user name of the local account, which can be any local account on the
system, not just a managed user account.
mdm/profiles/CommonPayloadKeys.yaml
+70
View File
@@ -0,0 +1,70 @@
title: Common Payload Keys
description: Payload dictionary keys common to all payload types
payload:
payloadtype: CommonPayloadKeys
supportedOS:
iOS:
introduced: '4.0'
supervised: false
allowmanualinstall: true
sharedipad:
mode: allowed
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
macOS:
introduced: '10.7'
devicechannel: true
userchannel: true
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: '5.0'
supervised: false
allowmanualinstall: true
watchOS:
introduced: '1.0'
allowmanualinstall: true
payloadkeys:
- key: PayloadIdentifier
type: <string>
presence: required
content: |-
The reverse-DNS-style identifier for the payload. This identifier is usually the same as the TopLevel value, with an additional appended component. This string must be unique within the profile.
During a profile replacement, the system updates payloads with the same 'PayloadIdentifier' and 'PayloadUUID' in the old and new profiles.
- key: PayloadUUID
type: <string>
presence: required
content: |-
The globally unique identifier for the payload. The actual content is unimportant, but must be globally unique. In macOS, use 'uuidgen' to generate UUIDs.
During a profile replacement, the system updates payloads with the same 'PayloadIdentifier' and 'PayloadUUID' in the old and new profiles.
- key: PayloadType
type: <string>
presence: required
content: The payload type, which each payload domain's reference page specifies.
- key: PayloadVersion
type: <integer>
presence: required
rangelist:
- 1
content: The version of this specific payload.
- key: PayloadDescription
type: <string>
presence: optional
content: The human-readable description of this payload. This description appears
on the Detail screen.
- key: PayloadDisplayName
type: <string>
presence: optional
content: The human-readable name for the profile payload. The name appears on the
Detail screen and doesn't need to be unique.
- key: PayloadOrganization
type: <string>
presence: optional
content: The human-readable string containing the name of the organization that
provides the profile. This value doesn't need to match the organization payload
value in the enclosing dictionary.
mdm/profiles/GlobalPreferences.yaml
+27
View File
@@ -0,0 +1,27 @@
title: Global Preferences
description: ''
payload:
payloadtype: .GlobalPreferences
supportedOS:
macOS:
introduced: '10.7'
devicechannel: true
userchannel: true
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
content: Global preferences on macOS
payloadkeys:
- key: MultipleSessionEnabled
type: <boolean>
presence: optional
default: true
content: If 'false', disables fast user switching.
- key: com.apple.autologout.AutoLogOutDelay
type: <real>
presence: optional
content: The 'autologout' delay, in seconds. A value of '0' means 'autologout' is
off. In some cases, this delay may be restricted to values between 5 minutes and
24 hours.
mdm/profiles/TopLevel.yaml
+205
View File
@@ -0,0 +1,205 @@
title: Top Level
description: ''
payload:
payloadtype: TopLevel
supportedOS:
iOS:
introduced: '4.0'
supervised: false
allowmanualinstall: true
sharedipad:
mode: allowed
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
macOS:
introduced: '10.7'
devicechannel: true
userchannel: true
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: '5.0'
supervised: false
allowmanualinstall: true
watchOS:
introduced: '1.0'
allowmanualinstall: true
payloadkeys:
- key: PayloadIdentifier
type: <string>
presence: required
content: The reverse-DNS style identifier ('com.example.myprofile', for example)
that identifies the profile. This string is used to determine whether a new profile
should replace an existing one or should be added.
- key: PayloadUUID
type: <string>
presence: required
content: The globally unique identifier for the profile. The actual content is unimportant.
In macOS, you can use 'uuidgen' to generate reasonable UUIDs.
- key: PayloadType
type: <string>
presence: required
rangelist:
- Configuration
content: The type of payload. The only supported value is 'Configuration'.
- key: PayloadVersion
type: <integer>
presence: required
rangelist:
- 1
content: The version number of the profile format. This number represents the version
of the configuration profile as a whole, not of the individual profiles within
it. The value should be 1.
- key: IsEncrypted
type: <boolean>
presence: optional
default: false
content: Set to 'true' if the profile is encrypted.
- key: PayloadContent
type: <array>
presence: required
content: The array of payload dictionaries. If 'IsEncrypted' is 'true', this array
isn't needed.
subkeys:
- key: PayloadContentItem
type: <dictionary>
subkeys:
- key: ANY
type: <any>
presence: required
content: A payload item as defined by each payload type.
- key: EncryptedPayloadContent
type: <data>
presence: optional
content: Enabled if 'IsEncrypted' is 'true'.
- key: PayloadDescription
type: <string>
presence: optional
content: The description of the profile, shown on the Detail screen for the profile.
This description should be detailed enough to help the user decide whether to
install the profile.
- key: PayloadDisplayName
type: <string>
presence: optional
content: The human-readable name for the profile. This value is displayed on the
Detail screen. It doesn't have to be unique.
- key: HasRemovalPasscode
type: <boolean>
presence: optional
default: false
content: Set to 'true' if there is a removal passcode.
- key: PayloadOrganization
type: <string>
presence: optional
content: The human-readable string containing the name of the organization that
provided the profile.
- key: PayloadRemovalDisallowed
supportedOS:
iOS:
supervised: true
userenrollment:
mode: forbidden
macOS:
supervised: true
userenrollment:
mode: forbidden
tvOS:
supervised: true
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: |-
If present and set to 'true', the user cannot delete the profile (unless the profile has a removal password and the user provides it).
On macOS, as of 10.15, this key only affects removal of manually installed profiles. If set to 'true' and no profile removal payload is present, admin auth will be required to remove the profile.
On macOS versions prior to 10.15, this key would prevent admins from removing MDM installed profiles but as of macOS 10.15, MDM profiles can never be removed by a user, not even the admin.
- key: PayloadScope
supportedOS:
macOS:
introduced: '10.8'
type: <string>
presence: optional
rangelist:
- System
- User
content: A string that defines whether the profile should be installed for the system
or the user. In many cases, it determines the location of certificate items, such
as keychains. Though it isn't possible to declare different payload scopes, payloads,
like VPN, may automatically install their items in both scopes, if needed.
- key: RemovalDate
type: <date>
presence: optional
content: The date when the profile is automatically removed.
- key: DurationUntilRemoval
type: <real>
presence: optional
content: The number of seconds until the profile is automatically removed. If the
'RemovalDate' key is present, whichever field yields the earliest date is used.
- key: PayloadExpirationDate
supportedOS:
watchOS:
introduced: n/a
type: <date>
presence: optional
content: The date when a profile is no longer valid and an update button is presented
to the user.
- key: TargetDeviceType
supportedOS:
iOS:
introduced: '12.2'
macOS:
introduced: '10.15'
tvOS:
introduced: '12.2'
watchOS:
introduced: '5.2'
type: <integer>
presence: optional
rangelist:
- 0
- 1
- 2
- 3
- 4
- 5
default: 0
content: |-
The type of platform of the target device. Specifying the platform type helps prevent unintended installations.
For interactive installations on iOS devices, specifying a target platform avoids the interstitial alerts that prompt the user to choose a profile target when multiple targets are eligible.
0 = Any/unspecified
1 = iPhone/iPad/iPod Touch
2 = Apple Watch
3 = HomePod
4 = Apple TV
5 = Mac
- key: ConsentText
type: <dictionary>
presence: optional
content: |-
A dictionary containing a key that consists of the IETF BCP 47 identifier for a language (for example, en or jp) and a value consisting of the agreement localized to that language. The agreement is displayed in a dialog, and the user must agree before installing the profile.
The dictionary can also contain an optional key, 'default', with its value consisting of the unlocalized (usually in en) agreement.
The system chooses a localized version in the order of preference specified by the user (macOS) or based on the user's current language setting (iOS). If no exact match is found, the default localization is used. If there is no default localization, the en localization is used. If there is no en localization, the first available localization is used.
Provide a default value, if possible. No warning is displayed if the user's locale doesn't match any localization in the 'ConsentText' dictionary.
subkeys:
- key: ConsentTextItem
type: <dictionary>
presence: required
content: The dictionary containing a key that consists of the IETF BCP 47 identifier
for a language (for example, en or jp) and a value that consists of the agreement
localized to that language.
subkeys:
- key: ANY
type: <string>
presence: required
content: The key consisting of the IETF BCP 47 identifier for a language (for
example, en or jp) and the value consisting of the agreement localized to
that language.
mdm/profiles/com.apple.ADCertificate.managed.yaml
+118
View File
@@ -0,0 +1,118 @@
title: Active Directory Certificate
description: Active Directory Certificate
payload:
payloadtype: com.apple.ADCertificate.managed
supportedOS:
macOS:
introduced: '10.7'
devicechannel: true
userchannel: true
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: allowed
content: A certificate can be requested from a Microsoft Certificate Authority (CA)
using DCE/RPC and the Active Directory Certificate profile payload instructions
detailed at support.apple.com/kb/HT5357.
payloadkeys:
- key: CertServer
title: Certificate Server
type: <string>
presence: required
content: The fully qualified host name of the CA.
- key: CertTemplate
title: Certificate Template
type: <string>
presence: required
content: The certificate template for your environment. The default user certificate
value is `User`. The default computer certificate value is `Machine`.
- key: Description
title: Description
type: <string>
presence: optional
content: A user-friendly description of the certification identity.
- key: CertificateRenewalTimeInterval
title: Certificate Renewal Time Interval
type: <integer>
presence: optional
content: The number of days in advance of certificate expiration that the notification
center notifies the user.
- key: CertificateAuthority
title: Certificate Authority
supportedOS:
macOS:
introduced: '10.8'
type: <string>
presence: optional
content: |-
The name of the certificate authority (CA). This value is determined from the common name (CN) of the Active Directory entry. Available in macOS 10.8 and later.
Valid values:
* CN=<your CA Name>
* CN='Certification Authorities'
* CN='Public Key Services'
* ''CN='Services'
* ''CN='Configuration'
* ''CN=<your base Domain Name>
- key: CertificateAcquisitionMechanism
title: Certificate Acquisition Mechanism
supportedOS:
macOS:
introduced: '10.8'
type: <string>
presence: optional
content: This value is most commonly 'RPC'; if using web enrollment, use 'HTTP'.
Available in macOS 10.8 and later.
- key: AllowAllAppsAccess
title: Allow All Apps Access
supportedOS:
macOS:
introduced: '10.10'
type: <boolean>
presence: optional
default: false
content: If 'true', gives apps access to the private key. Available in macOS 10.10
and later.
- key: PromptForCredentials
title: Prompt For Credentials
supportedOS:
macOS:
introduced: '10.8'
type: <boolean>
presence: optional
default: false
content: If 'true', the user is prompted for credentials when the profile is installed.
This key applies only to user certificates with the Manual Download profile delivery
method. Omit this key for computer certificates. Available in macOS 10.8 and later.
- key: KeyIsExtractable
title: Key Is Extractable
supportedOS:
macOS:
introduced: '10.10'
type: <boolean>
presence: optional
default: false
content: If 'true', allows exporting the private key. Available in macOS 10.10 and
later.
- key: Keysize
title: Key Size
supportedOS:
macOS:
introduced: '10.11'
type: <integer>
presence: optional
default: 2048
content: The RSA key size for the certificate signing request (CSR). Available in
macOS 10.11 and later.
- key: EnableAutoRenewal
title: Key Size
supportedOS:
macOS:
introduced: 10.13.4
type: <boolean>
presence: optional
default: false
content: If 'true', the certificate obtained with this payload attempts auto-renewal.
Auto-renewal can only be used with device Active Directory certificate payloads.
Available in macOS 10.13.4 and later.
mdm/profiles/com.apple.AIM.account.yaml
+62
View File
@@ -0,0 +1,62 @@
title: AIM Account
description: Use this section to define settings for configuration access to AIM servers.
payload:
payloadtype: com.apple.AIM.account
supportedOS:
macOS:
introduced: '10.7'
deprecated: '10.13'
removed: '10.14'
devicechannel: false
userchannel: true
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
content: An AIM payload creates an AIM account on the device.
payloadkeys:
- key: AIMAccountDescription
title: Account Description
type: <string>
presence: optional
content: The description of the account.
- key: AIMHostName
title: Account Hostname
type: <string>
presence: required
rangelist:
- slogin.oscar.aol.com
content: The server address.
- key: AIMUserName
title: Account Username
type: <string>
presence: optional
content: The user's login name.
- key: AIMPassword
title: Account Password
type: <string>
presence: optional
content: The user's password.
- key: AIMUseSSL
title: Use SSL
type: <boolean>
presence: optional
default: true
content: If 'true', enables SSL.
- key: AIMPort
title: Port Number
type: <integer>
presence: optional
range:
min: 0
max: 65535
default: 5190
content: The connection port for the server.
- key: AIMAuthentication
title: AIM Authentification
type: <string>
presence: required
rangelist:
- AIMAuthPassword
content: The authentication method for the account.
mdm/profiles/com.apple.AssetCache.managed.yaml
+288
View File
@@ -0,0 +1,288 @@
title: Content Caching
description: ''
payload:
payloadtype: com.apple.AssetCache.managed
supportedOS:
macOS:
introduced: 10.13.4
devicechannel: true
userchannel: false
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
content: Configures the Content Caching service.
payloadkeys:
- key: AllowCacheDelete
supportedOS:
macOS:
introduced: '10.15'
type: <boolean>
presence: optional
default: true
content: |-
Allow the system to purge content from the cache automatically when it needs disk space for other apps (i.e. when free disk space runs low on the computer). Customers who want Content Caching to be as effective as possible should turn this setting off.
Available in macOS 10.15 and later.
- key: AllowPersonalCaching
supportedOS:
macOS:
introduced: 10.13.4
type: <boolean>
presence: optional
default: true
content: |-
If 'true', caches the user's iCloud data. Clients may take some time (hours or days) to react to changes to this setting; it doesn't have an immediate effect.
At least one of the 'AllowPersonalCaching' or 'AllowSharedCaching' keys must be 'true'.
- key: AllowSharedCaching
supportedOS:
macOS:
introduced: 10.13.4
type: <boolean>
presence: optional
default: true
content: |-
If 'true', caches non-iCloud content, such as apps and software updates. Clients may take some time (hours, days) to react to changes to this setting; it does not have an immediate effect.
At least one of the 'AllowPersonalCaching' or 'AllowSharedCaching' keys must be 'true'.
- key: AutoActivation
supportedOS:
macOS:
introduced: 10.13.4
type: <boolean>
presence: optional
default: false
content: |-
If 'true', automatically activates the content cache when possible and prevents it from being disabled. If the 'allowContentCaching' restriction is set to 'false', 'AutoActivation' is also 'false'.
Removing a profile that set 'AutoActivation' to 'true' does not deactivate the Content Cache.
- key: AutoEnableTetheredCaching
supportedOS:
macOS:
introduced: 10.15.4
type: <boolean>
presence: optional
default: false
content: |-
Automatically enable Internet connection sharing when possible and prevent disabling Internet connection sharing. 'DenyTetheredCaching' overrides 'AutoEnableTetheredCaching'. Tethered caching requires Content Caching.
Available in macOS 10.15.4 and later.
- key: CacheLimit
supportedOS:
macOS:
introduced: 10.13.4
type: <integer>
presence: optional
default: 0
content: The maximum number of bytes of disk space that will be used for the content
cache. A value of 0 means unlimited disk space.
- key: DataPath
supportedOS:
macOS:
introduced: 10.13.4
type: <string>
presence: optional
default: /Library/Application Support/Apple/AssetCache/Data
content: |-
The path to the directory used to store cached content. Changing this setting manually doesn't automatically move cached content from the old location to the new one. To move content automatically, use the Sharing preference's Content Caching pane. The value must be (or end with) '/Library/Application Support/Apple/AssetCache/Data'.
A directory and its intermediates are created for the given data path if it doesn't already exist. The directory is owned by '_assetcache:_assetcache' and has mode 0750. Its immediate parent directory ('.../Library/Application Support/Apple/AssetCache') is owned by '_assetcache:_assetcache' and has mode '0755'.
- key: DenyTetheredCaching
supportedOS:
macOS:
introduced: 10.13.4
type: <boolean>
presence: optional
default: false
content: If 'true', disables tethered caching.
- key: DisplayAlerts
supportedOS:
macOS:
introduced: '10.15'
type: <boolean>
presence: optional
default: false
content: |-
If 'true', Content Caching displays exceptional conditions (alerts) as system notifications in the upper corner of the screen. Alerts were automatically displayed starting in macOS 10.13. In macOS 10.15 the alerts are off by default, but still available via this setting.
Available in macOS 10.15 and later.
- key: KeepAwake
supportedOS:
macOS:
introduced: '10.15'
type: <boolean>
presence: optional
default: false
content: |-
If 'true', prevents the computer from sleeping as long as Content Caching is on (System Preferences > Sharing > Content Caching is on). Customers who want Content Caching to be as available as musch as possible should turn this setting on.
Available in macOS 10.15 and later.
- key: ListenRanges
supportedOS:
macOS:
introduced: 10.13.4
type: <array>
presence: optional
content: An array of dictionaries describing a range of client IP addresses to serve.
subkeytype: Ranges
subkeys: &id001
- key: RangesItem
type: <dictionary>
subkeys:
- key: type
supportedOS:
macOS:
introduced: 10.13.4
type: <string>
presence: optional
rangelist:
- IPv4
- IPv6
default: IPv4
content: The IP address type.
- key: first
supportedOS:
macOS:
introduced: 10.13.4
type: <string>
presence: required
content: The first IP address in the range.
- key: last
supportedOS:
macOS:
introduced: 10.13.4
type: <string>
presence: required
content: The last IP address in the range.
- key: ListenRangesOnly
supportedOS:
macOS:
introduced: 10.13.4
type: <boolean>
presence: optional
default: false
content: If 'true', the content cache provides content to the clients in the 'ListenRanges'.
- key: ListenWithPeersAndParents
supportedOS:
macOS:
introduced: 10.13.4
type: <boolean>
presence: optional
default: true
content: If 'true', the content cache provides content to the clients in the union
of the 'ListenRanges', 'PeerListenRanges' and 'Parents'.
- key: LocalSubnetsOnly
supportedOS:
macOS:
introduced: 10.13.4
type: <boolean>
presence: optional
default: true
content: If 'true', the content cache offers content to clients only on the same
immediate local network only. No content is offered to clients on other networks
reachable by the content cache. If 'LocalSubnetsOnly' is set to 'true', 'ListenRanges'
will be ignored.
- key: LogClientIdentity
supportedOS:
macOS:
introduced: 10.13.4
type: <boolean>
presence: optional
default: false
content: If 'true', the Content Cache logs the IP address and port number of the
clients that request content.
- key: Parents
supportedOS:
macOS:
introduced: 10.13.4
type: <array>
presence: optional
content: An array of the local IP addresses of other content caches that this cache
should download from or upload to, instead of downloading from or uploading to
Apple directly. Invalid addresses and addresses of computers that aren't content
caches are ignored. Parent caches that become unavailable are skipped. If all
parent content caches become unavailable, the content cache downloads from or
uploads to Apple directly, until a parent content cache becomes available again.
subkeys:
- key: ParentsItem
type: <string>
presence: required
content: An IP address.
- key: ParentSelectionPolicy
supportedOS:
macOS:
introduced: 10.13.4
type: <string>
presence: optional
rangelist:
- first-available
- url-path-hash
- random
- round-robin
- sticky-available
default: round-robin
content: |-
The policy to implement when choosing among more than one configured parent content cache. With every policy, parent caches that are temporarily unavailable are skipped.
'first-available': Always use the first available parent in the Parents list. Use this policy to designate permanent primary, secondary, and subsequent parents.
'url-path-hash': Hash the path part of the requested URL so that the same parent is always used for the same URL. This is useful for maximizing the size of the combined caches of the parents.
'random': Choose a parent at random. Use this policy for load balancing.
'round-robin': Rotate through the parents in order. Use this policy for load balancing.
'sticky-available': Use the first available parent that is available in the Parents list until it becomes unavailable, then advance to the next one. Use this policy for designating floating primary, secondary, and subsequent parents.
- key: PeerFilterRanges
supportedOS:
macOS:
introduced: 10.13.4
type: <array>
presence: optional
content: An array of dictionaries describing a range of peer IP addresses that the
content cache uses to filter its list of peers to query for content. The content
cache only queries peers in 'PeerFilterRanges'. When 'PeerFilterRanges' is an
empty array, the content cache doesn't query any peers.
subkeytype: Ranges
subkeys: *id001
- key: PeerListenRanges
supportedOS:
macOS:
introduced: 10.13.4
type: <array>
presence: optional
content: An array of dictionaries describing a range of peer IP addresses the content
cache responds to. When 'PeerListenRanges' is an empty array, the content cache
responds with an error to all cache queries.
subkeytype: Ranges
subkeys: *id001
- key: PeerLocalSubnetsOnly
supportedOS:
macOS:
introduced: 10.13.4
type: <boolean>
presence: optional
default: true
content: If 'true', the content cache only peers with other content caches on the
same immediate local network, rather than with content caches that use the same
public IP address as the device. When 'PeerLocalSubnetsOnly' is 'true', it overrides
the configuration of 'PeerFilterRanges' and 'PeerListenRanges'. If the network
changes, the local network peering restrictions update appropriately. If 'false',
the content cache defers to 'PeerFilterRanges' and 'PeerListenRanges' for configuring
the peering restrictions.
- key: Port
supportedOS:
macOS:
introduced: 10.13.4
type: <integer>
presence: optional
default: 0
content: The TCP port number on which the content cache accepts requests for uploads
or downloads. Set the port to 0 to pick a random, available port.
- key: PublicRanges
supportedOS:
macOS:
introduced: 10.13.4
type: <array>
presence: optional
content: An array of dictionaries describing a range of public IP addresses that
the cloud servers should use for matching clients to content caches.
subkeytype: Ranges
subkeys: *id001
mdm/profiles/com.apple.Dictionary.yaml
+20
View File
@@ -0,0 +1,20 @@
title: 'Parental Controls: Dictionary'
description: ''
payload:
payloadtype: com.apple.Dictionary
supportedOS:
macOS:
introduced: '10.7'
devicechannel: true
userchannel: true
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
content: Parental controls dictionary restrictions.
payloadkeys:
- key: parentalControl
type: <boolean>
presence: required
content: If 'true', enables parental controls dictionary restrictions.
mdm/profiles/com.apple.DirectoryService.managed.yaml
+265
View File
@@ -0,0 +1,265 @@
title: Directory Service
description: Directory Service
payload:
payloadtype: com.apple.DirectoryService.managed
supportedOS:
macOS:
introduced: '10.8'
devicechannel: true
userchannel: false
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: allowed
content: In macOS 10.9 and later, a configuration profile can be used to configure
macOS to join an Active Directory (AD) domain. Advanced AD options available via
Directory Utility or the dsconfigad command line tool can also be set using a
configuration profile.
payloadkeys:
- key: HostName
title: HostName
type: <string>
presence: required
content: The Active Directory domain to join.
- key: UserName
title: UserName
type: <string>
presence: optional
content: The user name of the account for the domain.
- key: Password
title: Password
type: <string>
presence: optional
content: The password of the account for the domain.
- key: ClientID
title: Client ID
type: <string>
presence: optional
content: The client's identifier.
- key: Description
title: Description
type: <string>
presence: optional
content: The directory service description.
- key: ADOrganizationalUnit
title: ADOrganizationalUnit
type: <string>
presence: optional
content: The organizational unit where the joining computer object is added.
- key: ADMountStyle
title: ADMountStyle
type: <string>
presence: optional
content: 'The network home protocol to use: ''afp'' or ''smb''.'
- key: ADCreateMobileAccountAtLoginFlag
title: ADCreateMobileAccountAtLoginFlag
supportedOS:
macOS:
introduced: '10.9'
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADCreateMobileAccountAtLogin' key.
- key: ADCreateMobileAccountAtLogin
title: ADCreateMobileAccountAtLogin
type: <boolean>
presence: optional
default: false
content: If 'true', creates a mobile account at login.
- key: ADWarnUserBeforeCreatingMAFlag
title: ADWarnUserBeforeCreatingMAFlag
supportedOS:
macOS:
introduced: '10.9'
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADWarnUserBeforeCreatingMA' key.
- key: ADWarnUserBeforeCreatingMA
title: ADWarnUserBeforeCreatingMA
type: <boolean>
presence: optional
default: false
content: If 'true', enables the warning before creating the mobile account.
- key: ADForceHomeLocalFlag
title: ADForceHomeLocalFlag
supportedOS:
macOS:
introduced: '10.9'
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADForceHomeLocal' key.
- key: ADForceHomeLocal
title: ADForceHomeLocal
type: <boolean>
presence: optional
default: false
content: If 'true', forces a local home directory.
- key: ADUseWindowsUNCPathFlag
title: ADUseWindowsUNCPathFlag
supportedOS:
macOS:
introduced: '10.9'
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADUseWindowsUNCPath' key.
- key: ADUseWindowsUNCPath
title: ADUseWindowsUNCPath
type: <boolean>
presence: optional
default: false
content: If 'true', uses the UNC path from Active Directory to derive the network
home location.
- key: ADAllowMultiDomainAuthFlag
title: ADAllowMultiDomainAuthFlag
supportedOS:
macOS:
introduced: '10.9'
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADAllowMultiDomainAuth' key.
- key: ADAllowMultiDomainAuth
title: ADAllowMultiDomainAuth
type: <boolean>
presence: optional
default: false
content: If 'true', allows authentication from any domain in the namespace.
- key: ADDefaultUserShellFlag
title: ADDefaultUserShellFlag
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADDefaultUserShell' key.
- key: ADDefaultUserShell
title: ADDefaultUserShell
type: <string>
presence: optional
content: The default user shell.
- key: ADMapUIDAttributeFlag
title: ADMapUIDAttributeFlag
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADMapUIDAttribute' key.
- key: ADMapUIDAttribute
title: ADMapUIDAttribute
type: <string>
presence: optional
content: The map UID to attribute.
- key: ADMapGIDAttributeFlag
title: ADMapGIDAttributeFlag
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADMapGIDAttribute' key.
- key: ADMapGIDAttribute
title: ADMapGIDAttribute
type: <string>
presence: optional
content: The map GID to attribute.
- key: ADMapGGIDAttributeFlag
title: ADMapGGIDAttributeFlag
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADMapGGIDAttributeFlag' key.
- key: ADMapGGIDAttribute
title: ADMapGGIDAttribute
type: <string>
presence: optional
content: The map group GID to attribute.
- key: ADPreferredDCServerFlag
title: ADPreferredDCServerFlag
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADPreferredDCServer' key.
- key: ADPreferredDCServer
title: ADPreferredDCServer
type: <string>
presence: optional
content: The preferred domain server.
- key: ADDomainAdminGroupListFlag
title: ADDomainAdminGroupListFlag
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADDomainAdminGroupList' key.
- key: ADDomainAdminGroupList
title: ADDomainAdminGroupList
type: <array>
presence: optional
content: The list of Active Directory groups that are granted admin access.
subkeys:
- key: ADDomainAdminGroupListItem
type: <string>
- key: ADNamespaceFlag
title: ADNamespaceFlag
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADNamespace' key.
- key: ADNamespace
title: ADNamespace
type: <string>
presence: optional
content: The primary user account naming convention; either 'forest' or 'domain'.
- key: ADPacketSignFlag
title: ADPacketSignFlag
supportedOS:
macOS:
introduced: '10.8'
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADPacketSign' key.
- key: ADPacketSign
title: ADPacketSign
type: <string>
presence: optional
content: The packet signing policy.
- key: ADPacketEncryptFlag
title: ADPacketEncryptFlag
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADPacketEncrypt' key.
- key: ADPacketEncrypt
title: ADPacketEncrypt
type: <string>
presence: optional
content: The packet encryption policy.
- key: ADRestrictDDNSFlag
title: ADRestrictDDNSFlag
type: <boolean>
presence: optional
default: false
content: If 'true', enables the 'ADRestrictDDNS' key.
- key: ADRestrictDDNS
title: ADRestrictDDNS
supportedOS:
macOS:
introduced: '10.8'
type: <array>
presence: optional
content: An array of strings representing the interfaces that are allowed for dynamic
DNS updates (for example, en0, en1, and so on).
subkeys:
- key: ADRestrictDDNSItem
type: <string>
- key: ADTrustChangePassIntervalDaysFlag
title: ADTrustChangePassIntervalDaysFlag
type: <boolean>
presence: optional
default: false
content: If true, enables the 'ADTrustChangePassIntervalDays 'key.
- key: ADTrustChangePassIntervalDays
title: ADTrustChangePassIntervalDays
type: <integer>
presence: optional
content: The number of days before requiring a change of the computer trust account
password. '0' disables the feature.
mdm/profiles/com.apple.DiscRecording.yaml
+28
View File
@@ -0,0 +1,28 @@
title: 'Media Management: Disc Burning'
description: ''
payload:
payloadtype: com.apple.DiscRecording
supportedOS:
macOS:
introduced: '10.7'
devicechannel: true
userchannel: true
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
payloadkeys:
- key: BurnSupport
type: <string>
presence: required
rangelist:
- 'off'
- authenticate
- 'on'
content: |-
If 'off', disables disc burning.
If 'on', allows normal default operation. Setting this key to 'on' doesn't enable disc burn support if it has already been disabled by other mechanisms or preferences. It also must be enabled with the Finder profile.
If 'authenticate', requires authentication.
mdm/profiles/com.apple.MCX(Accounts).yaml
+32
View File
@@ -0,0 +1,32 @@
title: Accounts
description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
macOS:
introduced: '10.7'
devicechannel: true
userchannel: false
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
payloadkeys:
- key: EnableGuestAccount
supportedOS:
macOS:
introduced: '10.7'
type: <boolean>
presence: optional
default: false
content: If 'true', enables the guest account.
- key: DisableGuestAccount
supportedOS:
macOS:
introduced: '10.7'
type: <boolean>
presence: optional
default: false
content: If 'true', disables the guest account. This property has no effect if 'EnableGuestAccount'
is 'true'.
mdm/profiles/com.apple.MCX(EnergySaver).yaml
+154
View File
@@ -0,0 +1,154 @@
title: Energy Saver
description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
macOS:
introduced: '10.7'
devicechannel: true
userchannel: false
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
payloadkeys:
- key: com.apple.EnergySaver.desktop.ACPower
type: <dictionary>
presence: optional
content: The settings for a desktop computer.
subkeytype: PowerSettings
subkeys: &id001
- key: Display Sleep Timer
type: <integer>
presence: optional
rangelist:
- 0
range:
min: 1
max: 180
content: The display sleep time, in minutes. A value of 0 means never.
- key: Disk Sleep Timer
type: <integer>
presence: optional
rangelist:
- 0
range:
min: 1
max: 180
content: The disk sleep time, in minutes. A value of 0 means never.
- key: System Sleep Timer
type: <integer>
presence: optional
rangelist:
- 0
range:
min: 1
max: 180
content: System sleep time, in minutes. A value of 0 means never.
- key: Reduce Processor Speed
type: <integer>
presence: optional
rangelist:
- 0
- 1
content: May not be available on all systems.
- key: Dynamic Power Step
type: <integer>
presence: optional
rangelist:
- 0
- 1
content: May not be available on all systems.
- key: Wake on LAN
type: <integer>
presence: optional
rangelist:
- 0
- 1
content: If 'true', enables 'Wake for network access.'
- key: Wake On Modem Ring
type: <integer>
presence: optional
rangelist:
- 0
- 1
content: If 'true', enables 'Wake for modem ring.'
- key: Automatic Restart On Power Loss
type: <integer>
presence: optional
rangelist:
- 0
- 1
content: If 'true', enables 'Start up automatically after a power failure.'
- key: com.apple.EnergySaver.portable.ACPower
type: <dictionary>
presence: optional
content: The settings for a laptop computer using AC power.
subkeytype: PowerSettings
subkeys: *id001
- key: com.apple.EnergySaver.portable.BatteryPower
type: <dictionary>
presence: optional
content: The settings for a laptop computer using battery power.
subkeytype: PowerSettings
subkeys: *id001
- key: com.apple.EnergySaver.desktop.Schedule
type: <dictionary>
presence: optional
content: The schedule for turning a computer on and off.
subkeytype: EnergySaver Schedule
subkeys:
- key: RepeatingPowerOn
type: <dictionary>
presence: optional
content: The schedule for turning the device on.
subkeytype: RepeatingPowerItem
subkeys: &id002
- key: eventtype
type: <string>
presence: required
rangelist:
- wake
- poweron
- wakepoweron
- sleep
- shutdown
- restart
content: The type of action defined by this schedule.
- key: weekdays
type: <integer>
presence: optional
content: |-
One or more days of the week in an unsigned integer bitmap:
* '1' = Mon
* '2' = Tue
* '4' = Wed
* '8' = Thu
* '16' = Fri
* '32' = Sat
* '64' = Sun
- key: time
type: <integer>
presence: optional
content: The time, in minutes, since midnight.
- key: RepeatingPowerOff
type: <dictionary>
presence: optional
content: The schedule for turning the device off.
subkeytype: RepeatingPowerItem
subkeys: *id002
- key: SleepDisabled
type: <boolean>
presence: optional
default: false
content: If 'true', disables sleep.
- key: DestroyFVKeyOnStandby
supportedOS:
macOS:
introduced: '10.10'
type: <boolean>
presence: optional
default: false
content: If 'true', prevents the OS from storing a temporary FileVault key in SMC
or RAM for standby.
mdm/profiles/com.apple.MCX(FileVault2).yaml
+34
View File
@@ -0,0 +1,34 @@
title: FDE FileVault Options
description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
macOS:
introduced: '10.7'
devicechannel: true
userchannel: false
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
content: The FileVault accounts payload sets up options for enabling FileVault.
payloadkeys:
- key: dontAllowFDEDisable
type: <boolean>
presence: optional
default: false
content: Set to 'true' to prevent FileVault from being disabled.
- key: dontAllowFDEEnable
type: <boolean>
presence: optional
default: false
content: Set to 'true' to prevent FileVault from being enabled.
- key: DestroyFVKeyOnStandby
supportedOS:
macOS:
introduced: '10.9'
type: <boolean>
presence: optional
default: false
content: Set to 'true' to prevent storing the FileVault key across restarts.
mdm/profiles/com.apple.MCX(Mobililty).yaml
+47
View File
@@ -0,0 +1,47 @@
title: Mobile Accounts
description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
macOS:
introduced: '10.7'
devicechannel: true
userchannel: true
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
content: Sets up mobile account options for network based user accounts.
payloadkeys:
- key: com.apple.cachedaccounts.CreateAtLogin
type: <boolean>
presence: optional
default: false
content: If 'true', creates the mobile account at login time.
- key: com.apple.cachedaccounts.WarnOnCreate
type: <boolean>
presence: optional
default: false
content: If 'true', asks the user if the mobile account should be created and allow
the user to not create it.
- key: cachedaccounts.WarnOnCreate.allowNever
type: <boolean>
presence: optional
default: false
content: If 'true', allows the user to stop the prompts about mobile account creation
every time the user logs in. This key is only valid if 'com.apple.cachedaccounts.WarnOnCreate'
is set to 'true'.
- key: cachedaccounts.expiry.delete.disusedSeconds
type: <integer>
presence: optional
default: -1
content: |-
The minimum number of seconds a mobile account can exist before an automatic attempt is made to remove the mobile account.
Set to '0' to try to remove it at next login or logout time. Set to '-1' to never try to remove the mobile account.
- key: cachedaccounts.askForSecureTokenAuthBypass
type: <boolean>
presence: optional
default: false
content: If 'true', bypasses the secure token authorization dialog. This dialog
only appears on APFS volumes.
mdm/profiles/com.apple.MCX(TimeServer).yaml
+25
View File
@@ -0,0 +1,25 @@
title: Time Server
description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
macOS:
introduced: 10.12.4
devicechannel: true
userchannel: false
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
content: Settings for time zone and server
payloadkeys:
- key: timeServer
type: <string>
presence: optional
content: The NTP server to connect to. Use commas to separate multiple time servers.
- key: timeZone
type: <string>
presence: optional
content: The time zone path location string in '/usr/share/zoneinfo/'; for example,
'America/Denver' or 'Zulu'.
mdm/profiles/com.apple.MCX(WiFi).yaml
+39
View File
@@ -0,0 +1,39 @@
title: Wi-Fi Managed Settings
description: ''
payload:
payloadtype: com.apple.MCX
supportedOS:
macOS:
introduced: '10.9'
devicechannel: true
userchannel: false
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
payloadkeys:
- key: RequireAdminForIBSS
supportedOS:
macOS:
introduced: '10.9'
type: <boolean>
presence: optional
default: false
content: If YES, requires administrator authorization to enable IBSS.
- key: RequireAdminForAirPortNetworkChange
supportedOS:
macOS:
introduced: '10.9'
type: <boolean>
presence: optional
default: false
content: If YES, requires administrator authorization for network changes.
- key: RequireAdminToTurnAirPortOnOff
supportedOS:
macOS:
introduced: '10.9'
type: <boolean>
presence: optional
default: false
content: If YES, requires administrator authorization to turn Wi-Fi on or off.
mdm/profiles/com.apple.MCX.FileVault2.yaml
+95
View File
@@ -0,0 +1,95 @@
title: FDE FileVault
description: ''
payload:
payloadtype: com.apple.MCX.FileVault2
supportedOS:
macOS:
introduced: '10.9'
devicechannel: true
userchannel: false
requiresdep: false
userapprovedmdm: true
allowmanualinstall: true
userenrollment:
mode: forbidden
content: The FileVault payload only works on macOS to enable or disable FileVault.
Starting with macOS 10.15, this payload requires UAMDM to enable FileVault.
payloadkeys:
- key: Enable
type: <string>
presence: required
rangelist:
- 'On'
- 'Off'
content: If 'true', enables FileVault.
- key: Defer
type: <boolean>
presence: optional
default: false
content: If 'true', defers enabling FileVault until the designated user logs out.
For details, see 'fdesetup(8)'. The person enabling FileVault must be either a
local user or a mobile account user.
- key: UserEntersMissingInfo
type: <boolean>
presence: optional
default: false
content: If 'true', enables a prompt for missing user name or password fields.
- key: UseRecoveryKey
type: <boolean>
presence: optional
default: true
content: If 'true', creates a personal recovery key and displays it to the user.
- key: ShowRecoveryKey
type: <boolean>
presence: optional
default: true
content: If 'false', prevents display of the personal recovery key to the user after
FileVault is enabled.
- key: OutputPath
type: <string>
presence: optional
content: The path to the location where the recovery key and computer information
property list are stored.
- key: Certificate
type: <data>
presence: optional
content: The DER-encoded certificate data if 'UseRecoveryKey' is enabled.
- key: PayloadCertificateUUID
type: <string>
presence: optional
content: The UUID of the payload within the same profile containing the asymmetric
recovery key certificate payload.
- key: Username
type: <string>
presence: optional
content: The user name of the Open Directory user to be added to FileVault.
- key: Password
type: <string>
presence: optional
content: The password of the Open Directory user to be added to FileVault. Use the
'UserEntersMissingInfo' key if you want to prompt for this information.
- key: UseKeychain
type: <boolean>
presence: optional
default: false
content: If 'true' and no certificate information is provided in this payload, the
keychain created at '/Library/Keychains/FileVaultMaster.keychain' is used when
the institutional recovery key is added.
- key: DeferForceAtUserLoginMaxBypassAttempts
type: <integer>
presence: optional
range:
min: -1
max: 9999
content: The maximum number of times users can bypass enabling FileVault before
being required to enable it to log in. If the value is '0', the user will be required
to enabled FileVault the next time they attempt to log in. Setting this key to
'–1' disables the feature.
- key: DeferDontAskAtUserLogout
supportedOS:
macOS:
introduced: '10.10'
type: <boolean>
presence: optional
default: false
content: If 'true', prevents requests for enabling FileVault at user logout time.
mdm/profiles/com.apple.MCX.TimeMachine.yaml
+59
View File
@@ -0,0 +1,59 @@
title: Time Machine
payload:
payloadtype: com.apple.MCX.TimeMachine
supportedOS:
macOS:
introduced: '10.7'
devicechannel: true
userchannel: false
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
payloadkeys:
- key: AutoBackup
type: <boolean>
presence: optional
default: true
content: If 'true', performs automatic backups at regular intervals.
- key: BackupAllVolumes
type: <boolean>
presence: optional
default: false
content: If true, backs up only the startup volume by default.
- key: BackupDestURL
type: <string>
presence: required
content: The URL of the backup destination.
- key: BackupSizeMB
type: <integer>
presence: optional
default: 0
content: The backup size limit, in megabytes. Set to 0 for unlimited.
- key: BackupSkipSys
type: <boolean>
presence: optional
default: false
content: If 'true', skips system files and folders by default.
- key: MobileBackups
type: <boolean>
presence: optional
default: true
content: If 'true', create local backup snapshots when not connected to the network.
- key: BasePaths
type: <array>
presence: optional
content: The list of paths to back up besides the startup volume.
subkeys:
- key: BasePathItem
type: <string>
presence: required
- key: SkipPaths
type: <array>
presence: optional
content: The path to skip from start volume.
subkeys:
- key: SkipPathItem
type: <string>
presence: required
mdm/profiles/com.apple.ManagedClient.preferences.yaml
+43
View File
@@ -0,0 +1,43 @@
title: Managed Preferences
description: ''
payload:
payloadtype: com.apple.ManagedClient.preferences
supportedOS:
macOS:
introduced: '10.7'
devicechannel: true
userchannel: true
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
payloadkeys:
- key: PreferenceDomain
type: <dictionary>
presence: required
content: The dictionary containing app preference domains.
subkeys:
- key: Forced
type: <array>
presence: required
content: The dictionary of forced settings.
subkeys: &id001
- key: Settings
type: <dictionary>
presence: required
subkeys:
- key: mcx_preference_settings
type: <dictionary>
presence: required
content: The dictionary of settings.
subkeys:
- key: ANY
type: <any>
presence: optional
content: The setting/value pairs.
- key: Set-Once
type: <array>
presence: required
content: The dictonary of one-time settings.
subkeys: *id001
mdm/profiles/com.apple.NSExtension.yaml
+47
View File
@@ -0,0 +1,47 @@
title: NSExtension Management
description: ''
payload:
payloadtype: com.apple.NSExtension
supportedOS:
macOS:
introduced: '10.13'
devicechannel: true
userchannel: true
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
content: Specifies which NSExtension extensions are to be allowed or disallowed
on a system. Extensions can be managed by bundleID allow/deny lists and "extension
points".
payloadkeys:
- key: AllowedExtensions
type: <array>
presence: optional
content: An array of identifiers for extensions that are allowed to run on the system.
subkeys:
- key: AllowedExtensionsItem
type: <string>
presence: required
content: An extension identifier.
- key: DeniedExtensions
type: <array>
presence: optional
content: An array of identifiers for extensions that aren't allowed to run on the
system.
subkeys:
- key: DeniedExtensionsItem
type: <string>
presence: required
content: An extension identifier.
- key: DeniedExtensionPoints
type: <array>
presence: optional
content: An array of extension points for extensions that aren't allowed to run
on the system.
subkeys:
- key: DeniedExtensionPointsItem
type: <string>
presence: required
content: An extension identifier.
mdm/profiles/com.apple.SetupAssistant.managed.yaml
+137
View File
@@ -0,0 +1,137 @@
title: Setup Assistant
description: ''
payload:
payloadtype: com.apple.SetupAssistant.managed
supportedOS:
iOS:
introduced: '14.0'
supervised: true
allowmanualinstall: true
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: '10.12'
devicechannel: true
userchannel: true
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
content: On macOS, this payload can specify Setup Assistant options for either the
system or particular users.
payloadkeys:
- key: SkipCloudSetup
supportedOS:
iOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', skips the Apple ID setup window.
- key: SkipSiriSetup
supportedOS:
iOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', skips the Siri setup window.
- key: SkipPrivacySetup
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.13.4
type: <boolean>
presence: optional
default: false
content: If 'true', skips the Privacy consent window.
- key: SkipiCloudStorageSetup
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.13.4
type: <boolean>
presence: optional
default: false
content: If 'true', skips the iCloud Storage window.
- key: SkipTrueTone
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: 10.13.6
type: <boolean>
presence: optional
default: false
content: If 'true', skips the True Tone Display window.
- key: SkipAppearance
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.14'
type: <boolean>
presence: optional
default: false
content: If 'true', skips the Choose Your Look window.
- key: SkipTouchIDSetup
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.15'
type: <boolean>
presence: optional
default: false
content: If true, skips the Touch ID setup window.
- key: SkipScreenTime
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.15'
type: <boolean>
presence: optional
default: false
content: If true, skips the Screen Time window.
- key: SkipAccessibility
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
type: <boolean>
presence: optional
default: false
content: Skips Accessibility window
- key: SkipSetupItems
supportedOS:
iOS:
introduced: '14.0'
macOS:
introduced: n/a
type: <array>
presence: optional
content: |-
An array strings describing setup items to skip. SkipKeys provides a list of valid strings and their meanings.
Available in iOS 14 and later.
subkeys:
- key: SkipSetupItems
type: <string>
- key: SkipUnlockWithWatch
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '12.0'
type: <boolean>
presence: optional
default: false
content: Skips Unlock With Apple Watch window
mdm/profiles/com.apple.ShareKitHelper.yaml
+38
View File
@@ -0,0 +1,38 @@
title: ShareKit
description: ''
payload:
payloadtype: com.apple.ShareKitHelper
supportedOS:
macOS:
introduced: '10.9'
deprecated: '10.12'
devicechannel: true
userchannel: true
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
content: macOS only. Specifies which ShareKit plugin can be accessed on client.
Both allow and disallow lists can be specified.
payloadkeys:
- key: SHKAllowedShareServices
type: <array>
presence: optional
content: The list of plugin IDs that show up in the user's Share menu. If this array
exists, only these items are permitted.
subkeys:
- key: SHKAllowedShareServicesItem
type: <string>
presence: required
content: A plugin ID.
- key: SHKDeniedShareServices
type: <array>
presence: optional
content: The list of plugin IDs that won't show up in the user's Share menu. This
key is used only if there is no 'SHKAllowedShareServices' key.
subkeys:
- key: SHKDeniedShareServicesItem
type: <string>
presence: required
content: A plugin ID.
mdm/profiles/com.apple.SoftwareUpdate.yaml
+100
View File
@@ -0,0 +1,100 @@
title: Software Update
description: Software Update Managed Settings
payload:
payloadtype: com.apple.SoftwareUpdate
supportedOS:
macOS:
introduced: '10.7'
devicechannel: true
userchannel: false
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
content: Software update catalog options.
payloadkeys:
- key: CatalogURL
supportedOS:
macOS:
introduced: '10.7'
deprecated: '11.0'
userenrollment:
mode: forbidden
type: <string>
presence: optional
content: The URL of the software update catalog. This property is not supported
in macOS 11 and later.
- key: AllowPreReleaseInstallation
title: Allow Pre-Release Update Installation
supportedOS:
macOS:
introduced: '10.9'
type: <boolean>
presence: optional
default: true
content: If 'true', prerelease software can be installed on this computer.
- key: restrict-software-update-require-admin-to-install
supportedOS:
macOS:
introduced: '10.14'
type: <boolean>
presence: optional
default: false
content: If 'true', restrict app installations to admin users. This key has the
same function as the 'restrict-store-require-admin-to-install' key in the 'com.apple.appstore'
payload.
- key: AutomaticallyInstallMacOSUpdates
supportedOS:
macOS:
introduced: '10.15'
type: <boolean>
presence: optional
default: true
content: If 'false', restricts the 'Install macOS Updates' option and prevents the
user from changing the option.
- key: AutomaticallyInstallAppUpdates
supportedOS:
macOS:
introduced: '10.15'
type: <boolean>
presence: optional
default: true
content: If 'false', deselects the 'Install app updates from the App Store' option
and prevents the user from changing the option.
- key: AutomaticCheckEnabled
supportedOS:
macOS:
introduced: '10.15'
type: <boolean>
presence: optional
default: true
content: If 'false', deselects the 'Check for updates' option and prevents the user
from changing the option.
- key: AutomaticDownload
supportedOS:
macOS:
introduced: '10.15'
type: <boolean>
presence: optional
default: true
content: If 'false', deselects the 'Download new updates when available from the
App Store' option and prevents the user from changing the option.
- key: CriticalUpdateInstall
supportedOS:
macOS:
introduced: '10.15'
type: <boolean>
presence: optional
default: true
content: If 'false', disables the automatic installation of critical updates and
prevents the user from changing the 'Install system data files and security updates'
option.
- key: ConfigDataInstall
supportedOS:
macOS:
introduced: '10.15'
type: <boolean>
presence: optional
default: true
content: If 'false', restricts the automatic installation of configuration data.
mdm/profiles/com.apple.SystemConfiguration.yaml
+125
View File
@@ -0,0 +1,125 @@
title: Network Proxy Configuration
payload:
payloadtype: com.apple.SystemConfiguration
supportedOS:
macOS:
introduced: '10.7'
devicechannel: true
userchannel: false
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
payloadkeys:
- key: Proxies
type: <dictionary>
presence: required
content: The dictionary containing all the proxies for this device.
subkeys:
- key: FTPEnable
type: <integer>
presence: optional
content: If 'true', enables FTP proxy.
- key: FTPPassive
type: <integer>
presence: optional
content: If 'true', enables passive FTP mode.
- key: FTPPort
type: <integer>
presence: optional
content: The FTP proxy port.
- key: FTPProxy
type: <string>
presence: optional
content: The host name or IP address for the FTP proxy.
- key: GopherEnable
type: <integer>
presence: optional
content: If 'true', enables gopher proxy.
- key: GopherPort
type: <integer>
presence: optional
content: The gopher proxy port.
- key: GopherProxy
type: <string>
presence: optional
content: The host name or IP address for the gopher proxy.
- key: HTTPEnable
type: <integer>
presence: optional
content: If 'true', enables web proxy.
- key: HTTPPort
type: <integer>
presence: optional
content: The web proxy port.
- key: HTTPProxy
type: <string>
presence: optional
content: The host name or IP address for the web proxy.
- key: HTTPSEnable
type: <integer>
presence: optional
content: If 'true', enables secure web proxy.
- key: HTTPSPort
type: <integer>
presence: optional
content: The secure web proxy port.
- key: HTTPSProxy
type: <string>
presence: optional
content: The host name or IP address for the secure web proxy.
- key: ProxyAutoConfigEnable
type: <integer>
presence: optional
content: If 'true', enables automatic proxy configuration.
- key: ProxyAutoConfigURLString
type: <string>
presence: optional
content: The automatic proxy configuration URL.
- key: ProxyCaptiveLoginAllowed
supportedOS:
macOS:
introduced: '10.9'
type: <integer>
presence: optional
content: If 1, allows client to log into captive portal network.
- key: RTSPEnable
type: <integer>
presence: optional
content: If 'true', enable streaming proxy.
- key: RTSPPort
type: <integer>
presence: optional
content: The streaming proxy port.
- key: RTSPProxy
type: <string>
presence: optional
content: The host name or IP address for the streaming proxy.
- key: SOCKSEnable
type: <integer>
presence: optional
content: If 'true', enable the SOCKS proxy.
- key: SOCKSPortinteger
type: <integer>
presence: optional
content: The SOCKS proxy port.
- key: SOCKSProxy
type: <string>
presence: optional
content: The host name or IP address for the SOCKS proxy.
- key: FallBackAllowed
type: <integer>
presence: optional
content: |-
If '1', enables fallback. Default is '1'.
For managed devices, if not supplied, the default is '0'.
- key: ExceptionsList
type: <array>
presence: optional
content: The list of hosts and domains that should bypass proxy settings.
subkeys:
- key: Exception
type: <string>
presence: required
content: Bypass proxy settings for these Hosts & Domains
mdm/profiles/com.apple.TCC.configuration-profile-policy.yaml
+261
View File
@@ -0,0 +1,261 @@
title: Privacy Preferences Policy Control
description: Configures Security Preferences:Privacy settings
payload:
payloadtype: com.apple.TCC.configuration-profile-policy
supportedOS:
macOS:
introduced: '10.14'
devicechannel: true
userchannel: false
requiresdep: false
userapprovedmdm: true
allowmanualinstall: false
userenrollment:
mode: forbidden
payloadkeys:
- key: Services
type: <dictionary>
presence: required
content: A dictionary whose keys are limited to the privacy policy control services. In
the case of conflicting specifications, the most restrictive setting (deny) is
used.
subkeys:
- key: AddressBook
type: <array>
presence: optional
content: Specifies the policies for contact information managed by the Contacts.app.
subkeytype: Identity
subkeys: &id001
- key: IdentityDict
type: <dictionary>
subkeys:
- key: Identifier
type: <string>
presence: required
content: The bundle ID or installation path of the binary.
- key: IdentifierType
type: <string>
presence: required
rangelist:
- bundleID
- path
content: The type of identifier value. Application bundles must be identified
by bundle ID. Nonbundled binaries must be identified by installation path.
Helper tools embedded within an application bundle automatically inherit
the permissions of their enclosing app bundle.
- key: CodeRequirement
type: <string>
presence: required
content: Obtained via the command ''codesign –display -r -''.
- key: StaticCode
type: <boolean>
presence: optional
default: false
content: If 'true', statically validate the code requirement. Used only if
the process invalidates its dynamic code signature.
- key: Allowed
type: <boolean>
presence: required
content: If 'true', access is granted; otherwise, the process doesn't have
access. The user isn't prompted and can't change this value.
- key: Authorization
supportedOS:
macOS:
introduced: '11.0'
type: <string>
presence: optional
rangelist:
- Allow
- Deny
- AllowStandardUserToSetSystemService
content: |-
The 'Authorization' key is an optional replacement for the 'Allowed' key. Every payload must specify either 'Authorization' or 'Allowed', but not both.
'Allow': Equivalent to a 'true' value for the 'Allowed' key.
'Deny': Equivalent to a f'alse' value for the 'Allowed' key.
'AllowStandardUserToSetSystemService:' allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization. 'AllowStandardUserToSetSystemService' is only valid for the 'ListenEvent' and 'ScreenCapture' services.
Available in macOS 11 and later.
- key: Comment
type: <string>
presence: optional
content: Not used.
- key: AEReceiverIdentifier
type: <string>
presence: optional
content: The identifier of the process receiving an AppleEvent sent by the
Identifier process. This identifier is required for AppleEvents service;
not valid for other services.
- key: AEReceiverIdentifierType
type: <string>
presence: optional
rangelist:
- bundleID
- path
content: The type of AEReceiverIdentifier value, either 'bundleID' or 'path'.
This setting is required for AppleEvents service; not valid for other services.
- key: AEReceiverCodeRequirement
type: <string>
presence: optional
content: The code requirement for the receiving binary. This code requirement
is required for AppleEvents service; not valid for other services.
- key: Calendar
type: <array>
presence: optional
content: Specifies the policies for calendar information managed by the Calendar.app.
subkeytype: Identity
subkeys: *id001
- key: Reminders
type: <array>
presence: optional
content: Specifies the policies for reminders information managed by the Reminders
app.
subkeytype: Identity
subkeys: *id001
- key: Photos
type: <array>
presence: optional
content: The pictures managed by the Photos app in '~/Pictures/.photoslibrary'.
subkeytype: Identity
subkeys: *id001
- key: Camera
type: <array>
presence: optional
content: A system camera. Access to the camera cannot be given in a profile; it
can only be denied.
subkeytype: Identity
subkeys: *id001
- key: Microphone
type: <array>
presence: optional
content: A system microphone. Access to the microphone cannot be given in a profile;
it can only be denied.
subkeytype: Identity
subkeys: *id001
- key: Accessibility
type: <array>
presence: optional
content: Specifies the policies for the app via the Accessibility subsystem.
subkeytype: Identity
subkeys: *id001
- key: PostEvent
type: <array>
presence: optional
content: Specifies the policies for the application to use CoreGraphics APIs to
send CGEvents to the system event stream.
subkeytype: Identity
subkeys: *id001
- key: SystemPolicyAllFiles
type: <array>
presence: optional
content: Allows the application access to all protected files, including system
administration files.
subkeytype: Identity
subkeys: *id001
- key: SystemPolicySysAdminFiles
type: <array>
presence: optional
content: Allows the application access to some files used in system administration.
subkeytype: Identity
subkeys: *id001
- key: AppleEvents
type: <array>
presence: optional
content: Specifies the policies for the app sending restricted AppleEvents to
another process.
subkeytype: Identity
subkeys: *id001
- key: MediaLibrary
supportedOS:
macOS:
introduced: '10.15'
type: <array>
presence: optional
content: Allows the application to access Apple Music, music and video activity,
and the media library.
subkeytype: Identity
subkeys: *id001
- key: FileProviderPresence
supportedOS:
macOS:
introduced: '10.15'
type: <array>
presence: optional
content: Allows a File Provider application to know when the user is using files
managed by the File Provider.
subkeytype: Identity
subkeys: *id001
- key: ListenEvent
supportedOS:
macOS:
introduced: '10.15'
type: <array>
presence: optional
content: Allows the application to use CoreGraphics and HID APIs to listen to
(receive) CGEvents and HID events from all processes. Access to these events
cannot be given in a profile; it can only be denied.
subkeytype: Identity
subkeys: *id001
- key: ScreenCapture
supportedOS:
macOS:
introduced: '10.15'
type: <array>
presence: optional
content: Allows the application to capture (read) the contents of the system display.
Access to the contents cannot be given in a profile; it can only be denied.
subkeytype: Identity
subkeys: *id001
- key: SpeechRecognition
supportedOS:
macOS:
introduced: '10.15'
type: <array>
presence: optional
content: Allows the application to use the system Speech Recognition facility
and to send speech data to Apple.
subkeytype: Identity
subkeys: *id001
- key: SystemPolicyDesktopFolder
supportedOS:
macOS:
introduced: '10.15'
type: <array>
presence: optional
content: Allows the application to access files in the user's Desktop folder.
subkeytype: Identity
subkeys: *id001
- key: SystemPolicyDocumentsFolder
supportedOS:
macOS:
introduced: '10.15'
type: <array>
presence: optional
content: Allows the application to access files in the user's Documents folder.
subkeytype: Identity
subkeys: *id001
- key: SystemPolicyDownloadsFolder
supportedOS:
macOS:
introduced: '10.15'
type: <array>
presence: optional
content: Allows the application to access files in the user's Downloads folder.
subkeytype: Identity
subkeys: *id001
- key: SystemPolicyNetworkVolumes
supportedOS:
macOS:
introduced: '10.15'
type: <array>
presence: optional
content: Allows the application to access files on network volumes.
subkeytype: Identity
subkeys: *id001
- key: SystemPolicyRemovableVolumes
supportedOS:
macOS:
introduced: '10.15'
type: <array>
presence: optional
content: Allows the application to access files on removable volumes.
subkeytype: Identity
subkeys: *id001
mdm/profiles/com.apple.airplay.security.yaml
+46
View File
@@ -0,0 +1,46 @@
title: AirPlay Security
description: AirPlay Security settings
payload:
payloadtype: com.apple.airplay.security
supportedOS:
tvOS:
introduced: '11.0'
supervised: false
allowmanualinstall: true
content: Manages the AirPlay Security settings on Apple TV (Settings > AirPlay >
Security). Use this payload to lock Apple TV to a particular style of AirPlay
security. The setting can enable/disable an on-screen passcode, or require a specific
password phrase.
payloadkeys:
- key: SecurityType
title: Security Type
type: <string>
presence: required
rangelist:
- PASSCODE_ONCE
- PASSCODE_ALWAYS
- PASSWORD
content: |-
The security policy for AirPlay.
'PASSCODE_ONCE' requires an onscreen passcode on first connection from a device. Subsequent connections from the same device aren't prompted.
'PASSCODE_ALWAYS' requires an onscreen passcode for every AirPlay connection. After an AirPlay connection ends, reconnecting within 30 seconds is allowed without a password.
'PASSWORD' requires a passphrase as specified in the 'Password' key.
'NONE' was deprecated in tvOS 11.3. Existing profiles using 'NONE' get the 'PASSWORD_ONCE' behavior.
- key: AccessType
title: Access Type
type: <string>
presence: required
rangelist:
- ANY
- WIFI_ONLY
content: |-
The access policy for AirPlay.
'ANY' allows connections from both Ethernet/WiFi and Apple Wireless Direct Link.
'WIFI_ONLY' allows connections only from devices on the same Ethernet/WiFi network as Apple TV.
- key: Password
title: Password
type: <string>
presence: optional
content: The AirPlay password; required if SecurityType is 'PASSWORD'.
mdm/profiles/com.apple.airplay.yaml
+115
View File
@@ -0,0 +1,115 @@
title: AirPlay
description: AirPlay settings
payload:
payloadtype: com.apple.airplay
supportedOS:
iOS:
introduced: '7.0'
supervised: false
allowmanualinstall: true
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '10.10'
devicechannel: true
userchannel: true
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: allowed
content: macOS supports more than one payload, iOS does not. Supported on the user
channel for macOS only.
payloadkeys:
- key: AllowList
title: AllowList
supportedOS:
iOS:
introduced: '14.5'
supervised: true
userenrollment:
mode: forbidden
macOS:
introduced: '11.3'
userenrollment:
mode: ignored
type: <array>
presence: optional
content: If present, only AirPlay destinations in this list are available to the
device. This allow list applies to supervised devices.
subkeys: &id001
- key: AllowListItem
title: AllowList Content Item
supportedOS:
iOS:
introduced: '7.0'
supervised: true
userenrollment:
mode: forbidden
macOS:
introduced: '10.10'
userenrollment:
mode: ignored
type: <dictionary>
presence: required
subkeys:
- key: DeviceID
title: Device ID
type: <string>
presence: required
format: ^([0-9A-Fa-f]{2}:){5}([0-9A-Fa-f]{2})$
content: The device ID of the AirPlay destination in the format 'xx:xx:xx:xx:xx:xx'.
This field isn't case-sensitive.
- key: Passwords
title: Passwords
type: <array>
presence: optional
content: |-
If present, sets passwords for known AirPlay destinations.
Using multiple entries for the same destination, whether within the same payload or across multiple installed payloads, is an error and results in undefined behavior.
subkeys:
- key: PasswordsItem
title: Password Content Item
type: <dictionary>
presence: required
subkeys:
- key: DeviceName
title: Device Name
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: required
content: The name of the AirPlay destination; used in iOS.
- key: Password
title: Password
type: <string>
presence: required
content: The password for the AirPlay destination.
- key: DeviceID
supportedOS:
iOS:
introduced: n/a
type: <string>
presence: required
content: The device ID of the AirPlay destination; used in macOS.
- key: Whitelist
title: Whitelist
supportedOS:
iOS:
deprecated: '14.5'
supervised: true
userenrollment:
mode: forbidden
macOS:
deprecated: '11.3'
userenrollment:
mode: ignored
type: <array>
presence: optional
content: Use 'AllowList' instead. As of macOS 11.3 and iOS 14.5 this key is deprecated.
subkeys: *id001
mdm/profiles/com.apple.airprint.yaml
+82
View File
@@ -0,0 +1,82 @@
title: AirPrint
description: Use this section to define settings for AirPrint.
payload:
payloadtype: com.apple.airprint
supportedOS:
iOS:
introduced: '7.0'
supervised: false
allowmanualinstall: true
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '10.10'
devicechannel: true
userchannel: true
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: allowed
payloadkeys:
- key: AirPrint
title: Air print
type: <array>
presence: required
content: An array of AirPrint printers that are presented to the user.
subkeys:
- key: AirPrintItem
title: Identifier
type: <dictionary>
subkeys:
- key: IPAddress
title: IP Address
supportedOS:
iOS:
introduced: '7.0'
type: <string>
presence: required
content: The IP address or hostname of the AirPrint destination.
- key: ResourcePath
title: Resource Path
supportedOS:
iOS:
introduced: '7.0'
type: <string>
presence: required
content: |-
The resource path associated with the printer. This path corresponds to the 'rp' parameter of the '_ipps.tcp' Bonjour record. For example:
* 'printers/Canon_MG5300_series'
* 'printers/Xerox_Phaser_7600'
* 'ipp/print'
* 'Epson_IPP_Printer'
- key: Port
title: Port Number
supportedOS:
iOS:
introduced: '11.0'
macOS:
introduced: n/a
type: <integer>
presence: optional
range:
min: 0
max: 65535
content: The listening port of the AirPrint destination. Available only in iOS
11 and later.
- key: ForceTLS
title: Force TLS
supportedOS:
iOS:
introduced: '11.0'
macOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', AirPrint connections are secured by Transport Layer Security
(TLS). Available only in iOS 11 and later.
mdm/profiles/com.apple.apn.managed.yaml
+64
View File
@@ -0,0 +1,64 @@
title: APN
description: ''
payload:
payloadtype: com.apple.apn.managed
supportedOS:
iOS:
introduced: '4.0'
deprecated: '7.0'
supervised: false
allowmanualinstall: true
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
content: |-
Not supported in macOS.
This technically does install on watchOS but we are removing the supportedOS dictionary. The cellular payload should be used instead.
Only applies to the preferred data SIM.
Deprecated. Use Cellular instead.
payloadkeys:
- key: DefaultsData
type: <dictionary>
presence: required
content: The list of access point names (APNs).
subkeys:
- key: apns
type: <array>
presence: required
content: An array of APN dictionaries (`APN.DefaultsData.Apns`).
subkeys:
- key: apnsItem
type: <dictionary>
subkeys:
- key: apn
type: <string>
presence: required
content: This string specifies the Access Point Name.
- key: username
type: <string>
presence: optional
content: This string specifies the user name for this APN. If it is missing,
the device prompts for it during profile installation.
- key: password
type: <data>
presence: optional
content: This data represents the password for the user for this APN. For
obfuscation purposes, the password is encoded. If it is missing from the
payload, the device prompts for the password during profile installation.
- key: proxy
type: <string>
presence: optional
content: The IP address or URL of the APN proxy.
- key: proxyPort
type: <integer>
presence: optional
content: The port number of the APN proxy.
- key: DefaultsDomainName
type: <string>
presence: required
rangelist:
- com.apple.managedCarrier
content: The domain name.

Some files were not shown because too many files have changed in this diff Show More