mirror of
https://github.com/apple/device-management.git
synced 2026-08-27 18:40:23 +02:00
Release_iOS-15_macOS-12
This commit is contained in:
Cyrus Daboo
@@ -0,0 +1,70 @@
|
||||
title: Common Payload Keys
|
||||
description: Payload dictionary keys common to all payload types
|
||||
payload:
|
||||
payloadtype: CommonPayloadKeys
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
tvOS:
|
||||
introduced: '5.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
watchOS:
|
||||
introduced: '1.0'
|
||||
allowmanualinstall: true
|
||||
payloadkeys:
|
||||
- key: PayloadIdentifier
|
||||
type: <string>
|
||||
presence: required
|
||||
content: |-
|
||||
The reverse-DNS-style identifier for the payload. This identifier is usually the same as the TopLevel value, with an additional appended component. This string must be unique within the profile.
|
||||
During a profile replacement, the system updates payloads with the same 'PayloadIdentifier' and 'PayloadUUID' in the old and new profiles.
|
||||
- key: PayloadUUID
|
||||
type: <string>
|
||||
presence: required
|
||||
content: |-
|
||||
The globally unique identifier for the payload. The actual content is unimportant, but must be globally unique. In macOS, use 'uuidgen' to generate UUIDs.
|
||||
During a profile replacement, the system updates payloads with the same 'PayloadIdentifier' and 'PayloadUUID' in the old and new profiles.
|
||||
- key: PayloadType
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The payload type, which each payload domain's reference page specifies.
|
||||
- key: PayloadVersion
|
||||
type: <integer>
|
||||
presence: required
|
||||
rangelist:
|
||||
- 1
|
||||
content: The version of this specific payload.
|
||||
- key: PayloadDescription
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The human-readable description of this payload. This description appears
|
||||
on the Detail screen.
|
||||
- key: PayloadDisplayName
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The human-readable name for the profile payload. The name appears on the
|
||||
Detail screen and doesn't need to be unique.
|
||||
- key: PayloadOrganization
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The human-readable string containing the name of the organization that
|
||||
provides the profile. This value doesn't need to match the organization payload
|
||||
value in the enclosing dictionary.
|
||||
@@ -0,0 +1,27 @@
|
||||
title: Global Preferences
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: .GlobalPreferences
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Global preferences on macOS
|
||||
payloadkeys:
|
||||
- key: MultipleSessionEnabled
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', disables fast user switching.
|
||||
- key: com.apple.autologout.AutoLogOutDelay
|
||||
type: <real>
|
||||
presence: optional
|
||||
content: The 'autologout' delay, in seconds. A value of '0' means 'autologout' is
|
||||
off. In some cases, this delay may be restricted to values between 5 minutes and
|
||||
24 hours.
|
||||
@@ -0,0 +1,205 @@
|
||||
title: Top Level
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: TopLevel
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
tvOS:
|
||||
introduced: '5.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
watchOS:
|
||||
introduced: '1.0'
|
||||
allowmanualinstall: true
|
||||
payloadkeys:
|
||||
- key: PayloadIdentifier
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The reverse-DNS style identifier ('com.example.myprofile', for example)
|
||||
that identifies the profile. This string is used to determine whether a new profile
|
||||
should replace an existing one or should be added.
|
||||
- key: PayloadUUID
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The globally unique identifier for the profile. The actual content is unimportant.
|
||||
In macOS, you can use 'uuidgen' to generate reasonable UUIDs.
|
||||
- key: PayloadType
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- Configuration
|
||||
content: The type of payload. The only supported value is 'Configuration'.
|
||||
- key: PayloadVersion
|
||||
type: <integer>
|
||||
presence: required
|
||||
rangelist:
|
||||
- 1
|
||||
content: The version number of the profile format. This number represents the version
|
||||
of the configuration profile as a whole, not of the individual profiles within
|
||||
it. The value should be 1.
|
||||
- key: IsEncrypted
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: Set to 'true' if the profile is encrypted.
|
||||
- key: PayloadContent
|
||||
type: <array>
|
||||
presence: required
|
||||
content: The array of payload dictionaries. If 'IsEncrypted' is 'true', this array
|
||||
isn't needed.
|
||||
subkeys:
|
||||
- key: PayloadContentItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: ANY
|
||||
type: <any>
|
||||
presence: required
|
||||
content: A payload item as defined by each payload type.
|
||||
- key: EncryptedPayloadContent
|
||||
type: <data>
|
||||
presence: optional
|
||||
content: Enabled if 'IsEncrypted' is 'true'.
|
||||
- key: PayloadDescription
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The description of the profile, shown on the Detail screen for the profile.
|
||||
This description should be detailed enough to help the user decide whether to
|
||||
install the profile.
|
||||
- key: PayloadDisplayName
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The human-readable name for the profile. This value is displayed on the
|
||||
Detail screen. It doesn't have to be unique.
|
||||
- key: HasRemovalPasscode
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: Set to 'true' if there is a removal passcode.
|
||||
- key: PayloadOrganization
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The human-readable string containing the name of the organization that
|
||||
provided the profile.
|
||||
- key: PayloadRemovalDisallowed
|
||||
supportedOS:
|
||||
iOS:
|
||||
supervised: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
macOS:
|
||||
supervised: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
tvOS:
|
||||
supervised: true
|
||||
watchOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: |-
|
||||
If present and set to 'true', the user cannot delete the profile (unless the profile has a removal password and the user provides it).
|
||||
On macOS, as of 10.15, this key only affects removal of manually installed profiles. If set to 'true' and no profile removal payload is present, admin auth will be required to remove the profile.
|
||||
On macOS versions prior to 10.15, this key would prevent admins from removing MDM installed profiles but as of macOS 10.15, MDM profiles can never be removed by a user, not even the admin.
|
||||
- key: PayloadScope
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.8'
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- System
|
||||
- User
|
||||
content: A string that defines whether the profile should be installed for the system
|
||||
or the user. In many cases, it determines the location of certificate items, such
|
||||
as keychains. Though it isn't possible to declare different payload scopes, payloads,
|
||||
like VPN, may automatically install their items in both scopes, if needed.
|
||||
- key: RemovalDate
|
||||
type: <date>
|
||||
presence: optional
|
||||
content: The date when the profile is automatically removed.
|
||||
- key: DurationUntilRemoval
|
||||
type: <real>
|
||||
presence: optional
|
||||
content: The number of seconds until the profile is automatically removed. If the
|
||||
'RemovalDate' key is present, whichever field yields the earliest date is used.
|
||||
- key: PayloadExpirationDate
|
||||
supportedOS:
|
||||
watchOS:
|
||||
introduced: n/a
|
||||
type: <date>
|
||||
presence: optional
|
||||
content: The date when a profile is no longer valid and an update button is presented
|
||||
to the user.
|
||||
- key: TargetDeviceType
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.2'
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
tvOS:
|
||||
introduced: '12.2'
|
||||
watchOS:
|
||||
introduced: '5.2'
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 0
|
||||
- 1
|
||||
- 2
|
||||
- 3
|
||||
- 4
|
||||
- 5
|
||||
default: 0
|
||||
content: |-
|
||||
The type of platform of the target device. Specifying the platform type helps prevent unintended installations.
|
||||
For interactive installations on iOS devices, specifying a target platform avoids the interstitial alerts that prompt the user to choose a profile target when multiple targets are eligible.
|
||||
0 = Any/unspecified
|
||||
1 = iPhone/iPad/iPod Touch
|
||||
2 = Apple Watch
|
||||
3 = HomePod
|
||||
4 = Apple TV
|
||||
5 = Mac
|
||||
- key: ConsentText
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: |-
|
||||
A dictionary containing a key that consists of the IETF BCP 47 identifier for a language (for example, en or jp) and a value consisting of the agreement localized to that language. The agreement is displayed in a dialog, and the user must agree before installing the profile.
|
||||
|
||||
The dictionary can also contain an optional key, 'default', with its value consisting of the unlocalized (usually in en) agreement.
|
||||
|
||||
The system chooses a localized version in the order of preference specified by the user (macOS) or based on the user's current language setting (iOS). If no exact match is found, the default localization is used. If there is no default localization, the en localization is used. If there is no en localization, the first available localization is used.
|
||||
|
||||
Provide a default value, if possible. No warning is displayed if the user's locale doesn't match any localization in the 'ConsentText' dictionary.
|
||||
subkeys:
|
||||
- key: ConsentTextItem
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: The dictionary containing a key that consists of the IETF BCP 47 identifier
|
||||
for a language (for example, en or jp) and a value that consists of the agreement
|
||||
localized to that language.
|
||||
subkeys:
|
||||
- key: ANY
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The key consisting of the IETF BCP 47 identifier for a language (for
|
||||
example, en or jp) and the value consisting of the agreement localized to
|
||||
that language.
|
||||
@@ -0,0 +1,118 @@
|
||||
title: Active Directory Certificate
|
||||
description: Active Directory Certificate
|
||||
payload:
|
||||
payloadtype: com.apple.ADCertificate.managed
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: A certificate can be requested from a Microsoft Certificate Authority (CA)
|
||||
using DCE/RPC and the Active Directory Certificate profile payload instructions
|
||||
detailed at support.apple.com/kb/HT5357.
|
||||
payloadkeys:
|
||||
- key: CertServer
|
||||
title: Certificate Server
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The fully qualified host name of the CA.
|
||||
- key: CertTemplate
|
||||
title: Certificate Template
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The certificate template for your environment. The default user certificate
|
||||
value is `User`. The default computer certificate value is `Machine`.
|
||||
- key: Description
|
||||
title: Description
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: A user-friendly description of the certification identity.
|
||||
- key: CertificateRenewalTimeInterval
|
||||
title: Certificate Renewal Time Interval
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The number of days in advance of certificate expiration that the notification
|
||||
center notifies the user.
|
||||
- key: CertificateAuthority
|
||||
title: Certificate Authority
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.8'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The name of the certificate authority (CA). This value is determined from the common name (CN) of the Active Directory entry. Available in macOS 10.8 and later.
|
||||
|
||||
Valid values:
|
||||
* CN=<your CA Name>
|
||||
* CN='Certification Authorities'
|
||||
* CN='Public Key Services'
|
||||
* ''CN='Services'
|
||||
* ''CN='Configuration'
|
||||
* ''CN=<your base Domain Name>
|
||||
- key: CertificateAcquisitionMechanism
|
||||
title: Certificate Acquisition Mechanism
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.8'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: This value is most commonly 'RPC'; if using web enrollment, use 'HTTP'.
|
||||
Available in macOS 10.8 and later.
|
||||
- key: AllowAllAppsAccess
|
||||
title: Allow All Apps Access
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', gives apps access to the private key. Available in macOS 10.10
|
||||
and later.
|
||||
- key: PromptForCredentials
|
||||
title: Prompt For Credentials
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.8'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the user is prompted for credentials when the profile is installed.
|
||||
This key applies only to user certificates with the Manual Download profile delivery
|
||||
method. Omit this key for computer certificates. Available in macOS 10.8 and later.
|
||||
- key: KeyIsExtractable
|
||||
title: Key Is Extractable
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', allows exporting the private key. Available in macOS 10.10 and
|
||||
later.
|
||||
- key: Keysize
|
||||
title: Key Size
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.11'
|
||||
type: <integer>
|
||||
presence: optional
|
||||
default: 2048
|
||||
content: The RSA key size for the certificate signing request (CSR). Available in
|
||||
macOS 10.11 and later.
|
||||
- key: EnableAutoRenewal
|
||||
title: Key Size
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the certificate obtained with this payload attempts auto-renewal.
|
||||
Auto-renewal can only be used with device Active Directory certificate payloads.
|
||||
Available in macOS 10.13.4 and later.
|
||||
@@ -0,0 +1,62 @@
|
||||
title: AIM Account
|
||||
description: Use this section to define settings for configuration access to AIM servers.
|
||||
payload:
|
||||
payloadtype: com.apple.AIM.account
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
deprecated: '10.13'
|
||||
removed: '10.14'
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: An AIM payload creates an AIM account on the device.
|
||||
payloadkeys:
|
||||
- key: AIMAccountDescription
|
||||
title: Account Description
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The description of the account.
|
||||
- key: AIMHostName
|
||||
title: Account Hostname
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- slogin.oscar.aol.com
|
||||
content: The server address.
|
||||
- key: AIMUserName
|
||||
title: Account Username
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user's login name.
|
||||
- key: AIMPassword
|
||||
title: Account Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user's password.
|
||||
- key: AIMUseSSL
|
||||
title: Use SSL
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', enables SSL.
|
||||
- key: AIMPort
|
||||
title: Port Number
|
||||
type: <integer>
|
||||
presence: optional
|
||||
range:
|
||||
min: 0
|
||||
max: 65535
|
||||
default: 5190
|
||||
content: The connection port for the server.
|
||||
- key: AIMAuthentication
|
||||
title: AIM Authentification
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- AIMAuthPassword
|
||||
content: The authentication method for the account.
|
||||
@@ -0,0 +1,288 @@
|
||||
title: Content Caching
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.AssetCache.managed
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Configures the Content Caching service.
|
||||
payloadkeys:
|
||||
- key: AllowCacheDelete
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: |-
|
||||
Allow the system to purge content from the cache automatically when it needs disk space for other apps (i.e. when free disk space runs low on the computer). Customers who want Content Caching to be as effective as possible should turn this setting off.
|
||||
Available in macOS 10.15 and later.
|
||||
- key: AllowPersonalCaching
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: |-
|
||||
If 'true', caches the user's iCloud data. Clients may take some time (hours or days) to react to changes to this setting; it doesn't have an immediate effect.
|
||||
|
||||
At least one of the 'AllowPersonalCaching' or 'AllowSharedCaching' keys must be 'true'.
|
||||
- key: AllowSharedCaching
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: |-
|
||||
If 'true', caches non-iCloud content, such as apps and software updates. Clients may take some time (hours, days) to react to changes to this setting; it does not have an immediate effect.
|
||||
|
||||
At least one of the 'AllowPersonalCaching' or 'AllowSharedCaching' keys must be 'true'.
|
||||
- key: AutoActivation
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: |-
|
||||
If 'true', automatically activates the content cache when possible and prevents it from being disabled. If the 'allowContentCaching' restriction is set to 'false', 'AutoActivation' is also 'false'.
|
||||
Removing a profile that set 'AutoActivation' to 'true' does not deactivate the Content Cache.
|
||||
- key: AutoEnableTetheredCaching
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.15.4
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: |-
|
||||
Automatically enable Internet connection sharing when possible and prevent disabling Internet connection sharing. 'DenyTetheredCaching' overrides 'AutoEnableTetheredCaching'. Tethered caching requires Content Caching.
|
||||
Available in macOS 10.15.4 and later.
|
||||
- key: CacheLimit
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <integer>
|
||||
presence: optional
|
||||
default: 0
|
||||
content: The maximum number of bytes of disk space that will be used for the content
|
||||
cache. A value of 0 means unlimited disk space.
|
||||
- key: DataPath
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <string>
|
||||
presence: optional
|
||||
default: /Library/Application Support/Apple/AssetCache/Data
|
||||
content: |-
|
||||
The path to the directory used to store cached content. Changing this setting manually doesn't automatically move cached content from the old location to the new one. To move content automatically, use the Sharing preference's Content Caching pane. The value must be (or end with) '/Library/Application Support/Apple/AssetCache/Data'.
|
||||
|
||||
A directory and its intermediates are created for the given data path if it doesn't already exist. The directory is owned by '_assetcache:_assetcache' and has mode 0750. Its immediate parent directory ('.../Library/Application Support/Apple/AssetCache') is owned by '_assetcache:_assetcache' and has mode '0755'.
|
||||
- key: DenyTetheredCaching
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables tethered caching.
|
||||
- key: DisplayAlerts
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: |-
|
||||
If 'true', Content Caching displays exceptional conditions (alerts) as system notifications in the upper corner of the screen. Alerts were automatically displayed starting in macOS 10.13. In macOS 10.15 the alerts are off by default, but still available via this setting.
|
||||
Available in macOS 10.15 and later.
|
||||
- key: KeepAwake
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: |-
|
||||
If 'true', prevents the computer from sleeping as long as Content Caching is on (System Preferences > Sharing > Content Caching is on). Customers who want Content Caching to be as available as musch as possible should turn this setting on.
|
||||
Available in macOS 10.15 and later.
|
||||
- key: ListenRanges
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of dictionaries describing a range of client IP addresses to serve.
|
||||
subkeytype: Ranges
|
||||
subkeys: &id001
|
||||
- key: RangesItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: type
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- IPv4
|
||||
- IPv6
|
||||
default: IPv4
|
||||
content: The IP address type.
|
||||
- key: first
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The first IP address in the range.
|
||||
- key: last
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The last IP address in the range.
|
||||
- key: ListenRangesOnly
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the content cache provides content to the clients in the 'ListenRanges'.
|
||||
- key: ListenWithPeersAndParents
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', the content cache provides content to the clients in the union
|
||||
of the 'ListenRanges', 'PeerListenRanges' and 'Parents'.
|
||||
- key: LocalSubnetsOnly
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', the content cache offers content to clients only on the same
|
||||
immediate local network only. No content is offered to clients on other networks
|
||||
reachable by the content cache. If 'LocalSubnetsOnly' is set to 'true', 'ListenRanges'
|
||||
will be ignored.
|
||||
- key: LogClientIdentity
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the Content Cache logs the IP address and port number of the
|
||||
clients that request content.
|
||||
- key: Parents
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of the local IP addresses of other content caches that this cache
|
||||
should download from or upload to, instead of downloading from or uploading to
|
||||
Apple directly. Invalid addresses and addresses of computers that aren't content
|
||||
caches are ignored. Parent caches that become unavailable are skipped. If all
|
||||
parent content caches become unavailable, the content cache downloads from or
|
||||
uploads to Apple directly, until a parent content cache becomes available again.
|
||||
subkeys:
|
||||
- key: ParentsItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: An IP address.
|
||||
- key: ParentSelectionPolicy
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- first-available
|
||||
- url-path-hash
|
||||
- random
|
||||
- round-robin
|
||||
- sticky-available
|
||||
default: round-robin
|
||||
content: |-
|
||||
The policy to implement when choosing among more than one configured parent content cache. With every policy, parent caches that are temporarily unavailable are skipped.
|
||||
|
||||
'first-available': Always use the first available parent in the Parents list. Use this policy to designate permanent primary, secondary, and subsequent parents.
|
||||
|
||||
'url-path-hash': Hash the path part of the requested URL so that the same parent is always used for the same URL. This is useful for maximizing the size of the combined caches of the parents.
|
||||
|
||||
'random': Choose a parent at random. Use this policy for load balancing.
|
||||
|
||||
'round-robin': Rotate through the parents in order. Use this policy for load balancing.
|
||||
|
||||
'sticky-available': Use the first available parent that is available in the Parents list until it becomes unavailable, then advance to the next one. Use this policy for designating floating primary, secondary, and subsequent parents.
|
||||
- key: PeerFilterRanges
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of dictionaries describing a range of peer IP addresses that the
|
||||
content cache uses to filter its list of peers to query for content. The content
|
||||
cache only queries peers in 'PeerFilterRanges'. When 'PeerFilterRanges' is an
|
||||
empty array, the content cache doesn't query any peers.
|
||||
subkeytype: Ranges
|
||||
subkeys: *id001
|
||||
- key: PeerListenRanges
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of dictionaries describing a range of peer IP addresses the content
|
||||
cache responds to. When 'PeerListenRanges' is an empty array, the content cache
|
||||
responds with an error to all cache queries.
|
||||
subkeytype: Ranges
|
||||
subkeys: *id001
|
||||
- key: PeerLocalSubnetsOnly
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', the content cache only peers with other content caches on the
|
||||
same immediate local network, rather than with content caches that use the same
|
||||
public IP address as the device. When 'PeerLocalSubnetsOnly' is 'true', it overrides
|
||||
the configuration of 'PeerFilterRanges' and 'PeerListenRanges'. If the network
|
||||
changes, the local network peering restrictions update appropriately. If 'false',
|
||||
the content cache defers to 'PeerFilterRanges' and 'PeerListenRanges' for configuring
|
||||
the peering restrictions.
|
||||
- key: Port
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <integer>
|
||||
presence: optional
|
||||
default: 0
|
||||
content: The TCP port number on which the content cache accepts requests for uploads
|
||||
or downloads. Set the port to 0 to pick a random, available port.
|
||||
- key: PublicRanges
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of dictionaries describing a range of public IP addresses that
|
||||
the cloud servers should use for matching clients to content caches.
|
||||
subkeytype: Ranges
|
||||
subkeys: *id001
|
||||
@@ -0,0 +1,20 @@
|
||||
title: 'Parental Controls: Dictionary'
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.Dictionary
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Parental controls dictionary restrictions.
|
||||
payloadkeys:
|
||||
- key: parentalControl
|
||||
type: <boolean>
|
||||
presence: required
|
||||
content: If 'true', enables parental controls dictionary restrictions.
|
||||
@@ -0,0 +1,265 @@
|
||||
title: Directory Service
|
||||
description: Directory Service
|
||||
payload:
|
||||
payloadtype: com.apple.DirectoryService.managed
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.8'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: In macOS 10.9 and later, a configuration profile can be used to configure
|
||||
macOS to join an Active Directory (AD) domain. Advanced AD options available via
|
||||
Directory Utility or the dsconfigad command line tool can also be set using a
|
||||
configuration profile.
|
||||
payloadkeys:
|
||||
- key: HostName
|
||||
title: HostName
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The Active Directory domain to join.
|
||||
- key: UserName
|
||||
title: UserName
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user name of the account for the domain.
|
||||
- key: Password
|
||||
title: Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The password of the account for the domain.
|
||||
- key: ClientID
|
||||
title: Client ID
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The client's identifier.
|
||||
- key: Description
|
||||
title: Description
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The directory service description.
|
||||
- key: ADOrganizationalUnit
|
||||
title: ADOrganizationalUnit
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The organizational unit where the joining computer object is added.
|
||||
- key: ADMountStyle
|
||||
title: ADMountStyle
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: 'The network home protocol to use: ''afp'' or ''smb''.'
|
||||
- key: ADCreateMobileAccountAtLoginFlag
|
||||
title: ADCreateMobileAccountAtLoginFlag
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the 'ADCreateMobileAccountAtLogin' key.
|
||||
- key: ADCreateMobileAccountAtLogin
|
||||
title: ADCreateMobileAccountAtLogin
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', creates a mobile account at login.
|
||||
- key: ADWarnUserBeforeCreatingMAFlag
|
||||
title: ADWarnUserBeforeCreatingMAFlag
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the 'ADWarnUserBeforeCreatingMA' key.
|
||||
- key: ADWarnUserBeforeCreatingMA
|
||||
title: ADWarnUserBeforeCreatingMA
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the warning before creating the mobile account.
|
||||
- key: ADForceHomeLocalFlag
|
||||
title: ADForceHomeLocalFlag
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the 'ADForceHomeLocal' key.
|
||||
- key: ADForceHomeLocal
|
||||
title: ADForceHomeLocal
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', forces a local home directory.
|
||||
- key: ADUseWindowsUNCPathFlag
|
||||
title: ADUseWindowsUNCPathFlag
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the 'ADUseWindowsUNCPath' key.
|
||||
- key: ADUseWindowsUNCPath
|
||||
title: ADUseWindowsUNCPath
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', uses the UNC path from Active Directory to derive the network
|
||||
home location.
|
||||
- key: ADAllowMultiDomainAuthFlag
|
||||
title: ADAllowMultiDomainAuthFlag
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the 'ADAllowMultiDomainAuth' key.
|
||||
- key: ADAllowMultiDomainAuth
|
||||
title: ADAllowMultiDomainAuth
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', allows authentication from any domain in the namespace.
|
||||
- key: ADDefaultUserShellFlag
|
||||
title: ADDefaultUserShellFlag
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the 'ADDefaultUserShell' key.
|
||||
- key: ADDefaultUserShell
|
||||
title: ADDefaultUserShell
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The default user shell.
|
||||
- key: ADMapUIDAttributeFlag
|
||||
title: ADMapUIDAttributeFlag
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the 'ADMapUIDAttribute' key.
|
||||
- key: ADMapUIDAttribute
|
||||
title: ADMapUIDAttribute
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The map UID to attribute.
|
||||
- key: ADMapGIDAttributeFlag
|
||||
title: ADMapGIDAttributeFlag
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the 'ADMapGIDAttribute' key.
|
||||
- key: ADMapGIDAttribute
|
||||
title: ADMapGIDAttribute
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The map GID to attribute.
|
||||
- key: ADMapGGIDAttributeFlag
|
||||
title: ADMapGGIDAttributeFlag
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the 'ADMapGGIDAttributeFlag' key.
|
||||
- key: ADMapGGIDAttribute
|
||||
title: ADMapGGIDAttribute
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The map group GID to attribute.
|
||||
- key: ADPreferredDCServerFlag
|
||||
title: ADPreferredDCServerFlag
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the 'ADPreferredDCServer' key.
|
||||
- key: ADPreferredDCServer
|
||||
title: ADPreferredDCServer
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The preferred domain server.
|
||||
- key: ADDomainAdminGroupListFlag
|
||||
title: ADDomainAdminGroupListFlag
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the 'ADDomainAdminGroupList' key.
|
||||
- key: ADDomainAdminGroupList
|
||||
title: ADDomainAdminGroupList
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The list of Active Directory groups that are granted admin access.
|
||||
subkeys:
|
||||
- key: ADDomainAdminGroupListItem
|
||||
type: <string>
|
||||
- key: ADNamespaceFlag
|
||||
title: ADNamespaceFlag
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the 'ADNamespace' key.
|
||||
- key: ADNamespace
|
||||
title: ADNamespace
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The primary user account naming convention; either 'forest' or 'domain'.
|
||||
- key: ADPacketSignFlag
|
||||
title: ADPacketSignFlag
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.8'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the 'ADPacketSign' key.
|
||||
- key: ADPacketSign
|
||||
title: ADPacketSign
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The packet signing policy.
|
||||
- key: ADPacketEncryptFlag
|
||||
title: ADPacketEncryptFlag
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the 'ADPacketEncrypt' key.
|
||||
- key: ADPacketEncrypt
|
||||
title: ADPacketEncrypt
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The packet encryption policy.
|
||||
- key: ADRestrictDDNSFlag
|
||||
title: ADRestrictDDNSFlag
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the 'ADRestrictDDNS' key.
|
||||
- key: ADRestrictDDNS
|
||||
title: ADRestrictDDNS
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.8'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of strings representing the interfaces that are allowed for dynamic
|
||||
DNS updates (for example, en0, en1, and so on).
|
||||
subkeys:
|
||||
- key: ADRestrictDDNSItem
|
||||
type: <string>
|
||||
- key: ADTrustChangePassIntervalDaysFlag
|
||||
title: ADTrustChangePassIntervalDaysFlag
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If true, enables the 'ADTrustChangePassIntervalDays 'key.
|
||||
- key: ADTrustChangePassIntervalDays
|
||||
title: ADTrustChangePassIntervalDays
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The number of days before requiring a change of the computer trust account
|
||||
password. '0' disables the feature.
|
||||
@@ -0,0 +1,28 @@
|
||||
title: 'Media Management: Disc Burning'
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.DiscRecording
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: BurnSupport
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- 'off'
|
||||
- authenticate
|
||||
- 'on'
|
||||
content: |-
|
||||
If 'off', disables disc burning.
|
||||
|
||||
If 'on', allows normal default operation. Setting this key to 'on' doesn't enable disc burn support if it has already been disabled by other mechanisms or preferences. It also must be enabled with the Finder profile.
|
||||
|
||||
If 'authenticate', requires authentication.
|
||||
@@ -0,0 +1,32 @@
|
||||
title: Accounts
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.MCX
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: EnableGuestAccount
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables the guest account.
|
||||
- key: DisableGuestAccount
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the guest account. This property has no effect if 'EnableGuestAccount'
|
||||
is 'true'.
|
||||
@@ -0,0 +1,154 @@
|
||||
title: Energy Saver
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.MCX
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: com.apple.EnergySaver.desktop.ACPower
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The settings for a desktop computer.
|
||||
subkeytype: PowerSettings
|
||||
subkeys: &id001
|
||||
- key: Display Sleep Timer
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 0
|
||||
range:
|
||||
min: 1
|
||||
max: 180
|
||||
content: The display sleep time, in minutes. A value of 0 means never.
|
||||
- key: Disk Sleep Timer
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 0
|
||||
range:
|
||||
min: 1
|
||||
max: 180
|
||||
content: The disk sleep time, in minutes. A value of 0 means never.
|
||||
- key: System Sleep Timer
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 0
|
||||
range:
|
||||
min: 1
|
||||
max: 180
|
||||
content: System sleep time, in minutes. A value of 0 means never.
|
||||
- key: Reduce Processor Speed
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 0
|
||||
- 1
|
||||
content: May not be available on all systems.
|
||||
- key: Dynamic Power Step
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 0
|
||||
- 1
|
||||
content: May not be available on all systems.
|
||||
- key: Wake on LAN
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 0
|
||||
- 1
|
||||
content: If 'true', enables 'Wake for network access.'
|
||||
- key: Wake On Modem Ring
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 0
|
||||
- 1
|
||||
content: If 'true', enables 'Wake for modem ring.'
|
||||
- key: Automatic Restart On Power Loss
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 0
|
||||
- 1
|
||||
content: If 'true', enables 'Start up automatically after a power failure.'
|
||||
- key: com.apple.EnergySaver.portable.ACPower
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The settings for a laptop computer using AC power.
|
||||
subkeytype: PowerSettings
|
||||
subkeys: *id001
|
||||
- key: com.apple.EnergySaver.portable.BatteryPower
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The settings for a laptop computer using battery power.
|
||||
subkeytype: PowerSettings
|
||||
subkeys: *id001
|
||||
- key: com.apple.EnergySaver.desktop.Schedule
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The schedule for turning a computer on and off.
|
||||
subkeytype: EnergySaver Schedule
|
||||
subkeys:
|
||||
- key: RepeatingPowerOn
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The schedule for turning the device on.
|
||||
subkeytype: RepeatingPowerItem
|
||||
subkeys: &id002
|
||||
- key: eventtype
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- wake
|
||||
- poweron
|
||||
- wakepoweron
|
||||
- sleep
|
||||
- shutdown
|
||||
- restart
|
||||
content: The type of action defined by this schedule.
|
||||
- key: weekdays
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: |-
|
||||
One or more days of the week in an unsigned integer bitmap:
|
||||
* '1' = Mon
|
||||
* '2' = Tue
|
||||
* '4' = Wed
|
||||
* '8' = Thu
|
||||
* '16' = Fri
|
||||
* '32' = Sat
|
||||
* '64' = Sun
|
||||
- key: time
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The time, in minutes, since midnight.
|
||||
- key: RepeatingPowerOff
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The schedule for turning the device off.
|
||||
subkeytype: RepeatingPowerItem
|
||||
subkeys: *id002
|
||||
- key: SleepDisabled
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables sleep.
|
||||
- key: DestroyFVKeyOnStandby
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', prevents the OS from storing a temporary FileVault key in SMC
|
||||
or RAM for standby.
|
||||
@@ -0,0 +1,34 @@
|
||||
title: FDE FileVault Options
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.MCX
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: The FileVault accounts payload sets up options for enabling FileVault.
|
||||
payloadkeys:
|
||||
- key: dontAllowFDEDisable
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: Set to 'true' to prevent FileVault from being disabled.
|
||||
- key: dontAllowFDEEnable
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: Set to 'true' to prevent FileVault from being enabled.
|
||||
- key: DestroyFVKeyOnStandby
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: Set to 'true' to prevent storing the FileVault key across restarts.
|
||||
@@ -0,0 +1,47 @@
|
||||
title: Mobile Accounts
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.MCX
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Sets up mobile account options for network based user accounts.
|
||||
payloadkeys:
|
||||
- key: com.apple.cachedaccounts.CreateAtLogin
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', creates the mobile account at login time.
|
||||
- key: com.apple.cachedaccounts.WarnOnCreate
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', asks the user if the mobile account should be created and allow
|
||||
the user to not create it.
|
||||
- key: cachedaccounts.WarnOnCreate.allowNever
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', allows the user to stop the prompts about mobile account creation
|
||||
every time the user logs in. This key is only valid if 'com.apple.cachedaccounts.WarnOnCreate'
|
||||
is set to 'true'.
|
||||
- key: cachedaccounts.expiry.delete.disusedSeconds
|
||||
type: <integer>
|
||||
presence: optional
|
||||
default: -1
|
||||
content: |-
|
||||
The minimum number of seconds a mobile account can exist before an automatic attempt is made to remove the mobile account.
|
||||
Set to '0' to try to remove it at next login or logout time. Set to '-1' to never try to remove the mobile account.
|
||||
- key: cachedaccounts.askForSecureTokenAuthBypass
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', bypasses the secure token authorization dialog. This dialog
|
||||
only appears on APFS volumes.
|
||||
@@ -0,0 +1,25 @@
|
||||
title: Time Server
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.MCX
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.12.4
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Settings for time zone and server
|
||||
payloadkeys:
|
||||
- key: timeServer
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The NTP server to connect to. Use commas to separate multiple time servers.
|
||||
- key: timeZone
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The time zone path location string in '/usr/share/zoneinfo/'; for example,
|
||||
'America/Denver' or 'Zulu'.
|
||||
@@ -0,0 +1,39 @@
|
||||
title: Wi-Fi Managed Settings
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.MCX
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: RequireAdminForIBSS
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If YES, requires administrator authorization to enable IBSS.
|
||||
- key: RequireAdminForAirPortNetworkChange
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If YES, requires administrator authorization for network changes.
|
||||
- key: RequireAdminToTurnAirPortOnOff
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If YES, requires administrator authorization to turn Wi-Fi on or off.
|
||||
@@ -0,0 +1,95 @@
|
||||
title: FDE FileVault
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.MCX.FileVault2
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: true
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: The FileVault payload only works on macOS to enable or disable FileVault.
|
||||
Starting with macOS 10.15, this payload requires UAMDM to enable FileVault.
|
||||
payloadkeys:
|
||||
- key: Enable
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- 'On'
|
||||
- 'Off'
|
||||
content: If 'true', enables FileVault.
|
||||
- key: Defer
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', defers enabling FileVault until the designated user logs out.
|
||||
For details, see 'fdesetup(8)'. The person enabling FileVault must be either a
|
||||
local user or a mobile account user.
|
||||
- key: UserEntersMissingInfo
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables a prompt for missing user name or password fields.
|
||||
- key: UseRecoveryKey
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', creates a personal recovery key and displays it to the user.
|
||||
- key: ShowRecoveryKey
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', prevents display of the personal recovery key to the user after
|
||||
FileVault is enabled.
|
||||
- key: OutputPath
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The path to the location where the recovery key and computer information
|
||||
property list are stored.
|
||||
- key: Certificate
|
||||
type: <data>
|
||||
presence: optional
|
||||
content: The DER-encoded certificate data if 'UseRecoveryKey' is enabled.
|
||||
- key: PayloadCertificateUUID
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The UUID of the payload within the same profile containing the asymmetric
|
||||
recovery key certificate payload.
|
||||
- key: Username
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user name of the Open Directory user to be added to FileVault.
|
||||
- key: Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The password of the Open Directory user to be added to FileVault. Use the
|
||||
'UserEntersMissingInfo' key if you want to prompt for this information.
|
||||
- key: UseKeychain
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true' and no certificate information is provided in this payload, the
|
||||
keychain created at '/Library/Keychains/FileVaultMaster.keychain' is used when
|
||||
the institutional recovery key is added.
|
||||
- key: DeferForceAtUserLoginMaxBypassAttempts
|
||||
type: <integer>
|
||||
presence: optional
|
||||
range:
|
||||
min: -1
|
||||
max: 9999
|
||||
content: The maximum number of times users can bypass enabling FileVault before
|
||||
being required to enable it to log in. If the value is '0', the user will be required
|
||||
to enabled FileVault the next time they attempt to log in. Setting this key to
|
||||
'–1' disables the feature.
|
||||
- key: DeferDontAskAtUserLogout
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', prevents requests for enabling FileVault at user logout time.
|
||||
@@ -0,0 +1,59 @@
|
||||
title: Time Machine
|
||||
payload:
|
||||
payloadtype: com.apple.MCX.TimeMachine
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: AutoBackup
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', performs automatic backups at regular intervals.
|
||||
- key: BackupAllVolumes
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If true, backs up only the startup volume by default.
|
||||
- key: BackupDestURL
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The URL of the backup destination.
|
||||
- key: BackupSizeMB
|
||||
type: <integer>
|
||||
presence: optional
|
||||
default: 0
|
||||
content: The backup size limit, in megabytes. Set to 0 for unlimited.
|
||||
- key: BackupSkipSys
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', skips system files and folders by default.
|
||||
- key: MobileBackups
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', create local backup snapshots when not connected to the network.
|
||||
- key: BasePaths
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The list of paths to back up besides the startup volume.
|
||||
subkeys:
|
||||
- key: BasePathItem
|
||||
type: <string>
|
||||
presence: required
|
||||
- key: SkipPaths
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The path to skip from start volume.
|
||||
subkeys:
|
||||
- key: SkipPathItem
|
||||
type: <string>
|
||||
presence: required
|
||||
@@ -0,0 +1,43 @@
|
||||
title: Managed Preferences
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.ManagedClient.preferences
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: PreferenceDomain
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: The dictionary containing app preference domains.
|
||||
subkeys:
|
||||
- key: Forced
|
||||
type: <array>
|
||||
presence: required
|
||||
content: The dictionary of forced settings.
|
||||
subkeys: &id001
|
||||
- key: Settings
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
subkeys:
|
||||
- key: mcx_preference_settings
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: The dictionary of settings.
|
||||
subkeys:
|
||||
- key: ANY
|
||||
type: <any>
|
||||
presence: optional
|
||||
content: The setting/value pairs.
|
||||
- key: Set-Once
|
||||
type: <array>
|
||||
presence: required
|
||||
content: The dictonary of one-time settings.
|
||||
subkeys: *id001
|
||||
@@ -0,0 +1,47 @@
|
||||
title: NSExtension Management
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.NSExtension
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.13'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Specifies which NSExtension extensions are to be allowed or disallowed
|
||||
on a system. Extensions can be managed by bundleID allow/deny lists and "extension
|
||||
points".
|
||||
payloadkeys:
|
||||
- key: AllowedExtensions
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of identifiers for extensions that are allowed to run on the system.
|
||||
subkeys:
|
||||
- key: AllowedExtensionsItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: An extension identifier.
|
||||
- key: DeniedExtensions
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of identifiers for extensions that aren't allowed to run on the
|
||||
system.
|
||||
subkeys:
|
||||
- key: DeniedExtensionsItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: An extension identifier.
|
||||
- key: DeniedExtensionPoints
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of extension points for extensions that aren't allowed to run
|
||||
on the system.
|
||||
subkeys:
|
||||
- key: DeniedExtensionPointsItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: An extension identifier.
|
||||
@@ -0,0 +1,137 @@
|
||||
title: Setup Assistant
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.SetupAssistant.managed
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
supervised: true
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
macOS:
|
||||
introduced: '10.12'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: On macOS, this payload can specify Setup Assistant options for either the
|
||||
system or particular users.
|
||||
payloadkeys:
|
||||
- key: SkipCloudSetup
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', skips the Apple ID setup window.
|
||||
- key: SkipSiriSetup
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', skips the Siri setup window.
|
||||
- key: SkipPrivacySetup
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', skips the Privacy consent window.
|
||||
- key: SkipiCloudStorageSetup
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', skips the iCloud Storage window.
|
||||
- key: SkipTrueTone
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: 10.13.6
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', skips the True Tone Display window.
|
||||
- key: SkipAppearance
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: '10.14'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', skips the Choose Your Look window.
|
||||
- key: SkipTouchIDSetup
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If true, skips the Touch ID setup window.
|
||||
- key: SkipScreenTime
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If true, skips the Screen Time window.
|
||||
- key: SkipAccessibility
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: '11.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: Skips Accessibility window
|
||||
- key: SkipSetupItems
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
An array strings describing setup items to skip. SkipKeys provides a list of valid strings and their meanings.
|
||||
Available in iOS 14 and later.
|
||||
subkeys:
|
||||
- key: SkipSetupItems
|
||||
type: <string>
|
||||
- key: SkipUnlockWithWatch
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: '12.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: Skips Unlock With Apple Watch window
|
||||
@@ -0,0 +1,38 @@
|
||||
title: ShareKit
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.ShareKitHelper
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
deprecated: '10.12'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: macOS only. Specifies which ShareKit plugin can be accessed on client.
|
||||
Both allow and disallow lists can be specified.
|
||||
payloadkeys:
|
||||
- key: SHKAllowedShareServices
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The list of plugin IDs that show up in the user's Share menu. If this array
|
||||
exists, only these items are permitted.
|
||||
subkeys:
|
||||
- key: SHKAllowedShareServicesItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A plugin ID.
|
||||
- key: SHKDeniedShareServices
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The list of plugin IDs that won't show up in the user's Share menu. This
|
||||
key is used only if there is no 'SHKAllowedShareServices' key.
|
||||
subkeys:
|
||||
- key: SHKDeniedShareServicesItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A plugin ID.
|
||||
@@ -0,0 +1,100 @@
|
||||
title: Software Update
|
||||
description: Software Update Managed Settings
|
||||
payload:
|
||||
payloadtype: com.apple.SoftwareUpdate
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Software update catalog options.
|
||||
payloadkeys:
|
||||
- key: CatalogURL
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
deprecated: '11.0'
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The URL of the software update catalog. This property is not supported
|
||||
in macOS 11 and later.
|
||||
- key: AllowPreReleaseInstallation
|
||||
title: Allow Pre-Release Update Installation
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', prerelease software can be installed on this computer.
|
||||
- key: restrict-software-update-require-admin-to-install
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.14'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', restrict app installations to admin users. This key has the
|
||||
same function as the 'restrict-store-require-admin-to-install' key in the 'com.apple.appstore'
|
||||
payload.
|
||||
- key: AutomaticallyInstallMacOSUpdates
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', restricts the 'Install macOS Updates' option and prevents the
|
||||
user from changing the option.
|
||||
- key: AutomaticallyInstallAppUpdates
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', deselects the 'Install app updates from the App Store' option
|
||||
and prevents the user from changing the option.
|
||||
- key: AutomaticCheckEnabled
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', deselects the 'Check for updates' option and prevents the user
|
||||
from changing the option.
|
||||
- key: AutomaticDownload
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', deselects the 'Download new updates when available from the
|
||||
App Store' option and prevents the user from changing the option.
|
||||
- key: CriticalUpdateInstall
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', disables the automatic installation of critical updates and
|
||||
prevents the user from changing the 'Install system data files and security updates'
|
||||
option.
|
||||
- key: ConfigDataInstall
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', restricts the automatic installation of configuration data.
|
||||
@@ -0,0 +1,125 @@
|
||||
title: Network Proxy Configuration
|
||||
payload:
|
||||
payloadtype: com.apple.SystemConfiguration
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: Proxies
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: The dictionary containing all the proxies for this device.
|
||||
subkeys:
|
||||
- key: FTPEnable
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: If 'true', enables FTP proxy.
|
||||
- key: FTPPassive
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: If 'true', enables passive FTP mode.
|
||||
- key: FTPPort
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The FTP proxy port.
|
||||
- key: FTPProxy
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The host name or IP address for the FTP proxy.
|
||||
- key: GopherEnable
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: If 'true', enables gopher proxy.
|
||||
- key: GopherPort
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The gopher proxy port.
|
||||
- key: GopherProxy
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The host name or IP address for the gopher proxy.
|
||||
- key: HTTPEnable
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: If 'true', enables web proxy.
|
||||
- key: HTTPPort
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The web proxy port.
|
||||
- key: HTTPProxy
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The host name or IP address for the web proxy.
|
||||
- key: HTTPSEnable
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: If 'true', enables secure web proxy.
|
||||
- key: HTTPSPort
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The secure web proxy port.
|
||||
- key: HTTPSProxy
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The host name or IP address for the secure web proxy.
|
||||
- key: ProxyAutoConfigEnable
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: If 'true', enables automatic proxy configuration.
|
||||
- key: ProxyAutoConfigURLString
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The automatic proxy configuration URL.
|
||||
- key: ProxyCaptiveLoginAllowed
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: If 1, allows client to log into captive portal network.
|
||||
- key: RTSPEnable
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: If 'true', enable streaming proxy.
|
||||
- key: RTSPPort
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The streaming proxy port.
|
||||
- key: RTSPProxy
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The host name or IP address for the streaming proxy.
|
||||
- key: SOCKSEnable
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: If 'true', enable the SOCKS proxy.
|
||||
- key: SOCKSPortinteger
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The SOCKS proxy port.
|
||||
- key: SOCKSProxy
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The host name or IP address for the SOCKS proxy.
|
||||
- key: FallBackAllowed
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: |-
|
||||
If '1', enables fallback. Default is '1'.
|
||||
For managed devices, if not supplied, the default is '0'.
|
||||
- key: ExceptionsList
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The list of hosts and domains that should bypass proxy settings.
|
||||
subkeys:
|
||||
- key: Exception
|
||||
type: <string>
|
||||
presence: required
|
||||
content: Bypass proxy settings for these Hosts & Domains
|
||||
@@ -0,0 +1,261 @@
|
||||
title: Privacy Preferences Policy Control
|
||||
description: Configures Security Preferences:Privacy settings
|
||||
payload:
|
||||
payloadtype: com.apple.TCC.configuration-profile-policy
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.14'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: true
|
||||
allowmanualinstall: false
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: Services
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: A dictionary whose keys are limited to the privacy policy control services. In
|
||||
the case of conflicting specifications, the most restrictive setting (deny) is
|
||||
used.
|
||||
subkeys:
|
||||
- key: AddressBook
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Specifies the policies for contact information managed by the Contacts.app.
|
||||
subkeytype: Identity
|
||||
subkeys: &id001
|
||||
- key: IdentityDict
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: Identifier
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The bundle ID or installation path of the binary.
|
||||
- key: IdentifierType
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- bundleID
|
||||
- path
|
||||
content: The type of identifier value. Application bundles must be identified
|
||||
by bundle ID. Nonbundled binaries must be identified by installation path.
|
||||
Helper tools embedded within an application bundle automatically inherit
|
||||
the permissions of their enclosing app bundle.
|
||||
- key: CodeRequirement
|
||||
type: <string>
|
||||
presence: required
|
||||
content: Obtained via the command ''codesign –display -r -''.
|
||||
- key: StaticCode
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', statically validate the code requirement. Used only if
|
||||
the process invalidates its dynamic code signature.
|
||||
- key: Allowed
|
||||
type: <boolean>
|
||||
presence: required
|
||||
content: If 'true', access is granted; otherwise, the process doesn't have
|
||||
access. The user isn't prompted and can't change this value.
|
||||
- key: Authorization
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '11.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- Allow
|
||||
- Deny
|
||||
- AllowStandardUserToSetSystemService
|
||||
content: |-
|
||||
The 'Authorization' key is an optional replacement for the 'Allowed' key. Every payload must specify either 'Authorization' or 'Allowed', but not both.
|
||||
'Allow': Equivalent to a 'true' value for the 'Allowed' key.
|
||||
'Deny': Equivalent to a f'alse' value for the 'Allowed' key.
|
||||
'AllowStandardUserToSetSystemService:' allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization. 'AllowStandardUserToSetSystemService' is only valid for the 'ListenEvent' and 'ScreenCapture' services.
|
||||
Available in macOS 11 and later.
|
||||
- key: Comment
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: Not used.
|
||||
- key: AEReceiverIdentifier
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The identifier of the process receiving an AppleEvent sent by the
|
||||
Identifier process. This identifier is required for AppleEvents service;
|
||||
not valid for other services.
|
||||
- key: AEReceiverIdentifierType
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- bundleID
|
||||
- path
|
||||
content: The type of AEReceiverIdentifier value, either 'bundleID' or 'path'.
|
||||
This setting is required for AppleEvents service; not valid for other services.
|
||||
- key: AEReceiverCodeRequirement
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The code requirement for the receiving binary. This code requirement
|
||||
is required for AppleEvents service; not valid for other services.
|
||||
- key: Calendar
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Specifies the policies for calendar information managed by the Calendar.app.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: Reminders
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Specifies the policies for reminders information managed by the Reminders
|
||||
app.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: Photos
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The pictures managed by the Photos app in '~/Pictures/.photoslibrary'.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: Camera
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: A system camera. Access to the camera cannot be given in a profile; it
|
||||
can only be denied.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: Microphone
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: A system microphone. Access to the microphone cannot be given in a profile;
|
||||
it can only be denied.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: Accessibility
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Specifies the policies for the app via the Accessibility subsystem.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: PostEvent
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Specifies the policies for the application to use CoreGraphics APIs to
|
||||
send CGEvents to the system event stream.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: SystemPolicyAllFiles
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Allows the application access to all protected files, including system
|
||||
administration files.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: SystemPolicySysAdminFiles
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Allows the application access to some files used in system administration.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: AppleEvents
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Specifies the policies for the app sending restricted AppleEvents to
|
||||
another process.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: MediaLibrary
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Allows the application to access Apple Music, music and video activity,
|
||||
and the media library.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: FileProviderPresence
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Allows a File Provider application to know when the user is using files
|
||||
managed by the File Provider.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: ListenEvent
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Allows the application to use CoreGraphics and HID APIs to listen to
|
||||
(receive) CGEvents and HID events from all processes. Access to these events
|
||||
cannot be given in a profile; it can only be denied.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: ScreenCapture
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Allows the application to capture (read) the contents of the system display.
|
||||
Access to the contents cannot be given in a profile; it can only be denied.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: SpeechRecognition
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Allows the application to use the system Speech Recognition facility
|
||||
and to send speech data to Apple.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: SystemPolicyDesktopFolder
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Allows the application to access files in the user's Desktop folder.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: SystemPolicyDocumentsFolder
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Allows the application to access files in the user's Documents folder.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: SystemPolicyDownloadsFolder
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Allows the application to access files in the user's Downloads folder.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: SystemPolicyNetworkVolumes
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Allows the application to access files on network volumes.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
- key: SystemPolicyRemovableVolumes
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Allows the application to access files on removable volumes.
|
||||
subkeytype: Identity
|
||||
subkeys: *id001
|
||||
@@ -0,0 +1,46 @@
|
||||
title: AirPlay Security
|
||||
description: AirPlay Security settings
|
||||
payload:
|
||||
payloadtype: com.apple.airplay.security
|
||||
supportedOS:
|
||||
tvOS:
|
||||
introduced: '11.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
content: Manages the AirPlay Security settings on Apple TV (Settings > AirPlay >
|
||||
Security). Use this payload to lock Apple TV to a particular style of AirPlay
|
||||
security. The setting can enable/disable an on-screen passcode, or require a specific
|
||||
password phrase.
|
||||
payloadkeys:
|
||||
- key: SecurityType
|
||||
title: Security Type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- PASSCODE_ONCE
|
||||
- PASSCODE_ALWAYS
|
||||
- PASSWORD
|
||||
content: |-
|
||||
The security policy for AirPlay.
|
||||
'PASSCODE_ONCE' requires an onscreen passcode on first connection from a device. Subsequent connections from the same device aren't prompted.
|
||||
'PASSCODE_ALWAYS' requires an onscreen passcode for every AirPlay connection. After an AirPlay connection ends, reconnecting within 30 seconds is allowed without a password.
|
||||
|
||||
'PASSWORD' requires a passphrase as specified in the 'Password' key.
|
||||
|
||||
'NONE' was deprecated in tvOS 11.3. Existing profiles using 'NONE' get the 'PASSWORD_ONCE' behavior.
|
||||
- key: AccessType
|
||||
title: Access Type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- ANY
|
||||
- WIFI_ONLY
|
||||
content: |-
|
||||
The access policy for AirPlay.
|
||||
'ANY' allows connections from both Ethernet/WiFi and Apple Wireless Direct Link.
|
||||
'WIFI_ONLY' allows connections only from devices on the same Ethernet/WiFi network as Apple TV.
|
||||
- key: Password
|
||||
title: Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The AirPlay password; required if SecurityType is 'PASSWORD'.
|
||||
@@ -0,0 +1,115 @@
|
||||
title: AirPlay
|
||||
description: AirPlay settings
|
||||
payload:
|
||||
payloadtype: com.apple.airplay
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '7.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: macOS supports more than one payload, iOS does not. Supported on the user
|
||||
channel for macOS only.
|
||||
payloadkeys:
|
||||
- key: AllowList
|
||||
title: AllowList
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.5'
|
||||
supervised: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
macOS:
|
||||
introduced: '11.3'
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: If present, only AirPlay destinations in this list are available to the
|
||||
device. This allow list applies to supervised devices.
|
||||
subkeys: &id001
|
||||
- key: AllowListItem
|
||||
title: AllowList Content Item
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '7.0'
|
||||
supervised: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
subkeys:
|
||||
- key: DeviceID
|
||||
title: Device ID
|
||||
type: <string>
|
||||
presence: required
|
||||
format: ^([0-9A-Fa-f]{2}:){5}([0-9A-Fa-f]{2})$
|
||||
content: The device ID of the AirPlay destination in the format 'xx:xx:xx:xx:xx:xx'.
|
||||
This field isn't case-sensitive.
|
||||
- key: Passwords
|
||||
title: Passwords
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
If present, sets passwords for known AirPlay destinations.
|
||||
Using multiple entries for the same destination, whether within the same payload or across multiple installed payloads, is an error and results in undefined behavior.
|
||||
subkeys:
|
||||
- key: PasswordsItem
|
||||
title: Password Content Item
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
subkeys:
|
||||
- key: DeviceName
|
||||
title: Device Name
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The name of the AirPlay destination; used in iOS.
|
||||
- key: Password
|
||||
title: Password
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The password for the AirPlay destination.
|
||||
- key: DeviceID
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The device ID of the AirPlay destination; used in macOS.
|
||||
- key: Whitelist
|
||||
title: Whitelist
|
||||
supportedOS:
|
||||
iOS:
|
||||
deprecated: '14.5'
|
||||
supervised: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
macOS:
|
||||
deprecated: '11.3'
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Use 'AllowList' instead. As of macOS 11.3 and iOS 14.5 this key is deprecated.
|
||||
subkeys: *id001
|
||||
@@ -0,0 +1,82 @@
|
||||
title: AirPrint
|
||||
description: Use this section to define settings for AirPrint.
|
||||
payload:
|
||||
payloadtype: com.apple.airprint
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '7.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
payloadkeys:
|
||||
- key: AirPrint
|
||||
title: Air print
|
||||
type: <array>
|
||||
presence: required
|
||||
content: An array of AirPrint printers that are presented to the user.
|
||||
subkeys:
|
||||
- key: AirPrintItem
|
||||
title: Identifier
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: IPAddress
|
||||
title: IP Address
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '7.0'
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The IP address or hostname of the AirPrint destination.
|
||||
- key: ResourcePath
|
||||
title: Resource Path
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '7.0'
|
||||
type: <string>
|
||||
presence: required
|
||||
content: |-
|
||||
The resource path associated with the printer. This path corresponds to the 'rp' parameter of the '_ipps.tcp' Bonjour record. For example:
|
||||
* 'printers/Canon_MG5300_series'
|
||||
* 'printers/Xerox_Phaser_7600'
|
||||
* 'ipp/print'
|
||||
* 'Epson_IPP_Printer'
|
||||
- key: Port
|
||||
title: Port Number
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '11.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <integer>
|
||||
presence: optional
|
||||
range:
|
||||
min: 0
|
||||
max: 65535
|
||||
content: The listening port of the AirPrint destination. Available only in iOS
|
||||
11 and later.
|
||||
- key: ForceTLS
|
||||
title: Force TLS
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '11.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', AirPrint connections are secured by Transport Layer Security
|
||||
(TLS). Available only in iOS 11 and later.
|
||||
@@ -0,0 +1,64 @@
|
||||
title: APN
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.apn.managed
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
deprecated: '7.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: |-
|
||||
Not supported in macOS.
|
||||
This technically does install on watchOS but we are removing the supportedOS dictionary. The cellular payload should be used instead.
|
||||
Only applies to the preferred data SIM.
|
||||
Deprecated. Use Cellular instead.
|
||||
payloadkeys:
|
||||
- key: DefaultsData
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: The list of access point names (APNs).
|
||||
subkeys:
|
||||
- key: apns
|
||||
type: <array>
|
||||
presence: required
|
||||
content: An array of APN dictionaries (`APN.DefaultsData.Apns`).
|
||||
subkeys:
|
||||
- key: apnsItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: apn
|
||||
type: <string>
|
||||
presence: required
|
||||
content: This string specifies the Access Point Name.
|
||||
- key: username
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: This string specifies the user name for this APN. If it is missing,
|
||||
the device prompts for it during profile installation.
|
||||
- key: password
|
||||
type: <data>
|
||||
presence: optional
|
||||
content: This data represents the password for the user for this APN. For
|
||||
obfuscation purposes, the password is encoded. If it is missing from the
|
||||
payload, the device prompts for the password during profile installation.
|
||||
- key: proxy
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The IP address or URL of the APN proxy.
|
||||
- key: proxyPort
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The port number of the APN proxy.
|
||||
- key: DefaultsDomainName
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- com.apple.managedCarrier
|
||||
content: The domain name.
|
||||
@@ -0,0 +1,194 @@
|
||||
title: App Lock
|
||||
description: App Lock (Supervised Only)
|
||||
payload:
|
||||
payloadtype: com.apple.app.lock
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '6.0'
|
||||
supervised: true
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
tvOS:
|
||||
introduced: '10.2'
|
||||
supervised: true
|
||||
allowmanualinstall: true
|
||||
payloadkeys:
|
||||
- key: App
|
||||
title: App
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: A dictionary that contains information about the app.
|
||||
subkeys:
|
||||
- key: Identifier
|
||||
title: Identifier
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The app's bundle identifier.
|
||||
- key: Options
|
||||
title: Options
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '7.0'
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: A dictionary of options that the user cannot change.
|
||||
subkeys:
|
||||
- key: DisableTouch
|
||||
title: Disable Touch
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the touch screen. In tvOS, it disables the touch
|
||||
surface on the Apple TV Remote.
|
||||
- key: DisableDeviceRotation
|
||||
title: Disable Device Rotation
|
||||
supportedOS:
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables device rotation sensing.
|
||||
- key: DisableVolumeButtons
|
||||
title: Disable Volume Buttons
|
||||
supportedOS:
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the volume buttons.
|
||||
- key: DisableRingerSwitch
|
||||
title: Disable Ringer Switch
|
||||
supportedOS:
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the ringer switch. When disabled, the ringer behavior
|
||||
depends on what position the switch was in when it was first disabled.
|
||||
- key: DisableSleepWakeButton
|
||||
title: Disable Sleep Wake Button
|
||||
supportedOS:
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the sleep/wake button.
|
||||
- key: DisableAutoLock
|
||||
title: Disable Auto Lock
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the device doesn't automatically go to sleep after an idle
|
||||
period.
|
||||
- key: EnableVoiceOver
|
||||
title: Enable Voice Over
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables VoiceOver.
|
||||
- key: EnableZoom
|
||||
title: Enable Zoom
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables Zoom.
|
||||
- key: EnableInvertColors
|
||||
title: Enable Invert Colors
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables Invert Colors.
|
||||
- key: EnableAssistiveTouch
|
||||
title: Enable Assistive Touch
|
||||
supportedOS:
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables AssistiveTouch.
|
||||
- key: EnableSpeakSelection
|
||||
title: Enable Speak Selection
|
||||
supportedOS:
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables Speak Selection.
|
||||
- key: EnableMonoAudio
|
||||
title: Enable Mono Audio
|
||||
supportedOS:
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables Mono Audio.
|
||||
- key: EnableVoiceControl
|
||||
title: Enable Voice Control
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables Voice Control.
|
||||
- key: UserEnabledOptions
|
||||
title: User Enabled Options
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '7.0'
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: A dictionary of user-editable options.
|
||||
subkeys:
|
||||
- key: VoiceControl
|
||||
title: Voice Control
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', allows the user to toggle Voice Control.
|
||||
- key: VoiceOver
|
||||
title: Voice Over
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', allows the user to toggle VoiceOver.
|
||||
- key: Zoom
|
||||
title: Zoom
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', allows the user to toggle Zoom.
|
||||
- key: InvertColors
|
||||
title: Invert Colors
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', allows the user to toggle Invert Colors.
|
||||
- key: AssistiveTouch
|
||||
title: Assistive Touch
|
||||
supportedOS:
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', allows the user to toggle AssistiveTouch.
|
||||
@@ -0,0 +1,91 @@
|
||||
title: 'Parental Controls: Application Restrictions'
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.applicationaccess.new
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: |-
|
||||
Parental controls application restrictions.
|
||||
Order of evaluation:
|
||||
(1) Certain system applications and utilities are always allowed to run
|
||||
(2) The "whiteList" is searched to see if a matching entry is found by bundleID. If a match is found, the "appID" and "detachedSignature"
|
||||
(if present) are used to verify the signature of the application being launched. If the signature is valid and matches the designated
|
||||
requirement (in the "appID" key), the application is allowed to launch.
|
||||
(3) (deprecated) If the path to the binary being launched matches (or is in a subdirectory) of a path in "pathBlackList", the binary is denied.
|
||||
(4) (deprecated) If the path to the binary being launched matches (or is a subdirectory) of a path in "pathWhiteList", the binary is allowed to launch.
|
||||
(5) The binary is denied permission to launch.
|
||||
payloadkeys:
|
||||
- key: familyControlsEnabled
|
||||
type: <boolean>
|
||||
presence: required
|
||||
content: If 'true', enables app access restrictions.
|
||||
- key: whiteList
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The allow list of app item dictionaries.
|
||||
subkeytype: ApplicationItem
|
||||
subkeys: &id001
|
||||
- key: whiteListItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: bundleID
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The bundle ID of the app.
|
||||
- key: appID
|
||||
type: <data>
|
||||
presence: required
|
||||
content: The identifier of the app.
|
||||
- key: detachedSignature
|
||||
type: <data>
|
||||
presence: optional
|
||||
content: The signature for an unsigned binary.
|
||||
- key: disabled
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', this app is not added to the allow list.
|
||||
- key: subApps
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of nested helper applications.
|
||||
subkeytype: ApplicationItem
|
||||
subkeys: *id001
|
||||
- key: displayName
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The name used for display purposes.
|
||||
- key: pathBlackList
|
||||
supportedOS:
|
||||
macOS:
|
||||
deprecated: '10.15'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The paths to apps in the deny list. This property is deprecated in macOS
|
||||
10.15 and later.
|
||||
subkeys:
|
||||
- key: pathBlackListItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A path.
|
||||
- key: pathWhiteList
|
||||
supportedOS:
|
||||
macOS:
|
||||
deprecated: '10.15'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The paths to apps in the allow list. This property is deprecated in macOS
|
||||
10.15 and later.
|
||||
subkeys:
|
||||
- key: pathWhiteListItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A path.
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,54 @@
|
||||
title: App Store
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.appstore
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Use this payload to set restrictions used by the Mac App Store.
|
||||
payloadkeys:
|
||||
- key: restrict-store-require-admin-to-install
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
deprecated: '10.14'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', restricts app installations to admin users only. Deprecated
|
||||
in macOS 10.14. Use the 'com.apple.SoftwareUpdate' payload key 'restrict-software-update-require-admin-to-install'
|
||||
as a replacement.
|
||||
- key: restrict-store-softwareupdate-only
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', prevents App Store from launching. Available in macOS 10.14
|
||||
and later. Restricts installations to software updates only in macOS 10.10 - 10.13.
|
||||
- key: restrict-store-disable-app-adoption
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables app adoption by users. Available in macOS 10.10 and
|
||||
later.
|
||||
- key: DisableSoftwareUpdateNotifications
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables software update notifications. Available in macOS 10.10
|
||||
and later.
|
||||
@@ -0,0 +1,43 @@
|
||||
title: Autonomous Single App Mode
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.asam
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: true
|
||||
allowmanualinstall: false
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: AllowedApplications
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <array>
|
||||
presence: required
|
||||
content: An array of dictionaries that specifies the apps that can be granted access
|
||||
to the Accessibility APIs.
|
||||
subkeys:
|
||||
- key: AllowedApplicationsItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: BundleIdentifier
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The unique bundle identifier. If two dictionaries contain the same
|
||||
'BundleIdentifier' value but a different 'TeamIdentifier' value, this will
|
||||
be considered an error and the profile won't be installed.
|
||||
- key: TeamIdentifier
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The developer's team identifier, used when the app was signed.
|
||||
@@ -0,0 +1,54 @@
|
||||
title: Associated Domains
|
||||
description: Use this section to define settings for Associated Domains to be used
|
||||
with features such as Extensible AppSSO, universal links and Password AutoFill.
|
||||
payload:
|
||||
payloadtype: com.apple.associated-domains
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: true
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: Configures Associated Domains to be used with features such as Extensible
|
||||
AppSSO, universal links and Password AutoFill. Settings are per-user. The effective
|
||||
settings for a user will be the union of payloads installed for the device and
|
||||
the user. Users on a system that are not managed by the MDM will not have any
|
||||
effective settings, not even those from device payloads.
|
||||
payloadkeys:
|
||||
- key: Configuration
|
||||
title: Configuration
|
||||
type: <array>
|
||||
presence: required
|
||||
content: A dictionary that maps apps to their associated domains.
|
||||
subkeys:
|
||||
- key: ConfigurationItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: ApplicationIdentifier
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The app identifier to associate the domains with.
|
||||
- key: AssociatedDomains
|
||||
type: <array>
|
||||
presence: required
|
||||
content: |-
|
||||
The domains to be associated with the app. Each string is in the form of ''service:domain''. Domains should be fully qualified hostnames, like 'www.example.com'.
|
||||
See Supporting Associated Domains for more information.
|
||||
subkeys:
|
||||
- key: AssociatedDomain
|
||||
type: <string>
|
||||
presence: required
|
||||
- key: EnableDirectDownloads
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '11.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', data for this domain should be downloaded directly instead
|
||||
of through a CDN. The entitlement value for this domain must be set to 'service:domain?mode=managed'
|
||||
or this value will be ignored. Available in macOS 11 and later.
|
||||
@@ -0,0 +1,76 @@
|
||||
title: CalDAV
|
||||
description: Use this section to define settings for configuration access to CalDAV
|
||||
servers.
|
||||
payload:
|
||||
payloadtype: com.apple.caldav.account
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
payloadkeys:
|
||||
- key: CalDAVAccountDescription
|
||||
title: Account Description
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The description of the account.
|
||||
- key: CalDAVHostName
|
||||
title: Account Hostname
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The server's address.
|
||||
- key: CalDAVUsername
|
||||
title: Account Username
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The user name for logins.
|
||||
If this profile part of a non-interactive install, this field is required.
|
||||
- key: CalDAVPassword
|
||||
title: Account Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user's password. This is only used with encrypted profiles.
|
||||
- key: CalDAVPrincipalURL
|
||||
title: Principal URL
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The base URL to the user's calendar.
|
||||
- key: CalDAVUseSSL
|
||||
title: Use SSL
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', enables SSL.
|
||||
- key: CalDAVPort
|
||||
title: Port Number
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The server's port.
|
||||
- key: VPNUUID
|
||||
title: VPNUUID
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The VPNUUID of the per-app VPN the account uses for network communication.
|
||||
Available in iOS 14 and later.
|
||||
@@ -0,0 +1,128 @@
|
||||
title: CardDAV
|
||||
description: Use this section to define settings for configuration access to CardDAV
|
||||
servers.
|
||||
payload:
|
||||
payloadtype: com.apple.carddav.account
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
payloadkeys:
|
||||
- key: CardDAVAccountDescription
|
||||
title: Account Description
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The description of the account.
|
||||
- key: CardDAVHostName
|
||||
title: Account Hostname
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The server's address.
|
||||
- key: CardDAVUsername
|
||||
title: Account Username
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user name for logins.
|
||||
- key: CardDAVPassword
|
||||
title: Account Password
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user's password.
|
||||
- key: CardDAVPrincipalURL
|
||||
title: Principal URL
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The base URL to the user's address book.
|
||||
- key: CardDAVUseSSL
|
||||
title: Use SSL
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', enables SSL.
|
||||
- key: CardDAVPort
|
||||
title: Port Number
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The server's port.
|
||||
- key: CommunicationServiceRules
|
||||
title: Communication Service Rules
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: An array of communication service rules for this account.
|
||||
subkeys:
|
||||
- key: DefaultServiceHandlers
|
||||
title: Default Service Handlers
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: A dictionary of service handlers for contacts from this account.
|
||||
subkeys:
|
||||
- key: AudioCall
|
||||
title: App for audio calls
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: A string containing the bundle identifier for the default application
|
||||
that handles audio calls made to contacts from this account.
|
||||
- key: VPNUUID
|
||||
title: VPNUUID
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The VPNUUID of the per-app VPN the account uses for network communication.
|
||||
Available in iOS 14 and later.
|
||||
@@ -0,0 +1,183 @@
|
||||
title: Cellular
|
||||
description: Use this section to define custom APNs for cellular data access.
|
||||
payload:
|
||||
payloadtype: com.apple.cellular
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '7.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
watchOS:
|
||||
introduced: '3.2'
|
||||
allowmanualinstall: true
|
||||
content: |-
|
||||
This payload cannot be installed if an APN payload is already installed.
|
||||
This payload only applies to the preferred data SIM. There is no way to have a cellular payload affect a different SIM.
|
||||
This payload replaces the com.apple.managedCarrier payload. The latter payload is supported, but deprecated.
|
||||
payloadkeys:
|
||||
- key: AttachAPN
|
||||
title: AttachAPN
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: A configuration dictionary.
|
||||
subkeys:
|
||||
- key: Name
|
||||
title: Name
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The name for this configuration.
|
||||
- key: AuthenticationType
|
||||
title: Authentication type
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- CHAP
|
||||
- PAP
|
||||
default: PAP
|
||||
content: The authentication type.
|
||||
- key: Username
|
||||
title: User name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user name for the APN.
|
||||
- key: Password
|
||||
title: Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The password for the APN.
|
||||
- key: AllowedProtocolMask
|
||||
title: Supported IP Versions
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.3'
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 1
|
||||
- 2
|
||||
- 3
|
||||
content: |-
|
||||
The supported Internet Protocol versions. Possible values are:
|
||||
1 = IPv4
|
||||
2 = IPv6
|
||||
3 = Both
|
||||
- key: APNs
|
||||
title: APNs
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of access point dictionaries.
|
||||
subkeys:
|
||||
- key: APNsItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: Name
|
||||
title: Name
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The name for this configuration.
|
||||
- key: AuthenticationType
|
||||
title: Authentication type
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- CHAP
|
||||
- PAP
|
||||
default: PAP
|
||||
content: The authentication type for logging in.
|
||||
- key: Username
|
||||
title: User name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user name for the APN.
|
||||
- key: Password
|
||||
title: Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user's password for the APN.
|
||||
- key: ProxyServer
|
||||
title: Proxy server
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The proxy server's address.
|
||||
- key: ProxyPort
|
||||
title: Proxy port
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The proxy server's port number.
|
||||
- key: DefaultProtocolMask
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.3'
|
||||
deprecated: '11.0'
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 1
|
||||
- 2
|
||||
- 3
|
||||
content: |-
|
||||
Deprecated. The default Internet Protocol versions. Possible values are:
|
||||
* '1': IPv4
|
||||
* '2': IPv6
|
||||
* '3': Both
|
||||
Available in iOS 10.3 but no longer used in iOS 11 and later.
|
||||
- key: AllowedProtocolMask
|
||||
title: Supported IP Versions
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.3'
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 1
|
||||
- 2
|
||||
- 3
|
||||
content: |-
|
||||
The supported Internet Protocol versions. Possible values are:
|
||||
* '1': IPv4
|
||||
* '2': IPv6
|
||||
* '3': Both
|
||||
Available in iOS 10.3 and later.
|
||||
- key: AllowedProtocolMaskInRoaming
|
||||
title: Supported Roaming IP Versions
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.3'
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 1
|
||||
- 2
|
||||
- 3
|
||||
content: |-
|
||||
The supported Internet Protocol versions while roaming. Possible values are:
|
||||
* '1': IPv4
|
||||
* '2': IPv6
|
||||
* '3': Both
|
||||
Available in iOS 10.3 and later.
|
||||
- key: AllowedProtocolMaskInDomesticRoaming
|
||||
title: Supported Roaming IP Versions
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.3'
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 1
|
||||
- 2
|
||||
- 3
|
||||
content: |-
|
||||
The supported Internet Protocol versions while roaming domestically. Possible values are:
|
||||
* '1': IPv4
|
||||
* '2': IPv6
|
||||
* '3': Both
|
||||
Available in iOS 10.3 and later.
|
||||
@@ -0,0 +1,18 @@
|
||||
title: Conference Room Display
|
||||
description: Use this section to place an Apple TV device into Conference Room Display
|
||||
mode.
|
||||
payload:
|
||||
payloadtype: com.apple.conferenceroomdisplay
|
||||
supportedOS:
|
||||
tvOS:
|
||||
introduced: '10.2'
|
||||
supervised: true
|
||||
allowmanualinstall: true
|
||||
content: Configures an Apple TV to enter Conference Room Display mode, and restrictions
|
||||
exit from that mode
|
||||
payloadkeys:
|
||||
- key: Message
|
||||
title: Custom message
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The custom message displayed on the screen in Conference Room Display mode.
|
||||
@@ -0,0 +1,66 @@
|
||||
title: Identification
|
||||
payload:
|
||||
payloadtype: com.apple.configurationprofile.identification
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: |-
|
||||
This payload can be used on the device or user channel depending on what payload it is paired with.
|
||||
|
||||
Device channel:
|
||||
*com.apple.MCX.FileVault2
|
||||
*com.apple.ADCertificate.managed
|
||||
*com.apple.DirectoryService.managed
|
||||
|
||||
User channel:
|
||||
*com.apple.caldav.account
|
||||
*com.apple.carddav.account
|
||||
*com.apple.ews.account
|
||||
*com.apple.ldap.account
|
||||
*com.apple.mail.managed
|
||||
payloadkeys:
|
||||
- key: PayloadIdentification
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: The dictionary containing details about the user.
|
||||
subkeys:
|
||||
- key: UserName
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The UNIX user name for the accounts.
|
||||
- key: FullName
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The full name of the account.
|
||||
- key: EmailAddress
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The address for the account.
|
||||
- key: AuthMethod
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- Password
|
||||
- UserEnteredPassword
|
||||
content: The authorization method. Either the password is supplied in the profile
|
||||
or the user supplies it.
|
||||
- key: Password
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The password for the account. Required when the 'AuthMethod' is of type
|
||||
'password'.
|
||||
- key: Prompt
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The custom instructions for the user, if needed.
|
||||
- key: PromptMessage
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The additional descriptive text for the user prompt.
|
||||
@@ -0,0 +1,39 @@
|
||||
title: 'Parental Controls: Dashboard Widget Restrictions'
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.dashboard
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
deprecated: '10.15'
|
||||
removed: '10.15'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Widget restrictions.
|
||||
payloadkeys:
|
||||
- key: whiteListEnabled
|
||||
type: <boolean>
|
||||
presence: required
|
||||
content: If 'true', enables the widget allow list.
|
||||
- key: WhiteList
|
||||
type: <array>
|
||||
presence: required
|
||||
content: An array of widget item dictionaries that are allowed.
|
||||
subkeys:
|
||||
- key: WhiteListItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: Type
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The type of allow list item. Set to 'bundleID' to use a widget's bundle
|
||||
ID as its main ID.
|
||||
- key: ID
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The bundle ID of a widget.
|
||||
@@ -0,0 +1,28 @@
|
||||
title: Desktop
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.desktop
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: locked
|
||||
supportedOS:
|
||||
macOS:
|
||||
deprecated: '10.13'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', locks the desktop picture. Replaced with allowWallpaperModification
|
||||
in macOS 10.13.
|
||||
- key: override-picture-path
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The path to the desktop picture. If set, this picture is always locked.
|
||||
@@ -0,0 +1,49 @@
|
||||
title: DNS Proxy
|
||||
description: Use this section to configure a DNS proxy network extension
|
||||
payload:
|
||||
payloadtype: com.apple.dnsProxy.managed
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '11.0'
|
||||
supervised: false
|
||||
allowmanualinstall: false
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: As of iOS 15.0 this payload can now be installed on unsupervised devices
|
||||
via MDM and can now only be installed via MDM.
|
||||
payloadkeys:
|
||||
- key: AppBundleIdentifier
|
||||
title: App Bundle Identifier
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The bundle identifier of the app containing the DNS proxy network extension.
|
||||
- key: ProviderBundleIdentifier
|
||||
title: Provider Bundle Identifier
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The bundle identifier of the DNS proxy network extension to use. Declaring
|
||||
the bundle identifier is useful for apps that contain more than one DNS proxy
|
||||
extension.
|
||||
- key: ProviderConfiguration
|
||||
title: Provider Configuration
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The dictionary of vendor-specific configuration items.
|
||||
subkeys:
|
||||
- key: ANY
|
||||
type: <any>
|
||||
presence: optional
|
||||
content: Key/value pairs.
|
||||
@@ -0,0 +1,187 @@
|
||||
title: DNS Settings
|
||||
description: Use this section to configure DNS settings.
|
||||
payload:
|
||||
payloadtype: com.apple.dnsSettings.managed
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
macOS:
|
||||
introduced: '11.0'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: DNSSettings
|
||||
title: DNS Settings
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: A dictionary that defines a configuration for an encrypted DNS server.
|
||||
subkeys:
|
||||
- key: DNSProtocol
|
||||
title: DNS Protocol
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- HTTPS
|
||||
- TLS
|
||||
content: The encrypted transport protocol used to communicate with the DNS server.
|
||||
- key: ServerURL
|
||||
title: Server URL
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The URI template of a DNS-over-HTTPS server, as defined in RFC 8484.
|
||||
This URL must use the 'https://' scheme, and the hostname or address in the
|
||||
URL will be used to validate the server certificate. If no 'ServerAddresses'
|
||||
are provided, the hostname or address in the URL will be used to determine the
|
||||
server addresses. This key must be present only if the 'DNSProtocol' is 'HTTPS'.
|
||||
- key: ServerName
|
||||
title: Server Name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The hostname of a DNS-over-TLS server used to validate the server certificate,
|
||||
as defined in RFC 7858. If no 'ServerAddresses' are provided, the hostname will
|
||||
be used to determine the server addresses. This key must be present only if
|
||||
the DNSProtocol is 'TLS'.
|
||||
- key: ServerAddresses
|
||||
title: DNS Server Addresses
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An unordered list of DNS server IP address strings. These IP addresses
|
||||
can be a mixture of IPv4 and IPv6 addresses.
|
||||
subkeys:
|
||||
- key: ServerAddressesElement
|
||||
title: Server Address Element
|
||||
type: <string>
|
||||
- key: SupplementalMatchDomains
|
||||
title: Supplemental Match Domains
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
A list of domain strings used to determine which DNS queries will use the DNS server. If this array is not provided, all domains will use the DNS server.
|
||||
A single wildcard '*' prefix is supported, but is not required. For example, both '*.example.com' and 'example.com' match against 'mydomain.example.com' and 'your.domain.example.com', but do not match against 'mydomain-example.com'.
|
||||
subkeys:
|
||||
- key: SupplementalMatchDomainsElement
|
||||
title: Supplemental Match Domains Element
|
||||
type: <string>
|
||||
- key: OnDemandRules
|
||||
title: On Demand Rules
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of rules defining the DNS settings. If rules are not present,
|
||||
the system always applies the DNS settings. These rules are identical to the 'OnDemandRules'
|
||||
array in VPN payloads.
|
||||
subkeytype: OnDemandRulesElement
|
||||
subkeys:
|
||||
- key: OnDemandRulesElement
|
||||
title: On Demand Rules Element
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: Action
|
||||
title: On Demand Action
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- Connect
|
||||
- Disconnect
|
||||
- EvaluateConnection
|
||||
content: |-
|
||||
The action to take if this dictionary matches the current network. Possible values are:
|
||||
* 'Connect': Apply DNS Settings when the dictionary matches.
|
||||
* 'Disconnect': Do not apply DNS Settings when the dictionary matches.
|
||||
* 'EvaluateConnection': Apply DNS Settings with per-domain exceptions when the dictionary matches.
|
||||
- key: ActionParameters
|
||||
title: Action Parameters
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: |-
|
||||
A dictionary that provides per-connection rules.
|
||||
This array is used only for settings where the 'Action' value is'EvaluateConnection'.
|
||||
subkeys:
|
||||
- key: Domains
|
||||
title: Domains
|
||||
type: <array>
|
||||
presence: required
|
||||
content: The domains for which this evaluation applies.
|
||||
subkeys:
|
||||
- key: DomainsElement
|
||||
title: Domains Element
|
||||
type: <string>
|
||||
- key: DomainAction
|
||||
title: Domain Action
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- NeverConnect
|
||||
- ConnectIfNeeded
|
||||
content: |-
|
||||
The DNS settings behavior for the specified domains. Allowed values are:
|
||||
* 'NeverConnect': Do not use the DNS Settings for the specified domains.
|
||||
* 'ConnectIfNeeded': Allow using the DNS Settings for the specified domains.
|
||||
- key: DNSDomainMatch
|
||||
title: DNS Domain Match
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list.
|
||||
A single wildcard '*' prefix is supported, but is not required. For example, both '*.example.com' and 'example.com' match against 'mydomain.example.com' and 'your.domain.example.com', but do not match against 'mydomain-example.com'.
|
||||
subkeys:
|
||||
- key: DNSDomainMatchElement
|
||||
title: DNS Domain Match Element
|
||||
type: <string>
|
||||
- key: DNSServerAddressMatch
|
||||
title: DNS Server Address Match
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array.
|
||||
Matching with a single wildcard is supported. For example, 17.* matches any DNS server in the 17.0.0.0/8 subnet.
|
||||
subkeys:
|
||||
- key: DNSServerAddressMatchElement
|
||||
title: DNS Server Address Match Element
|
||||
type: <string>
|
||||
- key: InterfaceTypeMatch
|
||||
title: Interface Type Match
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- Ethernet
|
||||
- WiFi
|
||||
- Cellular
|
||||
content: An interface type. If specified, this rule matches only if the primary
|
||||
network interface hardware matches the specified type.
|
||||
- key: SSIDMatch
|
||||
title: SSID Match
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
An array of SSIDs to match against the current network. If the network is not a Wi-Fi network or if the SSID does not appear in this array, the match fails.
|
||||
Omit this key and the corresponding array to match against any SSID.
|
||||
subkeys:
|
||||
- key: SSIDMatchElement
|
||||
title: SSID Match Element
|
||||
type: <string>
|
||||
- key: URLStringProbe
|
||||
title: URL String Probe
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: A URL to probe. If this URL is successfully fetched (returning a 200
|
||||
HTTP status code) without redirection, this rule matches.
|
||||
- key: ProhibitDisablement
|
||||
title: Prohibit Disablement
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', prohibits users from disabling DNS settings. This key is only
|
||||
available on supervised devices.
|
||||
@@ -0,0 +1,282 @@
|
||||
title: Dock
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.dock
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: tilesize
|
||||
type: <integer>
|
||||
presence: optional
|
||||
range:
|
||||
min: 16
|
||||
max: 128
|
||||
content: The tile size. Values must be in the range from 16 to 128.
|
||||
- key: size-immutable
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', locks the size slider.
|
||||
- key: magnification
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables magnification.
|
||||
- key: magnify-immutable
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', locks magnification.
|
||||
- key: largesize
|
||||
type: <integer>
|
||||
presence: optional
|
||||
range:
|
||||
min: 16
|
||||
max: 128
|
||||
content: The size of the largest magnification.
|
||||
- key: magsize-immutable
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', locks the magnification slider.
|
||||
- key: orientation
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- bottom
|
||||
- left
|
||||
- right
|
||||
content: The orientation of the dock.
|
||||
- key: position-immutable
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', locks the position.
|
||||
- key: mineffect
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- genie
|
||||
- scale
|
||||
content: The minimize effect.
|
||||
- key: mineffect-immutable
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', locks 'Minimize windows using.'
|
||||
- key: windowtabbing
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- manual
|
||||
- always
|
||||
- fullscreen
|
||||
content: Set the 'Prefer tabs when opening documents' to the provided value.
|
||||
- key: windowtabbing-immutable
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.12'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables 'Prefer tabs when opening documents' checkbox.
|
||||
- key: dblclickbehavior
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- minimize
|
||||
- maximize
|
||||
- none
|
||||
content: The behavior when the window's title bar is double-clicked.
|
||||
- key: dblclickbehavior-immutable
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.14'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', locks 'Double-click a window's title bar.'
|
||||
- key: minimize-to-application
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables 'Minimize windows into application icon.'
|
||||
- key: minintoapp-immutable
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.14'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the 'Minimize windows into application icon' checkbox.
|
||||
- key: launchanim
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables 'Animate opening applications.'
|
||||
- key: launchanim-immutable
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', locks 'Animate opening applications.'
|
||||
- key: autohide
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables 'Automatically hide and show the dock.'
|
||||
- key: autohide-immutable
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', locks 'Automatically hide.'
|
||||
- key: show-process-indicators
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If true, shows the process indicator.
|
||||
- key: showindicators-immutable
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', locks 'Show indicators.'
|
||||
- key: show-recents
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.14'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables 'Show recent items.'
|
||||
- key: showrecents-immutable
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables 'Show recent applications' checkbox.
|
||||
- key: contents-immutable
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables changes to the dock.
|
||||
- key: MCXDockSpecialFolders
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
One or more special folders that may be created at user login time and placed in the dock.
|
||||
|
||||
The 'My Applications' item is only used for Simple Finder environments. The 'Original Network Home' item is only used for mobile account users.
|
||||
subkeys:
|
||||
- key: MCXDockSpecialFoldersItems
|
||||
type: <string>
|
||||
rangelist:
|
||||
- AddDockMCXMyApplicationsFolder
|
||||
- AddDockMCXDocumentsFolder
|
||||
- AddDockMCXSharedFolder
|
||||
- AddDockMCXOriginalNetworkHomeFolder
|
||||
- key: AllowDockFixupOverride
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.12'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', use the file in '/Library/Preferences/com.apple.dockfixup.plist'
|
||||
when a new user or migrated user logs in. This option has no effect for existing
|
||||
users. Available in macOS 10.12 and later. Only available on the device channel.
|
||||
- key: static-only
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', uses the 'static-apps' and 'static-others' dictionaries for
|
||||
the dock and ignores any items in the 'persistent-apps' and 'persistent-others'
|
||||
dictionaries. If 'false', the contents are merged with the static items listed
|
||||
first.
|
||||
- key: static-others
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of items located on the Documents side of the Dock and cannot
|
||||
be removed from that location.
|
||||
subkeytype: StaticItem
|
||||
subkeys: &id001
|
||||
- key: StaticItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: tile-data
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: The information about the dock item.
|
||||
subkeys:
|
||||
- key: label
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The label of the dock item.
|
||||
- key: url
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The URL string.
|
||||
- key: file-type
|
||||
type: <integer>
|
||||
presence: required
|
||||
rangelist:
|
||||
- 0
|
||||
- 1
|
||||
- 3
|
||||
content: |-
|
||||
The type of tile:
|
||||
* '0': URL
|
||||
* '1': File
|
||||
* '3': Directory
|
||||
- key: file-data
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The data in a file. For Apple use only.
|
||||
subkeys:
|
||||
- key: ANY
|
||||
type: <any>
|
||||
presence: optional
|
||||
content: For Apple use only.
|
||||
- key: tile-type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- file-tile
|
||||
- directory-tile
|
||||
- url-tile
|
||||
content: The type of tile.
|
||||
- key: static-apps
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of items located on the Applications side of the Dock and cannot
|
||||
be removed from that location.
|
||||
subkeytype: StaticItem
|
||||
subkeys: *id001
|
||||
- key: persistent-apps
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of items located on the Applications side of the Dock that can
|
||||
be removed from the dock.
|
||||
subkeytype: StaticItem
|
||||
subkeys: *id001
|
||||
- key: persistent-others
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of items located on the Documents side of the Dock that can be
|
||||
removed from the dock.
|
||||
subkeytype: StaticItem
|
||||
subkeys: *id001
|
||||
@@ -0,0 +1,69 @@
|
||||
title: Domains
|
||||
description: Use this section to define Domains settings.
|
||||
payload:
|
||||
payloadtype: com.apple.domains
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '8.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: This payload defines web domains that are under an enterprise's management.
|
||||
payloadkeys:
|
||||
- key: EmailDomains
|
||||
title: Email Domains
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
An array of domains. Email addresses that lack a suffix matching any of these strings are considered out of domain and marked in Mail.
|
||||
This is the only field supported on macOS.
|
||||
subkeys:
|
||||
- key: EmailDomainsItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: An email address.
|
||||
- key: WebDomains
|
||||
title: Web Domains
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of domains. URLs matching the patterns listed here are considered
|
||||
managed.
|
||||
subkeys:
|
||||
- key: WebDomainsItem
|
||||
type: <string>
|
||||
- key: SafariPasswordAutoFillDomains
|
||||
title: Password Autofill Domains
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '9.3'
|
||||
supervised: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
An array of domains. Users can only save passwords in Safari from URLs matching the patterns listed here. This property doesn't disable the autofill feature itself.
|
||||
Supervised devices or Shared iPads need this property to enable saving passwords in Safari.
|
||||
Available in iOS 9.3 and later.
|
||||
subkeys:
|
||||
- key: SafariPasswordAutoFillDomainsItem
|
||||
type: <string>
|
||||
@@ -0,0 +1,428 @@
|
||||
title: Exchange ActiveSync
|
||||
description: Use this section to define settings for the Exchange ActiveSync account.
|
||||
payload:
|
||||
payloadtype: com.apple.eas.account
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: |-
|
||||
This payload configures an Exchange Active Sync account on an iOS device for Mail, Contacts, Calendars, Reminders, and Notes.
|
||||
Updating this payload overrides any settings that the user customized, such as EnableMail/Contacts/Calendars/Reminders/Notes and MailNumberOfPastDaysToSync.
|
||||
payloadkeys:
|
||||
- key: EmailAddress
|
||||
title: Email Address
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The full email address for the account. If not present in the payload,
|
||||
the device prompts for this string during profile installation.
|
||||
- key: Host
|
||||
title: Exchange ActiveSync Host
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The Exchange server host name or IP address.
|
||||
If using OAuth without an OAuthSignInURL, the host name is ignored.
|
||||
- key: SSL
|
||||
title: Use SSL
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables SSL for authentication.
|
||||
- key: OAuth
|
||||
title: Use OAuth
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: |-
|
||||
If 'true', enables OAuth for authentication. If enabled, don't specify a password.
|
||||
Available only in iOS 12.0 and above.
|
||||
- key: UserName
|
||||
title: User
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: This user name for this Exchange account. The user name is required for
|
||||
noninteractive installations like MDM in iOS.
|
||||
- key: Password
|
||||
title: Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The password of the account. Use only with encrypted profiles.
|
||||
- key: Certificate
|
||||
title: Authentication Credential
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '7.0'
|
||||
type: <data>
|
||||
presence: optional
|
||||
content: The '.p12' identity certificate in NSData blob format, for accounts that
|
||||
allow authentication via certificate.
|
||||
- key: CertificateName
|
||||
title: Authentication Credential Name
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '7.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The name or description of the certificate.
|
||||
- key: CertificatePassword
|
||||
title: Authentication Credential Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The password necessary for the '.p12' identity certificate. Used with mandatory
|
||||
encryption of profiles.
|
||||
- key: PreventMove
|
||||
title: Prevent Move
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '5.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', prevents messages from being moved out of this email account
|
||||
into another account. This setting also prevents forwarding or replying from an
|
||||
account other than the one the message was sent to.
|
||||
- key: PreventAppSheet
|
||||
title: Prevent App Sheet
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '5.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', prevents this account from sending mail in any app other than
|
||||
the Apple Mail app.
|
||||
- key: PayloadCertificateUUID
|
||||
title: Payload Certificate UUID
|
||||
type: <string>
|
||||
presence: optional
|
||||
format: ^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$
|
||||
content: The UUID of of the certificate payload within the same profile to use for
|
||||
the identity credential. If this field is present, the Certificate field is not
|
||||
used.
|
||||
- key: SMIMEEnabled
|
||||
title: S/MIME Enabled
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '5.0'
|
||||
deprecated: '10.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables S/MIME encryption. In iOS 10.0 and later, this key is
|
||||
ignored. Use 'SMIMESigningEnabled' instead.
|
||||
- key: SMIMESigningEnabled
|
||||
title: S/MIME Signing Enabled
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.3'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables S/MIME signing for this account. Available in iOS 10.0
|
||||
and later.
|
||||
- key: SMIMESigningCertificateUUID
|
||||
title: S/MIME Signing Certificate
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '5.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
format: ^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$
|
||||
content: The UUID of the identity certificate used to sign messages sent from this
|
||||
account.
|
||||
- key: SMIMEEncryptionEnabled
|
||||
title: S/MIME Encryption Enabled
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.3'
|
||||
deprecated: '12.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables S/MIME encryption for this account. Available in iOS
|
||||
10.0 and later. As of iOS 12.0, this key is deprecated. It is recommended to use
|
||||
'SMIMEEncryptByDefault' instead.
|
||||
- key: SMIMEEncryptionCertificateUUID
|
||||
title: S/MIME Encryption Certificate
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '5.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
format: ^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$
|
||||
content: The payload UUID of the identity certificate used to decrypt messages sent
|
||||
to this account. The public certificate is attached to outgoing mail to allow
|
||||
encrypted mail to be sent to this user. When the user sends encrypted mail, the
|
||||
public certificate is used to encrypt the copy of the mail in the user's Sent
|
||||
mailbox.
|
||||
- key: SMIMEEnablePerMessageSwitch
|
||||
title: S/MIME Enable Per-Message Switch
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '8.0'
|
||||
deprecated: '12.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: |-
|
||||
If 'true', displays the per-message encryption switch in the Mail Compose UI.
|
||||
Available in iOS 8.0 and later. As of iOS 12.0, this key is deprecated. Use 'SMIMEEnableEncryptionPerMessageSwitch' instead.
|
||||
- key: disableMailRecentsSyncing
|
||||
title: Disable Mail Recents Syncing
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', excludes this account from Recent Addresses syncing.
|
||||
- key: MailNumberOfPastDaysToSync
|
||||
title: Past Days of Mail to Sync
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 1
|
||||
- 3
|
||||
- 7
|
||||
- 14
|
||||
- 31
|
||||
default: 7
|
||||
content: The number of days in the past to sync mail on the device.
|
||||
- key: HeaderMagic
|
||||
supportedOS:
|
||||
iOS:
|
||||
deprecated: '7.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The value of the 'X-Apple-Config-Magic' header in each EAS HTTP request.
|
||||
- key: CommunicationServiceRules
|
||||
title: Communication Service Rules
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.0'
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The communication service handler rules for this account.
|
||||
subkeys:
|
||||
- key: DefaultServiceHandlers
|
||||
title: Default Service Handlers
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.0'
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The default handlers to be used for contacts from this account.
|
||||
subkeys:
|
||||
- key: AudioCall
|
||||
title: App for audio calls
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The bundle identifier of the default application to use for audio calls
|
||||
made to contacts from this account.
|
||||
- key: allowMailDrop
|
||||
title: Allow Mail Drop
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '9.2'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables this account to use Mail Drop.
|
||||
- key: SMIMESigningUserOverrideable
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the user can turn S/MIME signing on or off in Settings. Available
|
||||
in iOS 12.0 and later.
|
||||
- key: SMIMESigningCertificateUUIDUserOverrideable
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the user can select the signing identity. Available in iOS 12.0
|
||||
and later.
|
||||
- key: SMIMEEncryptByDefault
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If set to true, S/MIME encryption is enabled by default. If 'SMIMEEnableEncryptionPerMessageSwitch'
|
||||
is false, this default cannot be changed by the user. Available in iOS 12.0 and
|
||||
later.
|
||||
- key: SMIMEEncryptByDefaultUserOverrideable
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the user can turn encryption by default on/off, and encryption
|
||||
is on. Available in iOS 12.0 and later.
|
||||
- key: SMIMEEncryptionCertificateUUIDUserOverrideable
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the user can select the S/MIME encryption identity, and encryption
|
||||
is on.Available in iOS 12.0 and later.
|
||||
- key: SMIMEEnableEncryptionPerMessageSwitch
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', displays the per-message encryption switch in the Mail Compose
|
||||
UI. Available in iOS 12.0 and later.
|
||||
- key: EnableMail
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: |-
|
||||
If 'false', disables the Mail service for this account. The Mail service may be re-enabled in Settings unless 'EnableMailUserOverridable' is 'false'.
|
||||
'EnableMail', 'EnableContacts', 'EnableCalendars', 'EnableReminders', and 'EnableNotes' can't all be set to 'false'.
|
||||
- key: EnableContacts
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: |-
|
||||
If 'false', disables the Contacts service for this account. The Contacts service may be re-enabled in Settings unless 'EnableContactsUserOverridable' is 'false'.
|
||||
'EnableMail', 'EnableContacts', 'EnableCalendars', 'EnableReminders', and 'EnableNotes' can't all be set to 'false'.
|
||||
- key: EnableCalendars
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: |-
|
||||
If 'false', disables the Calendars service for this account. The Calendars service may be re-enabled in Settings unless 'EnableCalendarsUserOverridable' is 'false'.
|
||||
'EnableMail', 'EnableContacts', 'EnableCalendars', 'EnableReminders', and 'EnableNotes' can't all be set to 'false'.
|
||||
- key: EnableReminders
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: |-
|
||||
If 'false', disables the Reminders service for this account. The Reminders service may be re-enabled in Settings unless 'EnableRemindersUserOverridable' is false.
|
||||
'EnableMail', 'EnableContacts', 'EnableCalendars', 'EnableReminders', and 'EnableNotes' can't all be set to 'false'.
|
||||
- key: EnableNotes
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: |-
|
||||
If 'false', disables the Notes service for this account. The Notes service may be re-enabled in Settings unless 'EnableNotesUserOverridable' is 'false'.
|
||||
'EnableMail', 'EnableContacts', 'EnableCalendars', 'EnableReminders', and 'EnableNotes' can't all be set to 'false'.
|
||||
- key: EnableMailUserOverridable
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', prevents the user from changing the state of the Mail service
|
||||
for this account in Settings.
|
||||
- key: EnableContactsUserOverridable
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', prevents the user from changing the state of the Contacts service
|
||||
for this account in Settings.
|
||||
- key: EnableCalendarsUserOverridable
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', prevents the user from changing the state of the Calendars
|
||||
service for this account in Settings.
|
||||
- key: EnableRemindersUserOverridable
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', prevents the user from changing the state of the Reminders
|
||||
service for this account in Settings.
|
||||
- key: EnableNotesUserOverridable
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', prevents the user from changing the state of the Notes service
|
||||
for this account in Settings.
|
||||
- key: OAuthSignInURL
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The URL that this account should use for signing in via OAuth. When this URL is specified, auto-discovery is not used for this account so you must also specify a host.
|
||||
This field is ignored unless 'OAuth' is 'true'.
|
||||
- key: OAuthTokenRequestURL
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The URL that this account should use for token requests via OAuth.
|
||||
This field is ignored unless 'OAuth' is 'true'.
|
||||
- key: OverridePreviousPassword
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', overrides the previous user/EAS password with the new EAS password
|
||||
in the payload. Available in iOS 14 and later.
|
||||
- key: VPNUUID
|
||||
title: VPNUUID
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The VPNUUID of the per-app VPN the account uses for network communication.
|
||||
Available in iOS 14 and later.
|
||||
@@ -0,0 +1,281 @@
|
||||
title: Education Configuration
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.education
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '9.3'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.14'
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: This payload is used to configure Classroom students, Classroom instructors,
|
||||
and the Shared iPad login screen. These do not necessarily require the same set
|
||||
of keys to be present in their payloads, so make sure to include all keys that
|
||||
are required for the education product you are configuring.
|
||||
payloadkeys:
|
||||
- key: OrganizationUUID
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The organization's UUID identifier. This identifier can be any valid UUID.
|
||||
All teacher and student devices that need to communicate with one another must
|
||||
have the same organization UUID, particularly if they originated from different
|
||||
Device Enrollment Programs.
|
||||
- key: OrganizationName
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The organization's display name. This name is shown in the iOS login screen.
|
||||
- key: PayloadCertificateUUID
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The UUID of an identity certificate payload within the same profile to use for performing client authentication with other devices.
|
||||
This key is required to configure Classroom. It does not impact the configuration of the Shared iPad login screen.
|
||||
- key: LeaderPayloadCertificateAnchorUUID
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
The array of UUIDs referring to certificate payloads within the same profile that are used to authorize leader peer certificate identities. This array must contain all certificates needed to validate the entire chain of trust. Leader certificates must have the common name prefix leader (case insensitive).
|
||||
Note: Identity payloads aren't supported.
|
||||
This key is required when configuring a student device for Classroom, and is ignored when configuring an instructor device. It does not impact the configuration of the Shared iPad login screen.
|
||||
subkeys:
|
||||
- key: LeaderPayloadCertificateAnchorUUIDItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A certificate payload UUID.
|
||||
- key: MemberPayloadCertificateAnchorUUID
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
The array of UUIDs referring to certificate payloads within the same profile that are used to authorize group member peer certificate identities. This array must contain all certificates needed to validate the entire chain of trust. Member certificates must have the common name prefix member (case insensitive).
|
||||
Note: Identity payloads aren't supported.
|
||||
This key is required when configuring an instructor device for Classroom, and is ignored when configuring a student device. It does not impact the configuration of the Shared iPad login screen.
|
||||
subkeys:
|
||||
- key: MemberPayloadCertificateAnchorUUIDItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A certificate payload UUID.
|
||||
- key: ResourcePayloadCertificateUUID
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The UUID of an identity certificate payload within the same profile that is used to perform client authentication when fetching additional resources, such as student images. If not specified, the MDM client identity is used.
|
||||
If present, this key is used to configure both Classroom and the Shared iPad login screen.
|
||||
- key: UserIdentifier
|
||||
type: <string>
|
||||
presence: required
|
||||
content: |-
|
||||
The unique string that identifies the user of this device within the organization.
|
||||
If this payload is intended to configure the Shared iPad login screen, this value must not be set.
|
||||
- key: Departments
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
For shared iPad profiles: The array of dictionaries that defines which departments are shown in the Shared iPad login screen.
|
||||
If present, this key is used to configure both Classroom and the Shared iPad login screen.
|
||||
subkeys:
|
||||
- key: DepartmentsItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: Name
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The display name of the department.
|
||||
- key: GroupBeaconIDs
|
||||
type: <array>
|
||||
presence: required
|
||||
content: The group beacon identifiers that are members of this department.
|
||||
subkeys:
|
||||
- key: GroupBeaconIDsItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A group beacon identifier.
|
||||
- key: Groups
|
||||
type: <array>
|
||||
presence: required
|
||||
content: |-
|
||||
For shared iPad profiles: The array of dictionaries that defines which groups the user can select in the login window.
|
||||
|
||||
For leader/teacher profiles: The array of dictionaries that defines the groups that the user can control.
|
||||
|
||||
For member/student profiles: The array of dictionaries that defines the groups where the user is a member.
|
||||
subkeys:
|
||||
- key: GroupsItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: BeaconID
|
||||
type: <integer>
|
||||
presence: required
|
||||
content: The group's unique beacon ID.
|
||||
- key: Name
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The display name of the group.
|
||||
- key: Description
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The description of the group.
|
||||
- key: ImageURL
|
||||
supportedOS:
|
||||
iOS:
|
||||
deprecated: 9.3.2
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: Deprecated in iOS 9.3.1 and later. The URL of an image for the group.
|
||||
- key: ConfigurationSource
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The source that provided this group; for example, iTunesU, SIS, or
|
||||
MDM.
|
||||
- key: LeaderIdentifiers
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The user identifiers that are leaders of this group.
|
||||
subkeys:
|
||||
- key: LeaderIdentifiersItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A user identifier.
|
||||
- key: MemberIdentifiers
|
||||
type: <array>
|
||||
presence: required
|
||||
content: The entries in the Users array that are members of the group.
|
||||
subkeys:
|
||||
- key: MemberIdentifiersItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A member identifier.
|
||||
- key: DeviceGroupIdentifiers
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
The identifiers that refer to entries in the DeviceGroups array to which the instructor can assign users from this class.
|
||||
The presence/value of this key does not impact the configuration of the Shared iPad login screen.
|
||||
subkeys:
|
||||
- key: DeviceGroupIdentifiersItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A device group identifier.
|
||||
- key: Users
|
||||
type: <array>
|
||||
presence: required
|
||||
content: |-
|
||||
For shared iPad profiles: The array of dictionaries that define the users that are shown in the iOS login window.
|
||||
|
||||
For leader/teacher profiles: The array of dictionaries that define users that are members of the teacher's groups.
|
||||
|
||||
For member/student profiles: The array of dictionaries that must contain the definition of the user specified in the 'UserIdentifier' key. With one-to-one member devices, this key should include only the device user and the teacher but not other class members.
|
||||
subkeys:
|
||||
- key: UsersItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: Identifier
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The unique identifier for a user in the organization.
|
||||
- key: Name
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The name of the user.
|
||||
- key: GivenName
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The given name of the user.
|
||||
- key: FamilyName
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The family name of the user.
|
||||
- key: PhoneticGivenName
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user's phonetic given name. This name is used to sort users in
|
||||
the Classroom app and the Shared iPad Login Screen.
|
||||
- key: PhoneticFamilyName
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user's phonetic family name. This name is used to sort users in
|
||||
the Classroom app and the shared iPad login screen.
|
||||
- key: ImageURL
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
A string containing a URL pointing to an image of the user. This image will be displayed in the iOS login screen and in the Classroom app. The recommended resolution is 256 x 256 pixels (512 x 512 pixels on a 2x device). The recommended formats are JPEG, PNG, and TIFF.
|
||||
The 'ResourcePayloadCertificateUUID' identity certificate or the MDM client identity will be used to perform authentication when fetching the image.
|
||||
- key: FullScreenImageURL
|
||||
supportedOS:
|
||||
iOS:
|
||||
deprecated: 9.3.2
|
||||
macOS:
|
||||
deprecated: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: Deprecated in iOS 9.3.1 and later. The URL pointing to an image of
|
||||
the user. The 'ResourcePayloadCertificateUUID' identity certificate or the
|
||||
MDM client identity will be used to perform authentication when fetching the
|
||||
specified resource.
|
||||
- key: AppleID
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The managed Apple ID for this user.
|
||||
This key is not required to configure Classroom, but it is used by Classroom if it is present.
|
||||
This key is required when configuring the Shared iPad login screen.
|
||||
- key: PasscodeType
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- complex
|
||||
- four
|
||||
- six
|
||||
content: The type of passcode UI to show when the user is at the login window.
|
||||
- key: DeviceGroups
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: 'For leader/teacher profiles: The array of dictionaries that defines which
|
||||
device groups the leader can assign devices to. This key is not included in member
|
||||
payloads.'
|
||||
subkeys:
|
||||
- key: DeviceGroupsItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: Identifier
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The unique identifier for the device group in the organization.
|
||||
- key: Name
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The name of the device group, which must be unique in the organization.
|
||||
- key: SerialNumbers
|
||||
type: <array>
|
||||
presence: required
|
||||
content: The serial numbers of the devices in the group.
|
||||
subkeys:
|
||||
- key: SerialNumbersItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A serial number.
|
||||
- key: ScreenObservationPermissionModificationAllowed
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.3'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', allows students enrolled in managed classes to modify their
|
||||
teacher's permissions for screen observation on their device.
|
||||
@@ -0,0 +1,117 @@
|
||||
title: Exchange Web Services
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.ews.account
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: For macOS 10.9 and higher, an Exchange Web services (EWS) account is configured
|
||||
with support for Mail, Contacts, Calendar, Notes and Reminders. macOS 10.7-10.8
|
||||
only supported Contacts.
|
||||
payloadkeys:
|
||||
- key: EmailAddress
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The full email address for the account. If the email address string isn't
|
||||
present in the payload, the device prompts for it during profile installation.
|
||||
- key: Host
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The Exchange server host name or IP address.
|
||||
If using OAuth, the host name is ignored..
|
||||
- key: SSL
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', enables SSL.
|
||||
- key: OAuth
|
||||
title: Use OAuth
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.14'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: |-
|
||||
If 'true', enables OAuth for authentication. If OAuth is enabled, don't specify a password.
|
||||
Available in macOS 10.14 and later
|
||||
- key: OAuthSignInURL
|
||||
title: URL for OAuth sign-in
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.14'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The URL to load into a web view for authentication via OAuth when autodiscovery
|
||||
isn't used. This setting requires a 'Host' value.
|
||||
- key: UserName
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user name for this Exchange account. This string is required for noninteractive
|
||||
(for example, MDM) installation. If it's missing, the device prompts for it during
|
||||
interactive profile installation.
|
||||
- key: Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The password of the account. Use only with encrypted profiles.
|
||||
- key: PayloadCertificateUUID
|
||||
title: Payload Certificate UUID
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.12'
|
||||
type: <string>
|
||||
presence: optional
|
||||
format: ^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$
|
||||
content: The UUID of of the certificate payload within the same profile to use for
|
||||
the identity credential. Supported on macOS 10.12 or later.
|
||||
- key: AuthenticationCertificateUUID
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.11'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The UUID of of the certificate payload within the same profile to use for
|
||||
the identity credential. Supported on macOS 10.11 or later. On macOS 10.12 or
|
||||
later use the PayloadCertificateUUID.
|
||||
- key: allowMailDrop
|
||||
title: Allow Mail Drop
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.12'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables Mail Drop.
|
||||
- key: Path
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The server path.
|
||||
- key: Port
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The server port number.
|
||||
- key: ExternalHost
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The external server address.
|
||||
- key: ExternalSSL
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', enables SSL for connections to the external server.
|
||||
- key: ExternalPath
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The external server path.
|
||||
- key: ExternalPort
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The external server port number.
|
||||
@@ -0,0 +1,356 @@
|
||||
title: Extensible Single Sign-On (Kerberos)
|
||||
description: Configures an app extension to handle Kerberos SSO.
|
||||
payload:
|
||||
payloadtype: com.apple.extensiblesso
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
supervised: false
|
||||
allowmanualinstall: false
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: true
|
||||
allowmanualinstall: false
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: Configures the included Kerberos extension that performs SSO on behalf
|
||||
of specified hosts. User channel support was added in macOS 11.0.
|
||||
payloadkeys:
|
||||
- key: ExtensionIdentifier
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- com.apple.AppSSOKerberos.KerberosExtension
|
||||
content: This value must be 'com.apple.AppSSOKerberos.KerberosExtension' for this
|
||||
extension.
|
||||
- key: TeamIdentifier
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- apple
|
||||
content: This value must be 'apple' for the Kerberos extension.
|
||||
- key: Type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- Credential
|
||||
content: This value must be 'Credential' for the Kerberos extension.
|
||||
- key: Realm
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The Kerberos realm, which should be properly capitalized. If in an Active
|
||||
Directory forest, this is the realm where the user logs in.
|
||||
- key: ExtensionData
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: This is the dictionary used by the Apple built-in Kerberos extension.
|
||||
subkeys:
|
||||
- key: cacheName
|
||||
supportedOS:
|
||||
iOS:
|
||||
deprecated: '15.0'
|
||||
macOS:
|
||||
deprecated: '12.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The GSS name of the Kerberos cache to use. Rarely set by an administrator.
|
||||
- key: principalName
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The principal (aka username) to use. You do not need to include the realm.
|
||||
- key: siteCode
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The name of the Active Directory site the Kerberos extension should use.
|
||||
Most administrators will never need to modify this value, as the Kerberos extension
|
||||
can normally find the site automatically.
|
||||
- key: certificateUUID
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The PayloadUUID of a PKINIT certificate.
|
||||
- key: useSiteAutoDiscovery
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', the Kerberos extension doesn't automatically use LDAP and
|
||||
DNS to determine its AD site name.
|
||||
- key: credentialBundleIdACL
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: A list of bundle IDs allowed to access the ticket-granting ticket (TGT).
|
||||
subkeys:
|
||||
- key: credentialBundleIdACLItem
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: Bundle IDs allowed to access the TGT. These values are case sensitive.
|
||||
- key: includeManagedAppsInBundleIdACL
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
macOS:
|
||||
introduced: '12.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the Kerberos extension allows only managed apps to access
|
||||
and use the credential. This is in addition to the 'credentialBundleIDACL',
|
||||
if it is specified. Available in iOS 14 and later, and macOS 12 and later.
|
||||
- key: includeKerberosAppsInBundleIdACL
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: '12.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: |-
|
||||
If 'true', the Kerberos extension allows the standard kerberos utilities including 'TicketViewer' and 'klist' to access and use the credential. This is in addition to 'includeManagedAppsInBundleIdACL' or the 'credentialBundleIdACL', if it is specified.
|
||||
Available in macOS 12 and later.
|
||||
- key: domainRealmMapping
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: A custom domain-realm mapping for Kerberos. This is used when the DNS
|
||||
name of hosts do not match the realm name. Most administrators will not need
|
||||
to customize this.
|
||||
subkeys:
|
||||
- key: Realm
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The key should be the name of the realm, and the value is an array
|
||||
of DNS suffixes that map to the realm.
|
||||
subkeys:
|
||||
- key: RealmItem
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: Domains to map to the realm
|
||||
- key: isDefaultRealm
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: This property specifies it is the default realm if there is more than
|
||||
one Kerberos extension configuration.
|
||||
- key: customUsernameLabel
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
macOS:
|
||||
introduced: '11.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The custom user name label used in the Kerberos extension instead of
|
||||
“Username”. For example, “Company ID”. Available in macOS 11 and later.
|
||||
- key: helpText
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
macOS:
|
||||
introduced: '11.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The text to be displayed to the user at the bottom of the Kerberos login
|
||||
window. It can be used to display help information or disclaimer text. Available
|
||||
in iOS 14 and later and macOS 11 and later.
|
||||
- key: allowPasswordChange
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', disables password changes. Available in macOS 10.15 and later.
|
||||
- key: allowAutomaticLogin
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', passwords are not allowed to be saved to the keychain.
|
||||
- key: requireUserPresence
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', requires the user to provide Touch ID, Face ID or their passcode
|
||||
to access the keychain entry.
|
||||
- key: pwExpireOverride
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
deprecated: '12.0'
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The number of days that passwords can be used on this domain. For most
|
||||
domains, this can be calculated automatically. Available in macOS 10.15 and
|
||||
later.
|
||||
- key: pwNotificationDays
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
type: <integer>
|
||||
presence: optional
|
||||
default: 15
|
||||
content: The number of days prior to password expiration when a notification of
|
||||
password expiration will be sent to the user. Available in macOS 10.15 and later.
|
||||
- key: pwReqLength
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The minimum length of passwords on the domain.Available in macOS 10.15
|
||||
and later.
|
||||
- key: pwReqComplexity
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', passwords must meet Active Directory's definition of 'complex'.Available
|
||||
in macOS 10.15 and later.
|
||||
- key: pwReqMinAge
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The minimum age of passwords before they can be changed on this domain.
|
||||
Available in macOS 10.15 and later.
|
||||
- key: pwReqHistory
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The number of prior passwords that cannot be re-used on this domain.Available
|
||||
in macOS 10.15 and later.
|
||||
- key: pwReqText
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The text version of the domain's password requirements. Only for use
|
||||
if 'pwReqComplexity' or 'pwReqLength' aren't specified. Available in macOS 10.15
|
||||
and later.
|
||||
- key: pwChangeURL
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: This URL will launch in the user's default web browser when they initiate
|
||||
a password change. Available in macOS 10.15 and later.
|
||||
- key: syncLocalPassword
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'false', disables password sync. Note that this will not work if the
|
||||
user is logged in with a mobile account. Available in macOS 10.15 and later.
|
||||
- key: replicationTime
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: '11.0'
|
||||
deprecated: '12.0'
|
||||
type: <integer>
|
||||
presence: optional
|
||||
default: 900
|
||||
content: The time, in seconds, required to replicate changes in the Active Directory
|
||||
domain. The Kerberos extension will use this when checking password age after
|
||||
a change. Available in macOS 11 and later.
|
||||
- key: delayUserSetup
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: '11.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', doesn't prompt the user to setup the Kerberos extension until
|
||||
either the administrator enables it with the 'app-sso' tool or a Kerberos challenge
|
||||
is received. Available in macOS 11 and later.
|
||||
- key: monitorCredentialsCache
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: '11.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: |-
|
||||
If 'false', the credential is requested on the next matching Kerberos challenge or network state change.
|
||||
If the credential is expired or missing, a new one will be created. Available in macOS 11 and later.
|
||||
- key: requireTLSForLDAP
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
macOS:
|
||||
introduced: '11.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: Require that LDAP connections use TLS. Available in macOS 11 and later.
|
||||
- key: credentialUseMode
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
macOS:
|
||||
introduced: '11.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- always
|
||||
- whenNotSpecified
|
||||
- kerberosDefault
|
||||
default: always
|
||||
content: |-
|
||||
This setting affects how the Kerberos Extension credential is used by other processes. Use of the following:
|
||||
* 'always -' The extension credential will always be used if the SPN matches the Kerberos Extension 'Hosts' array. The credential will not be used if the calling app is not in the 'credentialBundleIDACL'.
|
||||
* 'whenNotSpecified -' The credential will only be used when another credential has not been specified by the caller and the SPN matches the Kerberos Extensions 'Hosts' array. The credential will not be used if the calling app is not in the 'credentialBundleIDACL'.
|
||||
* 'kerberosDefault - 'The default Kerberos processes for selecting credentials is used which normally uses the default Kerberos credential. This is the same as turning off this capability.
|
||||
Available in macOS 11 and later.
|
||||
- key: preferredKDCs
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '15.0'
|
||||
macOS:
|
||||
introduced: '12.0'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
The ordered list of perferred Key Distribution Centers (KDCs) to use for Kerberos traffic. Use this if the servers are not discoverable via DNS. If the servers are specified, then they are used for both connectivity checks and attempted first for Kerberos traffic. If the servers do not respond, then the device falls back to DNS discovery. Each entry is formatted the same as it would be in a 'krb5.conf' file. Examples of entries are:
|
||||
* 'adserver1.example.com'
|
||||
* 'tcp/adserver1.example.com:88'
|
||||
* 'kkdcp://kerberosproxy.example.com:443/kkdcp'
|
||||
subkeys:
|
||||
- key: preferredKDC
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A host or domain name in the format of [protocol/]hostname[:port][/path]
|
||||
- key: Hosts
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
One or more host or domain names for which the app extension performs SSO. Host or domain names are matched case-insensitively, and all the host/domain names of all installed Extensible SSO payloads must be unique.
|
||||
Hosts that begin with a “.” are wildcard suffixes and will match all subdomains, otherwise the host must be an exact match.
|
||||
subkeys:
|
||||
- key: hostname
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A host or domain name. Values that begin with a "." will be used as domain
|
||||
names.
|
||||
@@ -0,0 +1,119 @@
|
||||
title: Extensible Single Sign-On
|
||||
description: Configures an app extension to handle SSO.
|
||||
payload:
|
||||
payloadtype: com.apple.extensiblesso
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
supervised: false
|
||||
allowmanualinstall: false
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: true
|
||||
allowmanualinstall: false
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: Configures an app extension that performs SSO on behalf of certain URLs.
|
||||
User channel support was added in macOS 11.0.
|
||||
payloadkeys:
|
||||
- key: ExtensionIdentifier
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The bundle identifier of the app extension that performs SSO for the specified
|
||||
URLs.
|
||||
- key: TeamIdentifier
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The team identifier of the app extension.
|
||||
This key is required on macOS and ignored elsewhere.
|
||||
- key: Type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- Credential
|
||||
- Redirect
|
||||
content: The type of SSO.
|
||||
- key: Realm
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The realm name for 'Credential' payloads. Use proper capitalization for this value.
|
||||
This key is ignored for 'Redirect' payloads.
|
||||
- key: ExtensionData
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: A dictionary of arbitrary data passed through to the app extension.
|
||||
subkeys:
|
||||
- key: ANY
|
||||
type: <any>
|
||||
presence: optional
|
||||
content: Keys and values to be passed to the app extension.
|
||||
- key: URLs
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
An array of URL prefixes of identity providers where the app extension performs SSO.
|
||||
Required for 'Redirect' payloads. Ignored for 'Credential' payloads.
|
||||
The URLs must begin with 'http://' or 'https://', the scheme and host name are matched case-insensitively, query parameters and URL fragments are not allowed, and the URLs of all installed Extensible SSO payloads must be unique.
|
||||
subkeys:
|
||||
- key: URL
|
||||
type: <string>
|
||||
presence: required
|
||||
content: An http or https URL prefix.
|
||||
- key: Hosts
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
An array of host names or domain names that apps can authenticate through the app extension.
|
||||
Required for 'Credential' payloads. Ignored for 'Redirect' payloads.
|
||||
Host or domain names are matched case-insensitively, and all the host/domain names of all installed Extensible SSO payloads must be unique.
|
||||
Hosts that begin with a “.” are wildcard suffixes and match all subdomains; otherwise the host must be an exact match.
|
||||
subkeys:
|
||||
- key: hostname
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A host or domain name, with or without a leading dot.
|
||||
- key: ScreenLockedBehavior
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '15.0'
|
||||
macOS:
|
||||
introduced: '12.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- Cancel
|
||||
- DoNotHandle
|
||||
default: Cancel
|
||||
content: |-
|
||||
If set to 'Cancel', the system cancels authentication requests when the screen is locked. If set to 'DoNotHandle', the request continues without SSO instead. This does not apply to requests where 'userInterfaceEnabled' is set to 'false' or background NSURLSession requests.
|
||||
Available in iOS 15 and later and macOS 12 and later.
|
||||
- key: DeniedBundleIdentifiers
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '15.0'
|
||||
macOS:
|
||||
introduced: '12.0'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
An array of bundle identifiers of apps that don't use SSO provided by this extension.
|
||||
Available in iOS 15 and later and macOS 12 and later.
|
||||
subkeys:
|
||||
- key: bundleIdentifier
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The bundle identifier of the app.
|
||||
@@ -0,0 +1,69 @@
|
||||
title: 'Parental Controls: Content Filter'
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.familycontrols.contentfilter
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Parental controls web filter.
|
||||
payloadkeys:
|
||||
- key: restrictWeb
|
||||
type: <boolean>
|
||||
presence: required
|
||||
content: If 'true', enables web content filters.
|
||||
- key: useContentFilter
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', filters content automatically.
|
||||
- key: whitelistEnabled
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables web content filters.
|
||||
- key: siteWhitelist
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
An array of sites that defines an allow list. If specified, this defines additional allowed sites besides those in the automated allow list and deny list, including disallowed adult sites.
|
||||
|
||||
This key is required if 'whiteListEnabled' is 'true'.
|
||||
subkeys:
|
||||
- key: siteWhitelistItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: address
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The site prefix, including http(s) scheme.
|
||||
- key: pageTitle
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The site page title.
|
||||
- key: filterWhitelist
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The array of URLs that defines an allow list. When 'restrictWeb' and 'useContentFilter'
|
||||
are enabled, only URLs in the allow list are available to the user.
|
||||
subkeys:
|
||||
- key: filterWhitelistItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: An allowed site.
|
||||
- key: filterBlacklist
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The array of URLs that defines a deny list. When 'restrictWeb' and 'useContentFilter'
|
||||
are enabled, no URLs in the deny list are available to the user.
|
||||
subkeys:
|
||||
- key: filterBlacklistItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A disallowed site.
|
||||
@@ -0,0 +1,75 @@
|
||||
title: 'Parental Controls: Time Limits'
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.familycontrols.timelimits.v2
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Parental controls time limits.
|
||||
payloadkeys:
|
||||
- key: familyControlsEnabled
|
||||
type: <boolean>
|
||||
presence: required
|
||||
content: If 'true', enables time limits.
|
||||
- key: time-limits
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The time limits to enforce if 'familyControlsEnabled' is enabled.
|
||||
subkeys:
|
||||
- key: weekday-allowance
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The weekday allowance settings.
|
||||
subkeytype: Allowance
|
||||
subkeys: &id001
|
||||
- key: enabled
|
||||
type: <boolean>
|
||||
presence: required
|
||||
content: If 'true', enable these settings.
|
||||
- key: rangeType
|
||||
type: <integer>
|
||||
presence: required
|
||||
rangelist:
|
||||
- 0
|
||||
- 1
|
||||
content: |-
|
||||
The type of day range:
|
||||
0 = Weekday
|
||||
1 = Weekend
|
||||
- key: start
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The curfew start time, in the format '%d:%d:%d'.
|
||||
- key: end
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The curfew end time, in the format '%d:%d:%d'.
|
||||
- key: secondsPerDay
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The allowance for that day, in seconds.
|
||||
- key: weekday-curfew
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The weekday curfew settings.
|
||||
subkeytype: Allowance
|
||||
subkeys: *id001
|
||||
- key: weekend-allowance
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The weekend allowance settings.
|
||||
subkeytype: Allowance
|
||||
subkeys: *id001
|
||||
- key: weekend-curfew
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The weekend curfew settings.
|
||||
subkeytype: Allowance
|
||||
subkeys: *id001
|
||||
@@ -0,0 +1,21 @@
|
||||
title: File Provider
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.fileproviderd
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '11.0'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: true
|
||||
allowmanualinstall: false
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: AllowManagedFileProvidersToRequestAttribution
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables file providers access to the path of the requesting
|
||||
process.
|
||||
@@ -0,0 +1,70 @@
|
||||
title: Finder
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.finder
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: ProhibitBurn
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the Finder's burn support.
|
||||
- key: InterfaceLevel
|
||||
supportedOS:
|
||||
macOS:
|
||||
removed: '10.15'
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- Simple
|
||||
- Full
|
||||
content: If Finder should operate in Simple or Full mode.
|
||||
- key: ProhibitConnectTo
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If set to true, Connect to Server will be disabled.
|
||||
- key: ProhibitEject
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If set to true, Eject will be disabled.
|
||||
- key: ProhibitGoToFolder
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If set to true, Go To Folder will be disabled.
|
||||
- key: ShowExternalHardDrivesOnDesktop
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If set to false, extneral hard drives will not appear on the desktop.
|
||||
- key: ShowHardDrivesOnDesktop
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If set to false, internal hard drives will not appear on the desktop.
|
||||
- key: ShowMountedServersOnDesktop
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If set to false, mounted file servers will not appear on the desktop.
|
||||
- key: ShowRemovableMediaOnDesktop
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If set to false, removable media will not appear on the desktop.
|
||||
- key: WarnOnEmptyTrash
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If set to false, user will not be warned before emptying the trash.
|
||||
@@ -0,0 +1,21 @@
|
||||
title: '802.1X: First Active Ethernet'
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.firstactiveethernet.managed
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
payloadkeys:
|
||||
- key: ANY
|
||||
type: <any>
|
||||
presence: optional
|
||||
content: Keys relevant to 802.1x configuration. User enrollment payloads do not
|
||||
support the various proxy keys including ProxyType, ProxyServer, ProxyServerPort,
|
||||
ProxyUsername, ProxyPassword,, ProxyPACURL and ProxyPACFallbackAllowed.
|
||||
@@ -0,0 +1,21 @@
|
||||
title: '802.1X: First Ethernet'
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.firstethernet.managed
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
payloadkeys:
|
||||
- key: ANY
|
||||
type: <any>
|
||||
presence: optional
|
||||
content: Keys relevant to 802.1x configuration. User enrollment payloads do not
|
||||
support the various proxy keys including ProxyType, ProxyServer, ProxyServerPort,
|
||||
ProxyUsername, ProxyPassword,, ProxyPACURL and ProxyPACFallbackAllowed.
|
||||
@@ -0,0 +1,40 @@
|
||||
title: Font
|
||||
description: Use this section to define Font settings.
|
||||
payload:
|
||||
payloadtype: com.apple.font
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '7.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: forbidden
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: |-
|
||||
Each payload may contain one font file. Font files may be in TrueType (.ttf) or OpenType (.otf) file format. Collection types (.ttc or .otc) formats are not supported.
|
||||
Fonts are uniqued internally by their embedded PostScript name. Two fonts with the same PostScript name will be considered the same font, even if their contents differ. Installing two different fonts with the same PostScript name is not supported, and it is undefined which font will remain installed.
|
||||
payloadkeys:
|
||||
- key: Name
|
||||
title: Font Name
|
||||
type: <string>
|
||||
presence: optional
|
||||
default: ''
|
||||
content: |-
|
||||
The user-visible name for the font. This field is replaced by the actual name of the font after installation. Each payload must contain exactly one font file in trueType (.ttf) or OpenType (.otf) format. Collection formats (.ttc or .otc) are not supported.
|
||||
|
||||
Fonts are identified by their embedded PostScript names. Two fonts with the same PostScript name are considered to be the same font even if their contents differ. Installing two different fonts with the same PostScript name isn't supported, and the resulting behavior is undefined.
|
||||
- key: Font
|
||||
title: Font
|
||||
type: <data>
|
||||
presence: required
|
||||
content: The contents of the font file.
|
||||
@@ -0,0 +1,45 @@
|
||||
title: 'Parental Controls: Game Center'
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.gamed
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Parental controls Game Center restrictions.
|
||||
payloadkeys:
|
||||
- key: GKFeatureGameCenterAllowed
|
||||
supportedOS:
|
||||
macOS:
|
||||
deprecated: '10.13'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', enables Game Center.
|
||||
- key: GKFeatureAccountModificationAllowed
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', allows account modifications.
|
||||
- key: GKFeatureAddingGameCenterFriendsAllowed
|
||||
supportedOS:
|
||||
macOS:
|
||||
deprecated: '10.13'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', allows adding Game Center friends.
|
||||
- key: GKFeatureMultiplayerGamingAllowed
|
||||
supportedOS:
|
||||
macOS:
|
||||
deprecated: '10.13'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', allows multiplayer gaming.
|
||||
@@ -0,0 +1,21 @@
|
||||
title: '802.1X: Global Ethernet'
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.globalethernet.managed
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.13'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
payloadkeys:
|
||||
- key: ANY
|
||||
type: <any>
|
||||
presence: optional
|
||||
content: Keys relevant to 802.1x configuration. User enrollment payloads do not
|
||||
support the various proxy keys including ProxyType, ProxyServer, ProxyServerPort,
|
||||
ProxyUsername, ProxyPassword,, ProxyPACURL and ProxyPACFallbackAllowed.
|
||||
@@ -0,0 +1,82 @@
|
||||
title: Google Account
|
||||
description: Use this section to configure Google accounts. The user will be prompted
|
||||
to sign in afterward.
|
||||
payload:
|
||||
payloadtype: com.apple.google-oauth
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '9.3'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: A Google account payload sets up a Google email address as well as any
|
||||
other Google services the user enables after authentication. Google accounts must
|
||||
be installed via MDM or by Apple Configurator 2 (if the device is supervised).
|
||||
The payload never contains credentials and the user will be prompted to enter
|
||||
their credentials shortly after the payload successfully installs. On Shared iPads,
|
||||
this payload can only be installed on the MDM user channel.
|
||||
payloadkeys:
|
||||
- key: AccountDescription
|
||||
title: Account Description
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: A user-visible description of the Google account, shown in the Mail and
|
||||
Settings apps.
|
||||
- key: AccountName
|
||||
title: Account Name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user's full name for the Google account. This name appears in sent
|
||||
messages.
|
||||
- key: EmailAddress
|
||||
title: Email Address
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The full Google email address for the account.
|
||||
- key: CommunicationServiceRules
|
||||
title: Communication Service Rules
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.0'
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The communication service handler rules for this account.
|
||||
subkeys:
|
||||
- key: DefaultServiceHandlers
|
||||
title: Default Service Handlers
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: A dictionary defining which app to use for audio calls made from this
|
||||
account.
|
||||
subkeys:
|
||||
- key: AudioCall
|
||||
title: App for audio calls
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: A string containing the bundle identifier for the default application
|
||||
that handles audio calls made to contacts from this account.
|
||||
- key: VPNUUID
|
||||
title: VPNUUID
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The VPNUUID of the per-app VPN the account uses for network communication.
|
||||
Available in iOS 14 and later.
|
||||
@@ -0,0 +1,77 @@
|
||||
title: Home Screen Layout
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.homescreenlayout
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '9.3'
|
||||
supervised: true
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
tvOS:
|
||||
introduced: '11.0'
|
||||
supervised: true
|
||||
allowmanualinstall: true
|
||||
content: The payload defines a layout of apps, folders, & web clips for the Home
|
||||
screen.
|
||||
payloadkeys:
|
||||
- key: Dock
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of dictionaries, each of which must conform to the icon dictionary
|
||||
format. If this key isn't present, the user's dock is empty.
|
||||
subkeytype: IconItem
|
||||
subkeys: &id001
|
||||
- key: IconItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: Type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- App
|
||||
- Folder
|
||||
- WebClip
|
||||
content: The type of the dock item.
|
||||
- key: DisplayName
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The human-readable string shown to the user. This setting is valid
|
||||
only if the type is 'Folder'.
|
||||
- key: BundleID
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The bundle identifier of the app. This setting is required if the type
|
||||
is 'Application'.
|
||||
- key: Pages
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of arrays of dictionaries, each conforming to the icon dictionary
|
||||
format. This setting is valid only if the type is 'Folder'.
|
||||
subkeytype: PagesItem
|
||||
subkeys: &id002
|
||||
- key: PagesItem
|
||||
type: <array>
|
||||
subkeytype: IconItem
|
||||
subkeys: *id001
|
||||
- key: URL
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '11.3'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The URL of the existing web clip for this item. This setting is required if 'type' is 'WebClip'. If more than one web clip exists with the same URL, the behavior is undefined.
|
||||
Specifying a web clip in this payload doesn't create the web clip. Use the WebClip payload to create a web clip.
|
||||
- key: Pages
|
||||
type: <array>
|
||||
presence: required
|
||||
content: An array of arrays of dictionaries, each of which must conform to the icon
|
||||
dictionary format.
|
||||
subkeytype: PagesItem
|
||||
subkeys: *id002
|
||||
@@ -0,0 +1,26 @@
|
||||
title: 'Parental Control: Dictation and Profanity'
|
||||
description: Parental controls for restricting Siri, Dictation and Profanity
|
||||
payload:
|
||||
payloadtype: com.apple.ironwood.support
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
deprecated: '10.13'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: Profanity Allowed
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', suppresses profanity.
|
||||
- key: Ironwood Allowed
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', disables dictation.
|
||||
@@ -0,0 +1,61 @@
|
||||
title: Jabber Account
|
||||
description: Use this section to define settings for configuration access to Jabber
|
||||
servers.
|
||||
payload:
|
||||
payloadtype: com.apple.jabber.account
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
deprecated: '10.14'
|
||||
removed: '10.14'
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: A Jabber payload creates a Jabber account on the device.
|
||||
payloadkeys:
|
||||
- key: JabberAccountDescription
|
||||
title: Account Description
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The description of the account.
|
||||
- key: JabberHostName
|
||||
title: Account Hostname
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The server's address.
|
||||
- key: JabberUserName
|
||||
title: Account Username
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user's user name.
|
||||
- key: JabberPassword
|
||||
title: Account Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user's password.
|
||||
- key: JabberUseSSL
|
||||
title: Use SSL
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables SSL.
|
||||
- key: JabberPort
|
||||
title: Port Number
|
||||
type: <integer>
|
||||
presence: optional
|
||||
range:
|
||||
min: 0
|
||||
max: 65535
|
||||
default: 5222
|
||||
content: The server's port.
|
||||
- key: JabberAuthentication
|
||||
title: Jabber Authentification
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- JabberAuthPassword
|
||||
content: The authentication method for the account.
|
||||
@@ -0,0 +1,98 @@
|
||||
title: LDAP
|
||||
description: Use this section to define settings for configuration access to LDAP
|
||||
servers.
|
||||
payload:
|
||||
payloadtype: com.apple.ldap.account
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
payloadkeys:
|
||||
- key: LDAPAccountDescription
|
||||
title: Account Description
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The description of the account.
|
||||
- key: LDAPAccountHostName
|
||||
title: Account Hostname
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The server's address.
|
||||
- key: LDAPAccountUserName
|
||||
title: Account Username
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user's user name.
|
||||
- key: LDAPAccountPassword
|
||||
title: Account Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user's password. The password is enabled only with encrypted profiles.
|
||||
- key: LDAPAccountUseSSL
|
||||
title: Use SSL
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', enables SSL.
|
||||
- key: LDAPSearchSettings
|
||||
title: Search Settings
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of search settings dictionaries.
|
||||
subkeys:
|
||||
- key: LDAPSearchSettingsItem
|
||||
title: An LDAP Search Setting
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: LDAPSearchSettingDescription
|
||||
title: Description
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The description of this search setting.
|
||||
- key: LDAPSearchSettingSearchBase
|
||||
title: Search Setting Search Base
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The path to the node where a search should start.
|
||||
- key: LDAPSearchSettingScope
|
||||
title: Search Setting Scope
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- LDAPSearchSettingScopeBase
|
||||
- LDAPSearchSettingScopeOneLevel
|
||||
- LDAPSearchSettingScopeSubtree
|
||||
default: LDAPSearchSettingScopeSubtree
|
||||
content: |-
|
||||
The type of recursion to use in the search. It is one of the following values:
|
||||
* 'LDAPSearchSettingScopeBase': Only the immediate node that the search base points to.
|
||||
* 'LDAPSearchSettingScopeOneLevel': The node plus its immediate children.
|
||||
* 'LDAPSearchSettingScopeSubtree': The node plus all children, regardless of depth.
|
||||
- key: VPNUUID
|
||||
title: VPNUUID
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The VPNUUID of the per-app VPN the account uses for network communication.
|
||||
Available in iOS 14 and later.
|
||||
@@ -0,0 +1,35 @@
|
||||
title: 'Login Items: Managed Items'
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.loginitems.managed
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.13'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: This payload handles login items usage on macOS.
|
||||
payloadkeys:
|
||||
- key: AutoLaunchedApplicationDictionary-managed
|
||||
type: <array>
|
||||
presence: required
|
||||
content: An array of login item dictionaries.
|
||||
subkeys:
|
||||
- key: LoginItem
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: A login item.
|
||||
subkeys:
|
||||
- key: Path
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The URL or path string to the item's location.
|
||||
- key: Hide
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If true, hide this item in the Users & Groups login items list.
|
||||
@@ -0,0 +1,155 @@
|
||||
title: Login Window
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.loginwindow
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: The com.apple.loginwindow payload creates managed preferences on macOS
|
||||
for system/device profiles.
|
||||
payloadkeys:
|
||||
- key: SHOWFULLNAME
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', shows the name and password dialog; if 'false', displays a list
|
||||
of users.
|
||||
- key: HideLocalUsers
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', shows only network and system users when showing a user list.
|
||||
- key: IncludeNetworkUser
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', shows network users when showing a user list.
|
||||
- key: HideAdminUsers
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', hides administrator users when showing a user list.
|
||||
- key: SHOWOTHERUSERS_MANAGED
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', displays Other... when showing a list of users.
|
||||
- key: AdminHostInfo
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- HostName
|
||||
- SystemVersion
|
||||
- IPAddress
|
||||
content: If this key is included in the payload, its value is displayed in the login
|
||||
window as additional computer information. Before macOS 10.10, this string could
|
||||
contain only certain information (host name, system version, or IP address). After
|
||||
macOS 10.10, setting this key to any value allows the user to click the time area
|
||||
of the menu bar to toggle through various computer information values.
|
||||
- key: AllowList
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The list of user GUIDs or group GUIDs of users that are allowed to log
|
||||
in. An asterisk '*' string specifies all users or groups.
|
||||
subkeys:
|
||||
- key: AllowListItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A user or group GUID.
|
||||
- key: DenyList
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The list of user GUIDs or group GUIDs of users that cannot log in. This
|
||||
list takes priority over the list in the 'AllowList' key.
|
||||
subkeys:
|
||||
- key: DenyListItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A user or group GUID.
|
||||
- key: HideMobileAccounts
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', hides mobile account users in a user list. In some cases, mobile
|
||||
users show up as network users.
|
||||
- key: ShutDownDisabled
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the Shut Down button.
|
||||
- key: RestartDisabled
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the Restart item.
|
||||
- key: SleepDisabled
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the Sleep button.
|
||||
- key: DisableConsoleAccess
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disregards the '>console' special user name, which will provide
|
||||
a command line UI.
|
||||
- key: LoginwindowText
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The text to display in the login window.
|
||||
- key: ShutDownDisabledWhileLoggedIn
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the Shut Down menu item when the user is logged in.
|
||||
- key: RestartDisabledWhileLoggedIn
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the Restart menu item when the user is logged in.
|
||||
- key: PowerOffDisabledWhileLoggedIn
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the Power Off menu item when the user is logged in.
|
||||
- key: LogOutDisabledWhileLoggedIn
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.13'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the Log Out menu item when the user is logged in. Available
|
||||
in macOS 10.13 and later.
|
||||
- key: DisableScreenLockImmediate
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.13'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the immediate Screen Lock functions. Available in macOS
|
||||
10.13 and later.
|
||||
- key: showInputMenu
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.8'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'True', shows the Input Menu in the login window.
|
||||
- key: DisableFDEAutoLogin
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If t'rue', disables the automatic login option when using FileVault.
|
||||
@@ -0,0 +1,49 @@
|
||||
title: Lights Out Management (LOM)
|
||||
description: Configures a computer to send or receive "PowerON". "PowerOFF", "Reset"
|
||||
requests.
|
||||
payload:
|
||||
payloadtype: com.apple.lom
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '11.0'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: true
|
||||
allowmanualinstall: false
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Configures a computer to send or receive "PowerON". "PowerOFF", "Reset"
|
||||
requests.
|
||||
payloadkeys:
|
||||
- key: DeviceCertificateUUID
|
||||
title: Device Certificate payload UUID
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The UUID certificate for the device. This key indicates the device can
|
||||
receive 'PowerON', 'PowerOFF', and 'Reset' requests from a LOM controller.
|
||||
- key: ControllerCertificateUUID
|
||||
title: Controller Certificate payload UUID
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The UUID certificate for the LOM controller. This key configures the device
|
||||
to accept the LOMDeviceRequestCommand from MDM and then send it to the target
|
||||
device.
|
||||
- key: DeviceCACertificateUUIDs
|
||||
title: CA certificate payload UUIDs
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Array of payload UUIDs containing CA certificates that controllers use
|
||||
to evaluate trust of device certificates.
|
||||
subkeys:
|
||||
- key: DeviceCACertificateUUIDsItem
|
||||
type: <string>
|
||||
- key: ControllerCACertificateUUIDs
|
||||
title: CA certificate payload UUIDs
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: Array of payload UUIDs containing CA certificates that devices use to evaluate
|
||||
trust of controller certificates.
|
||||
subkeys:
|
||||
- key: ControllerCACertificateUUIDsItem
|
||||
type: <string>
|
||||
@@ -0,0 +1,338 @@
|
||||
title: Mail
|
||||
description: Use this section to define settings for access to Email servers.
|
||||
payload:
|
||||
payloadtype: com.apple.mail.managed
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: An email payload creates an email account on the device.
|
||||
payloadkeys:
|
||||
- key: EmailAccountDescription
|
||||
title: Account Description
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: A user-visible description of the email account, shown in the Mail and
|
||||
Settings applications.
|
||||
- key: EmailAccountName
|
||||
title: Account Name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The full user name for the account. This name is shown in sent messages.
|
||||
- key: EmailAccountType
|
||||
title: Account Type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- EmailTypeIMAP
|
||||
- EmailTypePOP
|
||||
content: Defines the protocol to be used for the account.
|
||||
- key: EmailAddress
|
||||
title: Email Address
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The full email address for the account. If this string isn't present in
|
||||
the payload, the device prompts for this string during interactive profile installation
|
||||
in Settings or System Preferences.
|
||||
- key: IncomingMailServerAuthentication
|
||||
title: Incoming Mail Server Authentification
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- EmailAuthNone
|
||||
- EmailAuthPassword
|
||||
- EmailAuthCRAMMD5
|
||||
- EmailAuthNTLM
|
||||
- EmailAuthHTTPMD5
|
||||
content: The authentication scheme for incoming mail.
|
||||
- key: IncomingMailServerHostName
|
||||
title: Mail Server
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The incoming mail server host name.
|
||||
- key: IncomingMailServerPortNumber
|
||||
title: Port
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The incoming mail server port number. If no port number is specified, the
|
||||
default port for a given protocol is used.
|
||||
- key: IncomingMailServerUseSSL
|
||||
title: Use SSL
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables SSL for authentication on the incoming mail server.
|
||||
- key: IncomingMailServerUsername
|
||||
title: Username
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user name for the email account, usually the same as the email address
|
||||
up to the @ character. If the user name isn't present in the payload and the account
|
||||
is set up to require authentication for incoming email, the device prompts for
|
||||
this string during interactive profile installation in Settings or System Preferences.
|
||||
- key: IncomingPassword
|
||||
title: Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The password for the incoming mail server. This password is used only with
|
||||
encrypted profiles.
|
||||
- key: OutgoingPassword
|
||||
title: Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The password for the outgoing mail server. This password is used only with
|
||||
encrypted profiles.
|
||||
- key: OutgoingPasswordSameAsIncomingPassword
|
||||
title: Outgoing Password Same As Incoming
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: |-
|
||||
If 'true', the user is prompted only once for the password, which is used for both outgoing and incoming mail.
|
||||
This setting is only supported by interactive profile installations. Not supported by non-interactive installations (like MDM on iOS).
|
||||
- key: OutgoingMailServerAuthentication
|
||||
title: Authentication Type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- EmailAuthNone
|
||||
- EmailAuthPassword
|
||||
- EmailAuthCRAMMD5
|
||||
- EmailAuthNTLM
|
||||
- EmailAuthHTTPMD5
|
||||
content: The authentication scheme for outgoing mail.
|
||||
- key: OutgoingMailServerHostName
|
||||
title: Mail Server
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The outgoing mail server host name.
|
||||
- key: OutgoingMailServerPortNumber
|
||||
title: Port
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The outgoing mail server port number. If no port number is specified, ports
|
||||
25, 587, and 465 are used, in that order.
|
||||
- key: OutgoingMailServerUseSSL
|
||||
title: Use SSL
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables SSL authentication on the outgoing mail server.
|
||||
- key: OutgoingMailServerUsername
|
||||
title: Username
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user name for the email account, usually the same as the email address
|
||||
up to the @ character. If the user name isn't present in the payload and the account
|
||||
is set up to require authentication for outgoing email, the device prompts for
|
||||
this string during interactive profile installation in Settings or System Preferences.
|
||||
- key: PreventMove
|
||||
title: Prevent Move
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '5.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', prevents messages from being moved out of this email account
|
||||
and into another account. It also prevents forwarding or replying from an account
|
||||
other than one the message was sent to.
|
||||
- key: PreventAppSheet
|
||||
title: Prevent App Sheet
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '5.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', prevents this account from sending mail in any app other than
|
||||
the Apple Mail app.
|
||||
- key: SMIMEEnabled
|
||||
title: S/MIME Enabled
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '5.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables S/MIME encryption. In iOS 10.0 and later, this key is
|
||||
ignored.
|
||||
- key: SMIMESigningEnabled
|
||||
title: S/MIME Signing Enabled
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables S/MIME signing for this account.
|
||||
- key: SMIMESigningCertificateUUID
|
||||
title: S/MIME Signing Certificate
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '5.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
format: ^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$
|
||||
content: The payload UUID of the identity certificate used to sign messages sent
|
||||
from this account.
|
||||
- key: SMIMEEncryptionEnabled
|
||||
title: S/MIME Encryption Enabled
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '10.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables S/MIME encryption for this account.
|
||||
- key: SMIMEEncryptionCertificateUUID
|
||||
title: S/MIME Encryption Certificate
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '5.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
format: ^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$
|
||||
content: The UUID of the identity certificate used to decrypt messages sent to this
|
||||
account. The public certificate is attached to outgoing mail to allow encrypted
|
||||
mail to be sent to this user. When the user sends encrypted mail, the public certificate
|
||||
is used to encrypt the copy of the mail in their Sent mailbox.
|
||||
- key: SMIMEEnablePerMessageSwitch
|
||||
title: S/MIME Enable Per-Message Switch
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '8.0'
|
||||
deprecated: '10.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: |-
|
||||
If 'true', displays the per-message encryption switch in the Mail Compose UI.
|
||||
|
||||
As of iOS 12.0, this key is deprecated. Use 'SMIMEEnableEncryptionPerMessageSwitch' instead.
|
||||
- key: disableMailRecentsSyncing
|
||||
title: Disable Mail Recents Syncing
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '6.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', excludes this account from Recent Addresses syncing.
|
||||
- key: allowMailDrop
|
||||
title: Allow Mail Drop
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '9.2'
|
||||
macOS:
|
||||
introduced: '10.12'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables this account to use Mail Drop.
|
||||
- key: IncomingMailServerIMAPPathPrefix
|
||||
title: Path Prefix
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The path prefix for the IMAP mail server.
|
||||
- key: SMIMESigningUserOverrideable
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the user can turn S/MIME signing on or off in Settings.
|
||||
- key: SMIMESigningCertificateUUIDUserOverrideable
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the user can select the signing identity.
|
||||
- key: SMIMEEncryptByDefault
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', enables S/MIME encryption by default.
|
||||
- key: SMIMEEncryptByDefaultUserOverrideable
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the user can turn encryption by default on/off, and encryption
|
||||
is on.
|
||||
- key: SMIMEEncryptionCertificateUUIDUserOverrideable
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the user can select the S/MIME encryption identity, and encryption
|
||||
is on.
|
||||
- key: SMIMEEnableEncryptionPerMessageSwitch
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', displays the per-message encryption switch in the Mail Compose
|
||||
UI.
|
||||
- key: VPNUUID
|
||||
title: VPNUUID
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The VPNUUID of the per-app VPN the account uses for network communication.
|
||||
Available in iOS 14 and later.
|
||||
@@ -0,0 +1,134 @@
|
||||
title: Managed Menu Extras
|
||||
payload:
|
||||
payloadtype: com.apple.mcxMenuExtras
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: |-
|
||||
Specified menu extras will be added or removed from the menu bar
|
||||
after user login. Standard menu extra may be specified by file
|
||||
name. Non-standard menu extras are specified by full path.
|
||||
payloadkeys:
|
||||
- key: delaySeconds
|
||||
type: <real>
|
||||
presence: optional
|
||||
default: 2.5
|
||||
content: The number of seconds to delay after login before adding or removing menu
|
||||
extras. If the delay is too short, the menu extras don't appear, or disappear
|
||||
from the menu bar.
|
||||
- key: maxWaitSeconds
|
||||
type: <real>
|
||||
presence: optional
|
||||
default: 20.0
|
||||
content: The maximum wait, in seconds, for all menu extras to be added or removed.
|
||||
- key: AirPort.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the AirPort menu extra.
|
||||
- key: Battery.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the Battery menu extra.
|
||||
- key: Bluetooth.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the Bluetooth menu extra.
|
||||
- key: CPU.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the CPU menu extra.
|
||||
- key: Clock.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the Clock menu extra.
|
||||
- key: Displays.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the Displays menu extra.
|
||||
- key: Eject.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the Eject menu extra.
|
||||
- key: Fax.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the Fax menu extra.
|
||||
- key: HomeSync.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the HomeSync menu extra.
|
||||
- key: iChat.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the iChat menu extra.
|
||||
- key: Ink.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the Ink menu extra.
|
||||
- key: IrDA.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the IrDA menu extra.
|
||||
- key: PCCard.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the PCCard menu extra.
|
||||
- key: PPP.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the PPP menu extra.
|
||||
- key: PPPoE.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the PPPoE menu extra.
|
||||
- key: RemoteDesktop.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the Remote Desktop menu extra.
|
||||
- key: Script Menu.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the Script menu extra.
|
||||
- key: Spaces.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the Spaces menu extra.
|
||||
- key: Sync.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the Sync menu extra.
|
||||
- key: TextInput.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the Text Input menu extra.
|
||||
- key: TimeMachine.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the TimeMachine menu extra.
|
||||
- key: UniversalAccess.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the Universal Access menu extra.
|
||||
- key: User.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the User menu extra.
|
||||
- key: VPN.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the VPN menu extra.
|
||||
- key: Volume.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the Volume menu extra.
|
||||
- key: WWAN.menu
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables the WWAN menu extra.
|
||||
@@ -0,0 +1,49 @@
|
||||
title: 'Login Window: Scripts'
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.mcxloginscripts
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Login and logout managed script handling
|
||||
payloadkeys:
|
||||
- key: loginscripts
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of one or more dictionaries of scripts to run at user login time.
|
||||
subkeytype: ScriptsItems
|
||||
subkeys: &id001
|
||||
- key: ScriptsItems
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: filename
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The filename for display purposes.
|
||||
- key: filedata
|
||||
type: <data>
|
||||
presence: required
|
||||
content: The UTF-8 encoded data object representing the executable script.
|
||||
- key: logoutscripts
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of one or more dictionaries of scripts to run at user logout time.
|
||||
subkeytype: ScriptsItems
|
||||
subkeys: *id001
|
||||
- key: skipLoginHook
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', doesn't execute the login scripts during login.
|
||||
- key: skipLogoutHook
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', doesn't execute the logout scripts during logout.
|
||||
@@ -0,0 +1,100 @@
|
||||
title: Printing
|
||||
payload:
|
||||
payloadtype: com.apple.mcxprinting
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: RequireAdminToAddPrinters
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', requires an administrator password to add printers.
|
||||
- key: AllowLocalPrinters
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', allows printers that connect directly to a user's computer.
|
||||
- key: RequireAdminToPrintLocally
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', requires an administrator password to print locally.
|
||||
- key: ShowOnlyManagedPrinters
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', shows only managed printers.
|
||||
- key: PrintFooter
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', prints the page footer (including the user name and date).
|
||||
- key: PrintMACAddress
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', includes the MAC address.
|
||||
- key: FooterFontSize
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The footer font size.
|
||||
- key: FooterFontName
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The footer font name.
|
||||
- key: DefaultPrinter
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The default printer for the user.
|
||||
subkeys:
|
||||
- key: DeviceURI
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The device URI.
|
||||
- key: DisplayName
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The display name.
|
||||
- key: UserPrinterList
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The printers available to a user.
|
||||
subkeys:
|
||||
- key: Printer
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: A dictionary of printer details.
|
||||
subkeys:
|
||||
- key: DeviceURI
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The device URI.
|
||||
- key: DisplayName
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The display name.
|
||||
- key: Location
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The printer's location.
|
||||
- key: Model
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The printer's model.
|
||||
- key: PrinterLocked
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', locks the printer.
|
||||
- key: PPDURL
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The printer's PPDURL.
|
||||
@@ -0,0 +1,246 @@
|
||||
title: MDM
|
||||
description: Use this section to define settings for mobile device management.
|
||||
payload:
|
||||
payloadtype: com.apple.mdm
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
tvOS:
|
||||
introduced: '6.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
payloadkeys:
|
||||
- key: IdentityCertificateUUID
|
||||
title: Identity Certificate UUID
|
||||
type: <string>
|
||||
presence: required
|
||||
format: ^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$
|
||||
content: The UUID of the certificate payload for the device's identity. It may also
|
||||
point to a SCEP payload.
|
||||
- key: Topic
|
||||
title: Topic
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The topic that MDM listens to for push notifications. The certificate that
|
||||
the server uses to send push notifications must have the same topic in its subject.
|
||||
The topic must begin with the 'com.apple.mgmt.' prefix.
|
||||
- key: ServerURL
|
||||
title: Server URL
|
||||
type: <string>
|
||||
presence: required
|
||||
format: ^https://.*$
|
||||
content: The URL that the device contacts to retrieve device management instructions.
|
||||
The URL must begin with the 'https://' URL scheme, and may contain a port number
|
||||
(':1234', for example).
|
||||
- key: CheckInURL
|
||||
title: Check In URL
|
||||
type: <string>
|
||||
presence: optional
|
||||
format: ^https://.*$
|
||||
content: The URL that the device should use to check in during installation. The
|
||||
URL must begin with the 'https://' URL scheme and may contain a port number (':1234',
|
||||
for example). If this URL isn't given, 'ServerURL' is used for both purposes.
|
||||
- key: SignMessage
|
||||
title: Sign Message
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', each message coming from the device carries the additional 'Mdm-Signature'
|
||||
HTTP header.
|
||||
- key: AccessRights
|
||||
title: Access Rights
|
||||
supportedOS:
|
||||
iOS:
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
macOS:
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: |-
|
||||
Logical OR of the following bit flags:
|
||||
'1': Allow inspection of installed configuration profiles.
|
||||
'2': Allow installation and removal of configuration profiles.
|
||||
'4': Allow device lock and passcode removal.
|
||||
'8': Allow device erase.
|
||||
'16': Allow query of device information (device capacity, serial number).
|
||||
'32': Allow query of network information (phone/SIM numbers, MAC addresses).
|
||||
'64': Allow inspection of installed provisioning profiles.
|
||||
'128': Allow installation and removal of provisioning profiles.
|
||||
'256': Allow inspection of installed applications.
|
||||
'512': Allow restriction-related queries.
|
||||
'1024': Allow security-related queries.
|
||||
'2048': Allow manipulation of settings.
|
||||
'4096': Allow app management.
|
||||
The value can't be '0'. If '2' is specified, '1' must also be specified. If '128' is specified, '64' must also be specified.
|
||||
If the 'ManagedAppleID' is included, then 'AccessRights' are ignored.
|
||||
- key: UseDevelopmentAPNS
|
||||
title: Use Development APNS
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: |-
|
||||
If 'true', the device uses the development APNS servers. Otherwise, the device uses the production servers.
|
||||
Note that this property must be set to 'false' if your Apple Push Notification Service certificate was issued by the Apple Push Certificate Portal ('https://identity.apple.com/pushcert'). That portal only issues certificates for the production push environment.
|
||||
- key: ManagedAppleID
|
||||
title: Managed Apple ID
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.1'
|
||||
userenrollment:
|
||||
mode: required
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
userenrollment:
|
||||
mode: required
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The Managed Apple ID of the user. Available in iOS 13.1 and later, and
|
||||
macOS 10.15 and later.
|
||||
- key: AssignedManagedAppleID
|
||||
title: Assigned Managed Apple ID
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '15.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The Managed Apple ID pre-assigned to the authenticated user. This is only used with the BYOD enrollment flow.
|
||||
Available in iOS 15 and later.
|
||||
- key: EnrollmentMode
|
||||
title: Enrollment Mode
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '15.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- BYOD
|
||||
content: |-
|
||||
The enrollment mode the server indicates must be used when enrolling. This must be present for BYOD enrollments.
|
||||
Available in iOS 15 and later.
|
||||
- key: ServerURLPinningCertificateUUIDs
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.4'
|
||||
macOS:
|
||||
introduced: '10.13'
|
||||
tvOS:
|
||||
introduced: '13.4'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of strings, each containing the UUID of a certificate to be used
|
||||
when evaluating trust to the '.../connect/' URLs of MDM servers.
|
||||
subkeys:
|
||||
- key: ServerURLPinningCertificateUUIDsItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A certificate payload UUID.
|
||||
- key: CheckInURLPinningCertificateUUIDs
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.4'
|
||||
macOS:
|
||||
introduced: '10.13'
|
||||
tvOS:
|
||||
introduced: '13.4'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of strings, each containing the payload UUID of a certificate
|
||||
to be used when evaluating trust to the '.../checkin/' URLs of MDM servers.
|
||||
subkeys:
|
||||
- key: CheckInURLPinningCertificateUUIDsItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A certificate payload UUID.
|
||||
- key: PinningRevocationCheckRequired
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.4'
|
||||
macOS:
|
||||
introduced: '10.13'
|
||||
tvOS:
|
||||
introduced: '13.4'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: |-
|
||||
If 'true', fails the connection attempt unless a verified positive response is obtained during certificate revocation checks.
|
||||
If 'false', revocation checks are done on a best-attempt basis, where failure to reach the server isn't considered fatal.
|
||||
- key: ServerCapabilities
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
A unique array of strings indicating server capabilities. If the server manages macOS devices or a Shared iPad, this field is mandatory and must contain the value 'com.apple.mdm.per-user-connections', which indicates that the server supports both device and user connections.
|
||||
Starting with macOS 11, it is also recommended that macOS device enrollment profiles contain the value 'com.apple.mdm.bootstraptoken' to ensure the Bootstrap Token is created and escrowed with the MDM server at enrollment time.
|
||||
subkeys:
|
||||
- key: ServerCapabilitiesItems
|
||||
type: <string>
|
||||
rangelist:
|
||||
- com.apple.mdm.per-user-connections
|
||||
- com.apple.mdm.bootstraptoken
|
||||
- key: CheckOutWhenRemoved
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the device attempts to send a CheckOut <https://developer.apple.com/library/archive/documentation/Miscellaneous/Reference/MobileDeviceManagementProtocolRef/2-MDM_Check_In_Protocol/MDM_Check_In_Protocol..html#//apple_ref/doc/uid/TP40017387-CH4-SW7>
|
||||
message to the 'CheckInURL' when the profile is removed.
|
||||
- key: RequiredAppIDForMDM
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '15.1'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: |-
|
||||
This property specifies an iTunes Store ID for an app the system can install with the InstallApplicationCommand, without any approval from the user. The MDM vendor or managing organization generally provides this app, which enhances the management experience for the user. The device shows the user details about this app in the account-driven enrollment process prior to installing the MDM profile. Use this property with account-driven MDM enrollments that normally require user approval for app installs through MDM.
|
||||
Only account-driven user enrollments support this property and other enrollment types ignore it.
|
||||
Available in iOS 15.1 and later.
|
||||
- key: PromptUserToAllowBootstrapTokenForAuthentication
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: '11.0'
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: |-
|
||||
If 'true', warns the user that they need to reboot into RecoveryOS and allow the MDM to use the Bootstrap Token for authentication for certain sensitive operations such as enabling kernel extensions or installing some types of software updates. If the MDM doesn't need to perform these operations, it can leave this key set to 'false', and the user won't be notified.
|
||||
The SettingsCommand.Command.Settings.MDMOptions.MDMOptions command overrides this default value.
|
||||
This setting only applies to devices that have 'BootstrapTokenRequiredForSoftwareUpdate' or 'BootstrapTokenRequiredForKernelExtensionApproval' set to 'true' in their SecurityInfoResponse.SecurityInfo.
|
||||
DEP-enrolled devices are automatically allowed to use the Bootstrap Token for authentication.
|
||||
Available in macOS 11 and later.
|
||||
@@ -0,0 +1,185 @@
|
||||
title: Passcode
|
||||
description: Use this section to define passcode policy settings
|
||||
payload:
|
||||
payloadtype: com.apple.mobiledevice.passwordpolicy
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: forbidden
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: allowSimple
|
||||
title: Allow Simple Value
|
||||
supportedOS:
|
||||
iOS:
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', allows a simple passcode. A simple passcode contains repeated
|
||||
characters, or increasing or decreasing characters (such as '123' or 'CBA'). Setting
|
||||
this value to false has the same result as setting 'minComplexChars' to '1'.
|
||||
- key: forcePIN
|
||||
title: Require Passcode on Device
|
||||
supportedOS:
|
||||
iOS:
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', forces the user to enter a PIN.
|
||||
- key: maxFailedAttempts
|
||||
title: Maximum Number of Failed Attempts
|
||||
supportedOS:
|
||||
iOS:
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <integer>
|
||||
presence: optional
|
||||
range:
|
||||
min: 2
|
||||
max: 11
|
||||
default: 11
|
||||
content: The number of allowed failed attempts to enter the passcode at the device's
|
||||
lock screen. After six failed attempts, a time delay is imposed before a passcode
|
||||
can be entered again. The delay increases with each attempt. In macOS, set 'minutesUntilFailedLoginReset'
|
||||
to define a delay before the next passcode can be entered. When this number is
|
||||
exceeded in macOS, the device is locked; in iOS, the device is wiped.
|
||||
- key: maxInactivity
|
||||
title: Auto-Lock
|
||||
supportedOS:
|
||||
iOS:
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <integer>
|
||||
presence: optional
|
||||
range:
|
||||
min: 0
|
||||
max: 15
|
||||
content: The maximum number of minutes for which the device can be idle, without
|
||||
being unlocked by the user, before it gets locked by the system. When this limit
|
||||
is reached, the device is locked and the passcode must be entered. The user can
|
||||
edit this setting, but the value cannot exceed the 'maxInactivity' value. In macOS,
|
||||
this inactivity value is translated to screen-saver settings.
|
||||
- key: maxPINAgeInDays
|
||||
title: Maximum Passcode Age
|
||||
supportedOS:
|
||||
iOS:
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <integer>
|
||||
presence: optional
|
||||
range:
|
||||
min: 0
|
||||
max: 730
|
||||
content: The number of days for which the passcode can remain unchanged. After this
|
||||
number of days, the user is forced to change the passcode before the device is
|
||||
unlocked.
|
||||
- key: minComplexChars
|
||||
title: Minimum Number of Complex Characters
|
||||
supportedOS:
|
||||
iOS:
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <integer>
|
||||
presence: optional
|
||||
range:
|
||||
min: 0
|
||||
max: 4
|
||||
default: 0
|
||||
content: |-
|
||||
The minimum number of complex characters that a passcode must contain. A complex character is a character other than a number or a letter, such as & % $ #.
|
||||
This property is ignored for User Enrollments.
|
||||
- key: minLength
|
||||
title: Minimum Passcode Length
|
||||
supportedOS:
|
||||
iOS:
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <integer>
|
||||
presence: optional
|
||||
range:
|
||||
min: 0
|
||||
max: 16
|
||||
default: 0
|
||||
content: The minimum overall length of the passcode. This parameter is independent
|
||||
of the also optional minComplexChars argument.
|
||||
- key: requireAlphanumeric
|
||||
title: Require Alphabetic Value
|
||||
supportedOS:
|
||||
iOS:
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', requires alphabetic characters (abcd) instead of only numeric
|
||||
characters.
|
||||
- key: pinHistory
|
||||
title: Passcode History
|
||||
supportedOS:
|
||||
iOS:
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <integer>
|
||||
presence: optional
|
||||
range:
|
||||
min: 1
|
||||
max: 50
|
||||
content: This value defines N, where the new passcode must be unique within the
|
||||
last N entries in the passcode history.
|
||||
- key: maxGracePeriod
|
||||
title: Grace Period for Device Lock
|
||||
supportedOS:
|
||||
iOS:
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <integer>
|
||||
presence: optional
|
||||
default: 0
|
||||
content: The maximum grace period, in minutes, to unlock the phone without entering
|
||||
a passcode. The default is 0, which is no grace period and requires a passcode
|
||||
immediately. In macOS, this grace period value is translated to screen-saver settings.
|
||||
- key: minutesUntilFailedLoginReset
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The number of minutes before the login is reset after the maximum number
|
||||
of unsuccessful login attempts is reached. This key requires setting 'maxFailedAttempts'.
|
||||
Available in macOS 10.10 and later.
|
||||
- key: changeAtNextAuth
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: '10.13'
|
||||
userenrollment:
|
||||
mode: ignored
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', causes a password reset to occur the next time the user tries
|
||||
to authenticate. If this key is set in a device profile, the setting takes effect
|
||||
for all users, and admin authentications may fail until the admin user password
|
||||
is also reset. Available in macOS 10.13 and later.
|
||||
@@ -0,0 +1,82 @@
|
||||
title: Network Usage Rules
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.networkusagerules
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '9.0'
|
||||
supervised: false
|
||||
allowmanualinstall: false
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Network Usage Rules allow enterprises to specify how devices use networks,
|
||||
such as cellular data networks. iOS 9-12 support only ApplicationRules. In iOS
|
||||
13, ApplicationRules, SIMRules, or both must be present.
|
||||
payloadkeys:
|
||||
- key: ApplicationRules
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of application rules, that apply to only managed apps.
|
||||
subkeys:
|
||||
- key: ApplicationRulesItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: AppIdentifierMatches
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
A list of managed app identifiers, as strings, that must follow the associated rules. If this key is missing, the rules apply to all managed apps on the device.
|
||||
|
||||
Each string in the 'AppIdentifierMatches' array may either be an exact app identifier match (for example, 'com.mycompany.myapp') or it may specify a prefix match for the bundle ID by using the * wildcard character. If used, this character must appear after a period (.) and may only appear once, at the end of the string; for example, 'com.mycompany.*'.
|
||||
subkeys:
|
||||
- key: AppIdentifierMatchesItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A managed app identifier.
|
||||
- key: AllowRoamingCellularData
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', disables cellular data while roaming for all matching managed
|
||||
apps.
|
||||
- key: AllowCellularData
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', disables cellular data for all matching managed apps.
|
||||
- key: SIMRules
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '13.0'
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: An array of SIM rules, that apply to all apps.
|
||||
subkeys:
|
||||
- key: SIMRulesItem
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: ICCIDs
|
||||
type: <array>
|
||||
presence: required
|
||||
content: One or more ICCIDs of SIM cards for which the 'WiFiAssistPolicy' applies.
|
||||
All ICCIDs in all installed Network Usage Rules payloads must be unique. An
|
||||
example ICCID is '89310410106543789301'.
|
||||
subkeys:
|
||||
- key: ICCID
|
||||
type: <string>
|
||||
presence: required
|
||||
content: An ICCID.
|
||||
- key: WiFiAssistPolicy
|
||||
type: <integer>
|
||||
presence: required
|
||||
rangelist:
|
||||
- 2
|
||||
- 3
|
||||
content: |-
|
||||
The Wi-Fi Assist policy to apply to the SIM cards specified in the ICCIDs. See About Wi-Fi Assist <https://support.apple.com/en-us/HT205296> to learn more.
|
||||
* '2': Use the default system policy for the specified SIM card(s).
|
||||
* '3': Make Wi-Fi Assist switch more aggressively from a poor Wi-Fi connection to cellular data for the specified SIM card(s). This setting may increase cellular data use and may impact battery life.
|
||||
@@ -0,0 +1,163 @@
|
||||
title: Notifications
|
||||
description: Configures notifications settings for apps
|
||||
payload:
|
||||
payloadtype: com.apple.notificationsettings
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '9.3'
|
||||
supervised: true
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: A notification settings payload specifies the restriction enforced notification
|
||||
settings for apps using their bundle identifier. The profile specifies notification
|
||||
settings by bundle identifier (even for apps that aren’t installed on the device
|
||||
yet), and those settings will always be enforced.
|
||||
payloadkeys:
|
||||
- key: NotificationSettings
|
||||
title: Notification Settings
|
||||
type: <array>
|
||||
presence: required
|
||||
content: An array of notification settings dictionaries.
|
||||
subkeys:
|
||||
- key: NotificationSettingsItem
|
||||
title: Notification Setting
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: BundleIdentifier
|
||||
title: App Bundle Identifier
|
||||
type: <string>
|
||||
presence: required
|
||||
content: |-
|
||||
The bundle identifier of the app to which to apply these notification settings.
|
||||
Available in iOS 9.3 and later and macOS 10.15 and later.
|
||||
- key: NotificationsEnabled
|
||||
title: Enable Notifications
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: |-
|
||||
If 'true', enables notifications for this app.
|
||||
Available in iOS 9.3 and later and macOS 10.15 and later.
|
||||
- key: ShowInNotificationCenter
|
||||
title: Show in Notification Center
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: |-
|
||||
If 'true', enables notifications in the notification center for this app.
|
||||
Available in iOS 9.3 and later and macOS 10.15 and later.
|
||||
- key: ShowInLockScreen
|
||||
title: Show in Lock Screen
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: |-
|
||||
If 'true', enables notifications on the lock screen for this app.
|
||||
Available in iOS 9.3 and later and macOS 10.15 and later.
|
||||
- key: AlertType
|
||||
title: Alert Type
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 0
|
||||
- 1
|
||||
- 2
|
||||
default: 1
|
||||
content: |-
|
||||
The type of alert for notifications for this app:
|
||||
* '0': None
|
||||
* '1': Temporary Banner
|
||||
* '2': Persistent Banner
|
||||
Available in iOS 9.3 and later and macOS 10.15 and later.
|
||||
- key: BadgesEnabled
|
||||
title: Badges Enabled
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: |-
|
||||
If 'true', enables badges for this app.
|
||||
Available in iOS 9.3 and later and macOS 10.15 and later.
|
||||
- key: SoundsEnabled
|
||||
title: Sounds Enabled
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'true', enables sounds for this app.
|
||||
- key: ShowInCarPlay
|
||||
title: Show in CarPlay
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: |-
|
||||
If 'true', enables notifications in CarPlay for this app.
|
||||
Available in iOS 12 and later.
|
||||
- key: CriticalAlertEnabled
|
||||
title: Critical Alert Enabled
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: |-
|
||||
If 'true', enables critical alerts that can ignore Do Not Disturb and ringer settings for this app.
|
||||
Available in iOS 12 and later and macOS 10.15 and later.
|
||||
- key: GroupingType
|
||||
title: Grouping Type
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '12.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 0
|
||||
- 1
|
||||
- 2
|
||||
default: 0
|
||||
content: |-
|
||||
The type of grouping for notifications for this app:
|
||||
* '0': Automatic: Group notifications into app-specified groups.
|
||||
* '1': By app: Group notifications into one group.
|
||||
* '2': Off: Don't group notifications.
|
||||
Available in iOS 12 and later.
|
||||
- key: PreviewType
|
||||
title: Preview Type
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.0'
|
||||
macOS:
|
||||
introduced: n/a
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 0
|
||||
- 1
|
||||
- 2
|
||||
content: |-
|
||||
The type previews for notifications. This key overrides the value at Settings>Notifications>Show Previews.
|
||||
* '0' - Always: Previews will be shown when the device is locked and unlocked
|
||||
* '1' - When Unlocked: Previews will only be shown when the device is unlocked
|
||||
* '2' - Never: Previews will never be shown
|
||||
|
||||
|
||||
Available in iOS 14 and later.
|
||||
@@ -0,0 +1,60 @@
|
||||
title: macOS Server Account
|
||||
description: Use this section to define a macOS Server account
|
||||
payload:
|
||||
payloadtype: com.apple.osxserver.account
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '9.0'
|
||||
deprecated: '12.0'
|
||||
removed: '12.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: forbidden
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: HostName
|
||||
title: Account Hostname
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The server's address.
|
||||
- key: UserName
|
||||
title: Account Username
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The user's user name.
|
||||
- key: Password
|
||||
title: Account Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user's password.
|
||||
- key: AccountDescription
|
||||
title: Account Description
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The description of the account.
|
||||
- key: ConfiguredAccounts
|
||||
title: Configured Accounts
|
||||
type: <array>
|
||||
presence: required
|
||||
content: Array of dictionaries containing configured account types and relevant
|
||||
settings
|
||||
subkeys:
|
||||
- key: ConfiguredAccountsItem
|
||||
title: Configured Account
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: Type
|
||||
title: Account Type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- com.apple.osxserver.documents
|
||||
content: com.apple.osxserver.documents (the Documents account type).
|
||||
- key: Port
|
||||
title: Port Number
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: Designates the port number to use when contacting the server. If no
|
||||
port number is specified, the default port is used.
|
||||
@@ -0,0 +1,29 @@
|
||||
title: Security Preferences
|
||||
payload:
|
||||
payloadtype: com.apple.preference.security
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
payloadkeys:
|
||||
- key: dontAllowPasswordResetUI
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables user changes to the password.
|
||||
- key: dontAllowLockMessageUI
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables user changes to the lock message.
|
||||
- key: dontAllowFireWallUI
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables user changes to the firewall settings.
|
||||
@@ -0,0 +1,19 @@
|
||||
title: User Preferences
|
||||
payload:
|
||||
payloadtype: com.apple.preference.users
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.12'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
payloadkeys:
|
||||
- key: DisableUsingiCloudPassword
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', disables the iCloud password for local accounts.
|
||||
@@ -0,0 +1,32 @@
|
||||
title: Profile Removal Password
|
||||
description: Use this section to define settings for profile removal
|
||||
payload:
|
||||
payloadtype: com.apple.profileRemovalPassword
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
supervised: true
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: forbidden
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
tvOS:
|
||||
introduced: '9.0'
|
||||
supervised: true
|
||||
allowmanualinstall: true
|
||||
payloadkeys:
|
||||
- key: RemovalPassword
|
||||
title: Removal Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The password for allowing the profile to be removed.
|
||||
@@ -0,0 +1,90 @@
|
||||
title: Global HTTP Proxy
|
||||
description: Global HTTP Proxy (Supervised devices only)
|
||||
payload:
|
||||
payloadtype: com.apple.proxy.http.global
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '6.0'
|
||||
supervised: true
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
supervised: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
tvOS:
|
||||
introduced: '6.0'
|
||||
supervised: true
|
||||
allowmanualinstall: true
|
||||
content: PEM-encoded cer
|
||||
payloadkeys:
|
||||
- key: ProxyType
|
||||
title: Proxy Type
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- Manual
|
||||
- Auto
|
||||
default: Manual
|
||||
content: The proxy type. For a manual proxy type, the profile contains the proxy
|
||||
server address, including its port, and optionally a user name and password. For
|
||||
an auto proxy type, you can enter a PAC URL.
|
||||
- key: ProxyServer
|
||||
title: Proxy Server
|
||||
type: <string>
|
||||
subtype: hostname
|
||||
presence: required
|
||||
content: The proxy server's network address.
|
||||
- key: ProxyServerPort
|
||||
title: Proxy Server Port
|
||||
type: <integer>
|
||||
presence: required
|
||||
content: The proxy server's port number.
|
||||
- key: ProxyUsername
|
||||
title: Proxy Username
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user name used to authenticate to the proxy server.
|
||||
- key: ProxyPassword
|
||||
title: Proxy Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The password used to authenticate to the proxy server.
|
||||
- key: ProxyPACURL
|
||||
title: Proxy PAC URL
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The URL of the PAC file that defines the proxy configuration. Starting
|
||||
in iOS 13 and macOS 10.15, only URLs that begin with 'http://' or 'https://' are
|
||||
allowed.
|
||||
- key: ProxyPACFallbackAllowed
|
||||
title: Proxy PAC Fallback Allowed
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '7.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', allows connecting directly to the destination if the proxy autoconfiguration
|
||||
(PAC) file is unreachable.
|
||||
- key: ProxyCaptiveLoginAllowed
|
||||
title: Proxy Bypass Allowed
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '7.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', allows the device to bypass the proxy server to display the
|
||||
login page for captive networks.
|
||||
@@ -0,0 +1,30 @@
|
||||
title: Screensaver User
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.screensaver.user
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.11'
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Specifies *user* screensaver settings. (Settings for loginwindow screensaver
|
||||
use a different payload)
|
||||
payloadkeys:
|
||||
- key: moduleName
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The name of the screen saver module.
|
||||
- key: modulePath
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: A full path to the screen-saver module to use.
|
||||
- key: idleTime
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The number of seconds of inactivity before the screen saver activates ('0'
|
||||
= Never activate).
|
||||
@@ -0,0 +1,49 @@
|
||||
title: Screensaver
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.screensaver
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.11'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Specifies grace period for screensaver locking
|
||||
payloadkeys:
|
||||
- key: askForPassword
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.13'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the user is prompted for a password when the screen saver is
|
||||
unlocked or stopped. When you use this prompt, you must also provide 'askForPasswordDelay'.
|
||||
Available in macOS 10.13 and later.
|
||||
- key: askForPasswordDelay
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.13'
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The number of seconds to delay before the password will be required to
|
||||
unlock or stop the screen saver (the grace period). A value of '2147483647' (for
|
||||
example, '0x7FFFFFFF') disables this requirement. To use this option, you must
|
||||
set 'askForPassword' to 'true'. Available in macOS 10.13 and later.
|
||||
- key: loginWindowIdleTime
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The number of seconds of inactivity before the screen saver activates (0
|
||||
= Never activate).
|
||||
- key: loginWindowModulePath
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The full path to the screen-saver module to use.
|
||||
- key: moduleName
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The name of the screen saver module.
|
||||
@@ -0,0 +1,21 @@
|
||||
title: '802.1X: Second Active Ethernet'
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.secondactiveethernet.managed
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
payloadkeys:
|
||||
- key: ANY
|
||||
type: <any>
|
||||
presence: optional
|
||||
content: Keys relevant to 802.1x configuration. User enrollment payloads do not
|
||||
support the various proxy keys including ProxyType, ProxyServer, ProxyServerPort,
|
||||
ProxyUsername, ProxyPassword,, ProxyPACURL and ProxyPACFallbackAllowed.
|
||||
@@ -0,0 +1,21 @@
|
||||
title: '802.1X: Second Ethernet'
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.secondethernet.managed
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
payloadkeys:
|
||||
- key: ANY
|
||||
type: <any>
|
||||
presence: optional
|
||||
content: Keys relevant to 802.1x configuration. User enrollment payloads do not
|
||||
support the various proxy keys including ProxyType, ProxyServer, ProxyServerPort,
|
||||
ProxyUsername, ProxyPassword,, ProxyPACURL and ProxyPACFallbackAllowed.
|
||||
@@ -0,0 +1,43 @@
|
||||
title: FDE Recovery Key Escrow
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.security.FDERecoveryKeyEscrow
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.13'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: |-
|
||||
If FileVault is enabled after this payload is installed on the system, the FileVault PRK will be encrypted with the specified certificate, wrapped with a CMS envelope and stored at:
|
||||
/var/db/FileVaultPRK.dat
|
||||
The encrypted data will be made available to the MDM server as part of the SecurityInfo command. Alternatively, if a site uses their own administration software, they can extract the PRK from the above location at any time. As the PRK will be encrypted using the certificate provided in the profile, only the author of the profile can extract the data.
|
||||
Notes:
|
||||
* The payload must exist in a "system" scoped profile.
|
||||
* It will be an error to install more than one payload of this type per machine.
|
||||
* The old payload ("com.apple.security.FDERecoveryRedirect") will no longer be supported. It will still be allowed to be installed, but will be ignored. (This is so servers can send out the same profile to old and new clients).
|
||||
* If only an old-style redirection payload is installed at the time FileVault is turned on (via Security Pref pane), an error will be displayed and FileVault will not be allowed to be enabled.
|
||||
* No warning/error will be provided if FileVault is already enabled and an old-style payload is installed. In this case, it's assumed the recovery key has already been escrowed with the server.
|
||||
payloadkeys:
|
||||
- key: Location
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The description of the location where the recovery key will be escrowed.
|
||||
This text will be inserted into the message the user sees when enabling FileVault.
|
||||
- key: EncryptCertPayloadUUID
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The UUID of a payload within the same profile that contains the certificate
|
||||
that will be used to encrypt the recovery key. The referenced payload must be
|
||||
of type 'com.apple.security.pkcs1'.
|
||||
- key: DeviceKey
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
The string that's included in help text if the user appears to have forgotten the password. Site admins can use this key to look up the escrowed key for the particular computer.
|
||||
|
||||
This key replaces the 'RecordNumber' key used in the previous escrow mechanism. If the key is missing, the device serial number is used instead.
|
||||
@@ -0,0 +1,34 @@
|
||||
title: FDE Recovery Key Redirection
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.security.FDERecoveryRedirect
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.9'
|
||||
deprecated: '10.13'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: |-
|
||||
*** This payload will be ignored on macOS 10.13 and later. See "com.apple.security.FDERecoveryKeyEscrow" payload. ***
|
||||
Old notes:
|
||||
Once installed, this payload will cause any FDE (Full Disk Encryption) recovery keys to be redirected to the specified URL instead of being sent to Apple. This will require sites to implement their own HTTPS server that will receive the recovery keys via a POST request. Details of the data sent to the server will be provided in a different document.
|
||||
Notes:
|
||||
* The payload must exist in a "system" scoped profile.
|
||||
* It will be an error to install more than one payload of this type per machine.
|
||||
payloadkeys:
|
||||
- key: RedirectURL
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The URL to which FDE recovery keys should be sent instead of to Apple.
|
||||
The URL must begin with https://.
|
||||
- key: EncryptCertPayloadUUID
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The UUID of a payload within the same profile that contains a certificate
|
||||
used to encrypt the recovery key when it's sent to the redirected URL. The referenced
|
||||
payload must be of type `com.apple.security.pkcs1`.
|
||||
@@ -0,0 +1,29 @@
|
||||
title: Certificate Preference
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.security.certificatepreference
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.12'
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: Defines a Certificate Preference item in the user's keychain that references
|
||||
a certificate payload included in the same profile. Can only appear in a user
|
||||
profile (not a device profile). See also "com.apple.security.identitypreference"
|
||||
for setting up identity preferences.
|
||||
payloadkeys:
|
||||
- key: Name
|
||||
type: <string>
|
||||
presence: required
|
||||
content: An email address (in RFC 822 format) or other name for which a preferred
|
||||
certificate is requested.
|
||||
- key: PayloadCertificateUUID
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The UUID of the certificate payload within the same profile to use for
|
||||
the identity credential.
|
||||
@@ -0,0 +1,41 @@
|
||||
title: Certificate Revocation
|
||||
description: Use this section to define settings for certificate revocation.
|
||||
payload:
|
||||
payloadtype: com.apple.security.certificaterevocation
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '14.2'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: Policies that affect system-wide certificate revocation checking.
|
||||
payloadkeys:
|
||||
- key: EnabledForCerts
|
||||
title: Enabled Certs
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
An array of certificates that the system checks for revocation.
|
||||
Specifying a certificate authority (CA) enables revocation checking for all certificates chaining up to that CA.
|
||||
It is not necessary to specify trusted root certificates because they are implicitly specified. See <https://support.apple.com/en-us/HT209143> for the available trusted root certificates for Apple operating systems.
|
||||
subkeys:
|
||||
- key: SubjectPublicKeyInfoHashDict
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: Algorithm
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- sha256
|
||||
content: The algorithm must be 'sha256'.
|
||||
- key: Hash
|
||||
type: <data>
|
||||
presence: required
|
||||
content: |-
|
||||
The hash of the DER-encoding of the certificate's 'subjectPublicKeyInfo'.
|
||||
The hash field requires the data ('subjectPublicKeyInfo' hash) in a specific format: a Base64 encoded (binary) SHA-256 hash of the certificate's public key.
|
||||
@@ -0,0 +1,69 @@
|
||||
title: Certificate Transparency
|
||||
description: Use this section to define settings for certificate transparency.
|
||||
payload:
|
||||
payloadtype: com.apple.security.certificatetransparency
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: 12.1.1
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: 10.14.2
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
tvOS:
|
||||
introduced: 12.1.1
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
watchOS:
|
||||
introduced: 5.1.1
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
content: Policies that affect system-wide certificate transparency enforcement.
|
||||
payloadkeys:
|
||||
- key: DisabledForCerts
|
||||
title: Disabled Certs
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
An array of certificates for which certificate transparency is disabled. For Certificate Transparency enforcement to be disabled when this policy is set, one of the following conditions must be met:
|
||||
* The hash is of the server certificate's 'subjectPublicKeyInfo'.
|
||||
* The hash is of a 'subjectPublicKeyInfo' that appears in a CA certificate in the certificate chain; the CA certificate is constrained through the X.509v3 'nameConstraints' extension; one or more 'directoryName' 'nameConstraints' are present in the 'permittedSubtrees;' and the 'directoryName' contains an 'organizationName' attribute.
|
||||
* The hash is of a 'subjectPublicKeyInfo' that appears in a CA certificate in the certificate chain; the CA certificate has one or more 'organizationName' attributes in the certificate 'Subject;' and the server's certificate contains the same number of 'organizationName' attributes, in the same order, and with byte-for-byte identical values.
|
||||
subkeys:
|
||||
- key: SubjectPublicKeyInfoHashDict
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: Algorithm
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- sha256
|
||||
content: The algorithm must be 'sha256'.
|
||||
- key: Hash
|
||||
type: <data>
|
||||
presence: required
|
||||
content: |-
|
||||
The hash of the DER-encoding of the certificate's 'subjectPublicKeyInfo'.
|
||||
The hash field requires the data ('subjectPublicKeyInfo' hash) in a specific format: a Base64 encoded (binary) SHA-256 hash of the certificate's public key.
|
||||
- key: DisabledForDomains
|
||||
title: Disabled domains
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
An array of strings representing the domains to be excluded from certificate transparency enforcement. A leading period (.) is supported to signify subdomains.
|
||||
Wildcard domains are not supported. If a leading period (.) is specified, the domain cannot be a top-level domain (for example, '.com' and '.co.uk' are disallowed).
|
||||
subkeys:
|
||||
- key: domain
|
||||
type: <string>
|
||||
@@ -0,0 +1,74 @@
|
||||
title: Firewall
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.security.firewall
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.12'
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: |-
|
||||
Manages the Application Firewall settings (e.g. Security pref pane -> Firewall).
|
||||
Notes:
|
||||
* The payload must exist in a "system" scoped profile.
|
||||
* If more than one profile contains this payload, the most restrictive union of settings will be used.
|
||||
* Per Firewall team's request, the "Automatically allow signed downloaded software" and "Automatically allow built-in software" options are not supported but both will be forced ON when this payload is present.
|
||||
payloadkeys:
|
||||
- key: EnableFirewall
|
||||
type: <boolean>
|
||||
presence: required
|
||||
content: If 'true', enables the firewall.
|
||||
- key: BlockAllIncoming
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables blocking of all incoming connections.
|
||||
- key: EnableStealthMode
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: If 'true', enables stealth mode.
|
||||
- key: Applications
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: The list of apps with connections controlled by the firewall.
|
||||
subkeys:
|
||||
- key: ApplicationsItem
|
||||
title: Applications
|
||||
type: <dictionary>
|
||||
subkeys:
|
||||
- key: BundleID
|
||||
title: Application Identifier
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The bundle identifier for an app.
|
||||
- key: Allowed
|
||||
title: Allow connections
|
||||
type: <boolean>
|
||||
presence: required
|
||||
content: If true, allows connections for the app.
|
||||
- key: EnableLogging
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '12.0'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
content: |-
|
||||
If 'true', enables logging.
|
||||
Available in macOS 12 and later.
|
||||
- key: LoggingOption
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '12.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- throttled
|
||||
- brief
|
||||
- detail
|
||||
content: |-
|
||||
This string specifies the type of logging.
|
||||
Available in macOS 12 and later.
|
||||
@@ -0,0 +1,29 @@
|
||||
title: Identity Preference
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.security.identitypreference
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.12'
|
||||
devicechannel: false
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
content: Defines an Identity Preference item in the user's keychain that references
|
||||
a identity payload included in the same profile. Can only appear in a user profile
|
||||
(not a device profile). See also "com.apple.security.certificatepreference" for
|
||||
setting up certificate preferences.
|
||||
payloadkeys:
|
||||
- key: Name
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The email address (in RFC 822 format), DNS host name, or other name that
|
||||
uniquely identifies a service requiring this identity.
|
||||
- key: PayloadCertificateUUID
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The UUID of the certificate payload within the same profile to use for
|
||||
the identity credential.
|
||||
@@ -0,0 +1,43 @@
|
||||
title: Certificate (PEM)
|
||||
description: Use this section to define settings for a pem certificate.
|
||||
payload:
|
||||
payloadtype: com.apple.security.pem
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
tvOS:
|
||||
introduced: '5.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
watchOS:
|
||||
introduced: '3.0'
|
||||
allowmanualinstall: true
|
||||
content: PEM-encoded certificate without private key. May contain root certificates.
|
||||
payloadkeys:
|
||||
- key: PayloadCertificateFileName
|
||||
title: Payload Certificate Filename
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The file name of the enclosed certificate.
|
||||
- key: PayloadContent
|
||||
title: Payload Certificate Filename
|
||||
type: <data>
|
||||
presence: required
|
||||
content: The binary representation of the payload, encoded in Base64.
|
||||
@@ -0,0 +1,43 @@
|
||||
title: 'Certificate (PKCS #1)'
|
||||
description: Use this section to define settings for a pkcs1 certificate.
|
||||
payload:
|
||||
payloadtype: com.apple.security.pkcs1
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
tvOS:
|
||||
introduced: '5.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
watchOS:
|
||||
introduced: '3.0'
|
||||
allowmanualinstall: true
|
||||
content: DER-encoded certificate without private key. May contain root certificates.
|
||||
payloadkeys:
|
||||
- key: PayloadCertificateFileName
|
||||
title: Payload Certificate Filename
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The file name of the enclosed certificate.
|
||||
- key: PayloadContent
|
||||
title: Payload Certificate Filename
|
||||
type: <data>
|
||||
presence: required
|
||||
content: The binary representation of the payload, encoded in Base64.
|
||||
@@ -0,0 +1,79 @@
|
||||
title: 'Certificate (PKCS #12)'
|
||||
description: Use this section to define settings for a pkcs12 certificate.
|
||||
payload:
|
||||
payloadtype: com.apple.security.pkcs12
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
tvOS:
|
||||
introduced: '5.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
watchOS:
|
||||
introduced: '3.0'
|
||||
allowmanualinstall: true
|
||||
content: Password-protected identity certificate. Only one certificate may be included.
|
||||
payloadkeys:
|
||||
- key: PayloadCertificateFileName
|
||||
title: Payload Certificate Filename
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The file name of the enclosed certificate.
|
||||
- key: PayloadContent
|
||||
title: Payload Certificate Filename
|
||||
type: <data>
|
||||
presence: required
|
||||
content: The binary representation of the payload, encoded in Base64.
|
||||
- key: Password
|
||||
title: Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
This is the password to the identity.
|
||||
Security Caution: Because the password string is stored in the clear (unencrypted) in the profile, you should encrypt the entire profile.
|
||||
- key: AllowAllAppsAccess
|
||||
title: Allow All Apps Access
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
watchOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', allows apps access to the private key.
|
||||
- key: KeyIsExtractable
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: n/a
|
||||
macOS:
|
||||
introduced: '10.15'
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
watchOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If false, does not tag the private key data as extractable in the keychain.
|
||||
@@ -0,0 +1,43 @@
|
||||
title: Certificate (Root)
|
||||
description: Use this section to define settings for a root certificate.
|
||||
payload:
|
||||
payloadtype: com.apple.security.root
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
tvOS:
|
||||
introduced: '5.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
watchOS:
|
||||
introduced: '3.0'
|
||||
allowmanualinstall: true
|
||||
content: Alias for com.apple.security.pkcs1.
|
||||
payloadkeys:
|
||||
- key: PayloadCertificateFileName
|
||||
title: Payload Certificate Filename
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The file name of the enclosed certificate.
|
||||
- key: PayloadContent
|
||||
title: Payload Certificate Filename
|
||||
type: <data>
|
||||
presence: required
|
||||
content: The binary representation of the payload encoded in base64.
|
||||
@@ -0,0 +1,186 @@
|
||||
title: SCEP
|
||||
description: Use this section to define settings for configuration access to SCEP
|
||||
servers.
|
||||
payload:
|
||||
payloadtype: com.apple.security.scep
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '4.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
devicechannel: true
|
||||
userchannel: true
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
tvOS:
|
||||
introduced: '6.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
payloadkeys:
|
||||
- key: PayloadContent
|
||||
title: Payload Content
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: An array of payload dictionaries. This array isn't present if 'IsEncrypted'
|
||||
is 'true'.
|
||||
subkeys:
|
||||
- key: URL
|
||||
title: URL
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.7'
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The SCEP URL. See Over-the-Air Profile Delivery and Configuration for
|
||||
more information about SCEP.
|
||||
- key: Name
|
||||
title: Name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: A string that's understood by the SCEP server; for example, a domain
|
||||
name like example.org. If a certificate authority has multiple CA certificates,
|
||||
this field can be used to distinguish which is required.
|
||||
- key: Subject
|
||||
title: Subject
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
The representation of an X.500 name as an array of OID and value.
|
||||
For example, '/C=US/O=Apple Inc./CN=foo/1.2.5.3=bar' translates to '[ [ [“C”, “US”] ], [ [“O”, “Apple Inc.'] ], …, [ [ “1.2.5.3”, “bar” ] ] ]'.
|
||||
|
||||
OIDs can be represented as dotted numbers, with shortcuts for country (C), locality (L), state (ST), organization (O), organizational unit (OU), and common name (CN).
|
||||
subkeys:
|
||||
- key: SCEPSubjectArrayInnerArray
|
||||
title: Array Inside SCEP Subject Array
|
||||
type: <array>
|
||||
subkeys:
|
||||
- key: SCEPSubjectArrayPair
|
||||
title: Subject Array Pair
|
||||
type: <array>
|
||||
subkeys:
|
||||
- key: SCEPSubjectArrayPairItem
|
||||
title: SCEP Subject Array Pair Item
|
||||
type: <string>
|
||||
repetition:
|
||||
min: 2
|
||||
max: 2
|
||||
- key: Challenge
|
||||
title: Challenge
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: A preshared secret.
|
||||
- key: Keysize
|
||||
title: Key Size
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 1024
|
||||
- 2048
|
||||
- 4096
|
||||
default: 1024
|
||||
content: The key size, in bits.
|
||||
- key: Key Type
|
||||
title: Key Type
|
||||
type: <string>
|
||||
presence: optional
|
||||
default: RSA
|
||||
content: Always 'RSA'.
|
||||
- key: Key Usage
|
||||
title: Key Usage
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.11'
|
||||
type: <integer>
|
||||
presence: optional
|
||||
default: 0
|
||||
content: |-
|
||||
A bitmask indicating the use of the key.
|
||||
|
||||
* 1: Signing
|
||||
* 4: Encryption
|
||||
|
||||
Some certificate authorities, such as Windows CA, support only encryption or signing, but not both at the same time.
|
||||
- key: CAFingerprint
|
||||
title: Fingerprint
|
||||
type: <data>
|
||||
presence: optional
|
||||
content: The fingerprint of the Certificate Authority certificate.
|
||||
- key: Retries
|
||||
title: Retries
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
type: <integer>
|
||||
presence: optional
|
||||
default: 3
|
||||
content: The number of times the device should retry if the server sends a PENDING
|
||||
response.
|
||||
- key: RetryDelay
|
||||
title: Retry Delay
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
type: <integer>
|
||||
presence: optional
|
||||
default: 10
|
||||
content: The number of seconds to wait between subsequent retries. The first retry
|
||||
is attempted without this delay.
|
||||
- key: SubjectAltName
|
||||
title: Subject Alt Name
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The SCEP payload can specify an optional 'SubjectAltName' dictionary
|
||||
that provides values required by the CA for issuing a certificate. You can specify
|
||||
a single string or an array of strings for each key. The values you specify
|
||||
depend on the CA you're using, but might include DNS name, URL, or email values.
|
||||
For an example, see Sample Configuration Profile or Over-the-Air Profile Delivery
|
||||
and Configuration.
|
||||
subkeys:
|
||||
- key: rfc822Name
|
||||
title: RFC 822 Name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The RFC 822 (email address) string.
|
||||
- key: dNSName
|
||||
title: DNS Name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The DNS name.
|
||||
- key: uniformResourceIdentifier
|
||||
title: URI
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The Uniform Resource Identifier.
|
||||
- key: ntPrincipalName
|
||||
title: NT Principal Name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The NT principal name.
|
||||
- key: KeyIsExtractable
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', disables exporting the private key from the keychain.
|
||||
- key: AllowAllAppsAccess
|
||||
title: Allow All Apps Access
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: '10.10'
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', all apps have access to the private key.
|
||||
@@ -0,0 +1,71 @@
|
||||
title: SmartCard
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.security.smartcard
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.12.4
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
requiresdep: false
|
||||
userapprovedmdm: false
|
||||
allowmanualinstall: true
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Restrictions and settings for SmartCard pairing on macOS
|
||||
payloadkeys:
|
||||
- key: UserPairing
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', users don't get the pairing dialog, although existing pairings
|
||||
still work.
|
||||
- key: allowSmartCard
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: true
|
||||
content: If 'false', disables the SmartCard for logins, authorizations, and screen
|
||||
saver unlocking. It is still allowed for other functions, such as signing emails
|
||||
and accessing the web. A restart is required for a setting change to take effect.
|
||||
- key: checkCertificateTrust
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 0
|
||||
- 1
|
||||
- 2
|
||||
- 3
|
||||
default: 0
|
||||
content: |-
|
||||
Valid values are 0 to 3:
|
||||
'0': Turns off certificate trust check.
|
||||
'1': Turns on certificate trust check. A standard validity check is performed but doesn't include additional revocation checks.
|
||||
'2': Turns on certificate trust check. A soft revocation check is also performed. Until the certificate is explicitly rejected by CRL/OCSP, it's considered valid. This setting means that unavailable or unreachable CRL/OCSP allow this check to succeed.
|
||||
'3': Turns on certificate trust check. A hard revocation check is also performed. Unless CRL/OCSP explicitly says 'This certificate is OK,' it's considered invalid. This option is the most secure.
|
||||
- key: oneCardPerUser
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', a user can pair with only one SmartCard, although existing pairings
|
||||
are allowed if already set up.
|
||||
- key: tokenRemovalAction
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.4
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 0
|
||||
- 1
|
||||
default: 0
|
||||
content: If '1', enables the screen saver when the SmartCard is removed. Available
|
||||
in macOS 10.13.4 and later.
|
||||
- key: enforceSmartCard
|
||||
supportedOS:
|
||||
macOS:
|
||||
introduced: 10.13.2
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', a user can only log in or authenticate with a SmartCard. Available
|
||||
in macOS 10.13.2 and later.
|
||||
@@ -0,0 +1,9 @@
|
||||
title: WAPI Identity Certificate
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.security.wapi-identity
|
||||
payloadkeys:
|
||||
- key: PEMData
|
||||
type: <data>
|
||||
presence: required
|
||||
content: Certificate data in PEM format.
|
||||
@@ -0,0 +1,40 @@
|
||||
title: Lock Screen Message
|
||||
description: Use this section to define text displayed by shared devices in the login
|
||||
window and lock screen.
|
||||
payload:
|
||||
payloadtype: com.apple.shareddeviceconfiguration
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '9.3'
|
||||
supervised: true
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: allowed
|
||||
devicechannel: true
|
||||
userchannel: false
|
||||
userenrollment:
|
||||
mode: forbidden
|
||||
content: Allows admins to specify optional text displayed on the login window and
|
||||
lock screen (i.e. a footnote and Asset Tag Information).
|
||||
payloadkeys:
|
||||
- key: AssetTagInformation
|
||||
title: Asset Tag
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The asset tag information for the device, displayed in the login window
|
||||
and Lock screen.
|
||||
- key: IfLostReturnToMessage
|
||||
title: If Lost message
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: 9.3.1
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: Deprecated. Use 'LockScreenFootnote' instead.
|
||||
- key: LockScreenFootnote
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: 9.3.1
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The footnote displayed in the login window and Lock screen.
|
||||
@@ -0,0 +1,66 @@
|
||||
title: Single Sign-On
|
||||
description: ''
|
||||
payload:
|
||||
payloadtype: com.apple.sso
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '7.0'
|
||||
supervised: false
|
||||
allowmanualinstall: true
|
||||
sharedipad:
|
||||
mode: forbidden
|
||||
userenrollment:
|
||||
mode: allowed
|
||||
payloadkeys:
|
||||
- key: Name
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The human-readable name for the account.
|
||||
- key: Kerberos
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The Kerberos dictionary.
|
||||
subkeys:
|
||||
- key: PrincipalName
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The principal name. If not provided, the user will be prompted for one
|
||||
during profile installation. This field is required for MDM installation.
|
||||
- key: PayloadCertificateUUID
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '8.0'
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The 'PayloadUUID' of an identity certificate payload that can be used
|
||||
to renew the Kerberos credential without user interaction. The certificate payload
|
||||
must have either the 'com.apple.security.pkcs12' or 'com.apple.security.scep'
|
||||
payload type. Both the Single Sign On payload and the identity certificate payload
|
||||
must be included in the same configuration profile.
|
||||
- key: Realm
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The realm name. This value should be properly capitalized.
|
||||
- key: URLPrefixMatches
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
The list of URL prefixes that must be matched in order to use this account for Kerberos authentication over HTTP. If this key is missing, the account will be eligible to match all 'http://' and 'https://' URLs.
|
||||
The URL matching patterns must begin with either 'http://' or 'https://'. A simple string match is performed, so the URL prefix 'http://www.apple.com/' will not match 'http://www.apple.com:80/'. However, if a matching pattern does not end in '/', a '/' will be appended to it.
|
||||
subkeys:
|
||||
- key: URLPrefixMatchesItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: A URL prefix.
|
||||
- key: AppIdentifierMatches
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
The list of app identifiers that are allowed to use this login. If this field missing, this login will match all app identifiers.
|
||||
This array may not be empty.
|
||||
This array must contain strings that match App Bundle IDs. These strings may be exact matches, e.g. 'com.mycompany.myapp' or may specify a prefix match on the Bundle ID by using the '*' wildcard character. The wildcard character must appear after a period character ('.'), and may only appear once, at the end of the string, e.g. 'com.mycompany.*'. When a wildcard is given, any app whose Bundle ID begins with the prefix will be granted access to the account.
|
||||
subkeys:
|
||||
- key: AppIdentifierMatchesItem
|
||||
type: <string>
|
||||
presence: required
|
||||
content: An app identifier.
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user