Seed5

mdm/checkin/tokenupdate.yaml

@@ -220,11 +220,11 @@ notes:
 
     In addition to sending the initial `TokenUpdate` message, the device may send additional `TokenUpdate` messages to the check-in server at any time while it has a valid MDM enrollment.
 
-    The use of `PushMagic` constrains the device to a unique MDM relationship. When a user removes the MDM profile, the device no longer listens to the former relationship, even if the user reestablishes a management relationship with the same server topic. Note that only the push topic is the same in this case; the server's address might change. This also helps when a user restores a device from backup that contains an older relationship. The use of `PushMagic` also ensures that the same organization owns both the server that receives the `CheckIn` message and the computer sending the push notifications. This is important because there's no way of knowing if the push topic belongs to the owner of the check-in server. It's conceivable that Apple might revoke a push token for one party, only to have that party reenroll people from some other topic that's actively pushing. The fact that all MDM push topics reside in the namespace `com.apple.mgmt.*` helps prevent this.
+    The use of `PushMagic` constrains the device to a unique MDM relationship. When a user removes the MDM profile, the device no longer listens to the former relationship, even if the user reestablishes a management relationship with the same server topic. Note that only the push topic is the same in this case; the server's address might change. This also helps when a user restores a device from backup that contains an older relationship. The use of `PushMagic` also ensures that the same organization owns both the server that receives the `CheckIn` message and the computer sending the push notifications. This is important because there's no way of knowing if the push topic belongs to the owner of the check-in server. It's conceivable that Apple might revoke a push token for one party, only to have that party reenroll people from some other topic that's actively pushing. The fact that all MDM push topics reside in the namespace `com.apple.mgmt.\*` helps prevent this.
 
     The `PushMagic` or `UnlockToken` fields of subsequent `TokenUpdate` messages may be identical to those in previous messages, or may be different (and may differ in size from previous values). If different, the server needs to update its record for the device to the new values in the message. Failure to do so results in the server being unable to send push notifications or perform passcode resets.
 
     Although a device can send the `TokenUpdate` message multiple times, it might send it only once if the values in the message never change. Ensure your implementation doesn't rely on repeated messages to update lost server-side data or to recover from a failure to process a previous `TokenUpdate` message. Also note that `UnlockToken` is optional. Don't treat the absence of an `UnlockToken` in a `TokenUpdate` message as an invalidation of a previously received `UnlockToken`.
 
     > Note:
-    > The topic string for the MDM check-in protocol needs to start with `com.apple.mgmt.*` where `*` is a unique suffix.
+    > The topic string for the MDM check-in protocol needs to start with `com.apple.mgmt.\*` where `\*` is a unique suffix.

mdm/profiles/com.apple.TCC.configuration-profile-policy.yaml

@@ -163,9 +163,9 @@ payloadkeys:
     type: <array>
     presence: optional
     content: |-
-      Specifies the policies for the app via the Accessibility subsystem. This profile deprecated its ability to grant access as of macOS 26.2, and removes that ability in macOS 27.0.
+      Specifies the policies for the app via the Accessibility subsystem. In macOS 27.0, the device shows a non-blocking notification for each application when this setting is applied, and it allows the user to make changes to the setting in the System Settings app.
 
-      Deprecated: use the `Privacy` key in the declarative management `com.apple.configuration.app-settings` configuration.
+      Deprecated: use the `Privacy` key in the declarative management `com.apple.configuration.app.settings` configuration.
     subkeytype: Identity
     subkeys: *id001
   - key: PostEvent
@@ -246,7 +246,7 @@ payloadkeys:
     content: |-
       Allows the application to use the system Speech Recognition facility and to send speech data to Apple.
 
-      Deprecated: use the `Privacy` key in the declarative management `com.apple.configuration.app-settings` configuration.
+      Deprecated: use the `Privacy` key in the declarative management `com.apple.configuration.app.settings` configuration.
     subkeytype: Identity
     subkeys: *id001
   - key: SystemPolicyDesktopFolder
@@ -322,7 +322,7 @@ payloadkeys:
     content: |-
       Specifies the policies for the app to access Bluetooth devices.
 
-      Deprecated: use the `Privacy` key in the declarative management `com.apple.configuration.app-settings` configuration.
+      Deprecated: use the `Privacy` key in the declarative management `com.apple.configuration.app.settings` configuration.
     subkeytype: Identity
     subkeys: *id001
 examples:

mdm/profiles/com.apple.applicationaccess.yaml

@@ -3299,6 +3299,29 @@ payloadkeys:
   default: true
   content: If `false`, the system disables Shared Photo Stream. Support for this restriction
     on unsupervised devices is deprecated.
+- key: allowSiriAI
+  title: Allow Siri Apple Intelligence integration
+  supportedOS:
+    iOS:
+      introduced: '27.0'
+      deprecated: '27.0'
+      sharedipad:
+        mode: forbidden
+    macOS:
+      introduced: n/a
+    tvOS:
+      introduced: n/a
+    visionOS:
+      introduced: n/a
+    watchOS:
+      introduced: n/a
+  type: <boolean>
+  presence: optional
+  default: true
+  content: |-
+    If `false`, the system disables Apple Intelligence integration in Siri.
+
+    Deprecated: use the declarative management `com.apple.configuration.siri.settings` configuration.
 - key: allowSpellCheck
   title: Allow spell check
   supportedOS:
@@ -4195,28 +4218,6 @@ payloadkeys:
   default: false
   content: If `true`, then the system bypasses the presentation of a screen capture
     alert.
-- key: ForceCaptivePortalConnectionFromLockScreen
-  title: Enable captive WiFi portal for login and unlock
-  supportedOS:
-    iOS:
-      introduced: n/a
-    macOS:
-      introduced: '27.0'
-      supervised: true
-      allowmanualinstall: false
-      userenrollment:
-        mode: forbidden
-    tvOS:
-      introduced: n/a
-    visionOS:
-      introduced: n/a
-    watchOS:
-      introduced: n/a
-  type: <boolean>
-  presence: optional
-  default: false
-  content: If `true`, the system allows use of the captive WiFi portal at login or
-    unlock.
 - key: forceClassroomAutomaticallyJoinClasses
   supportedOS:
     iOS:
@@ -4529,28 +4530,6 @@ payloadkeys:
   presence: optional
   default: false
   content: If `true`, the system forces a paired Apple Watch to use Wrist Detection.
-- key: ForceWifiConfigurationOnLockScreen
-  title: Enable WiFi network selection for login and unlock
-  supportedOS:
-    iOS:
-      introduced: n/a
-    macOS:
-      introduced: '27.0'
-      supervised: true
-      allowmanualinstall: false
-      userenrollment:
-        mode: forbidden
-    tvOS:
-      introduced: n/a
-    visionOS:
-      introduced: n/a
-    watchOS:
-      introduced: n/a
-  type: <boolean>
-  presence: optional
-  default: false
-  content: If `true`, the system allows the user to select WiFi networks at login
-    or unlock.
 - key: forceWiFiPowerOn
   title: Disallow Wi-Fi from being turned off
   supportedOS:

mdm/profiles/com.apple.dnsProxy.managed.yaml

@@ -5,6 +5,7 @@ payload:
   supportedOS:
     iOS:
       introduced: '11.0'
+      deprecated: '27.0'
       multiple: false
       supervised: false
       allowmanualinstall: false
@@ -16,6 +17,7 @@ payload:
         mode: allowed
     macOS:
       introduced: '10.15'
+      deprecated: '27.0'
       multiple: false
       devicechannel: true
       userchannel: false
@@ -28,6 +30,7 @@ payload:
       introduced: n/a
     visionOS:
       introduced: '1.1'
+      deprecated: '27.0'
       multiple: false
       supervised: false
       allowmanualinstall: false

mdm/profiles/com.apple.dnsSettings.managed.yaml

@@ -5,6 +5,7 @@ payload:
   supportedOS:
     iOS:
       introduced: '14.0'
+      deprecated: '27.0'
       multiple: true
       supervised: false
       allowmanualinstall: true
@@ -16,6 +17,7 @@ payload:
         mode: forbidden
     macOS:
       introduced: '11.0'
+      deprecated: '27.0'
       multiple: true
       devicechannel: true
       userchannel: false
@@ -28,6 +30,7 @@ payload:
       introduced: n/a
     visionOS:
       introduced: '1.0'
+      deprecated: '27.0'
       multiple: true
       supervised: false
       allowmanualinstall: true
@@ -109,7 +112,7 @@ payloadkeys:
     content: |-
       A list of domain strings used to determine which DNS queries use the DNS server. If not set, all domains use the DNS server.
 
-      The system supports a single wildcard (`*`) prefix, but it's not required. For example, both `*.example.com` and `example.com` match against `mydomain.example.com` and `your.domain.example.com`, but don't match against `mydomain-example.com`.
+      The system supports a single wildcard (`\*`) prefix, but it's not required. For example, both `\*.example.com` and `example.com` match against `mydomain.example.com` and `your.domain.example.com`, but don't match against `mydomain-example.com`.
     subkeys:
     - key: SupplementalMatchDomainsElement
       title: Supplemental match domains element
@@ -184,7 +187,7 @@ payloadkeys:
       content: |-
         An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list.
 
-        The system supports a single wildcard (`*`) prefix, but it's not required. For example, both `*.example.com` and `example.com` match against `mydomain.example.com` and `your.domain.example.com`, but don't match against `mydomain-example.com`.
+        The system supports a single wildcard (`\*`) prefix, but it's not required. For example, both `\*.example.com` and `example.com` match against `mydomain.example.com` and `your.domain.example.com`, but don't match against `mydomain-example.com`.
       subkeys:
       - key: DNSDomainMatchElement
         title: DNS domain match element
@@ -196,7 +199,7 @@ payloadkeys:
       content: |-
         An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array.
 
-        The system supports matching with a single wildcard. For example, `17.*` matches any DNS server in the 17.0.0.0/8 subnet.
+        The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the 17.0.0.0/8 subnet.
       subkeys:
       - key: DNSServerAddressMatchElement
         title: DNS server address match element

mdm/profiles/com.apple.domains.yaml

@@ -139,7 +139,7 @@ notes:
 
     Trailing slashes are ignored.
 
-    If a domain string contains a port number, the system considers only addresses that specify that port number managed. Otherwise, the system matches the domain without regard to the port number specified. For example, the pattern `*.example.com:8080` matches `http://site.example.com:8080/page.html` but not `http://site.example.com/page.html`, while the pattern `*.example.com` matches both URLs.
+    If a domain string contains a port number, the system considers only addresses that specify that port number managed. Otherwise, the system matches the domain without regard to the port number specified. For example, the pattern `\*.example.com:8080` matches `http://site.example.com:8080/page.html` but not `http://site.example.com/page.html`, while the pattern `\*.example.com` matches both URLs.
 examples:
 - title: Profile example
   files:

mdm/profiles/com.apple.finder.yaml

@@ -28,16 +28,6 @@ payloadkeys:
   presence: optional
   default: false
   content: If `true`, the system disables the Finder's burn support.
-- key: InterfaceLevel
-  supportedOS:
-    macOS:
-      removed: '10.15'
-  type: <string>
-  presence: optional
-  rangelist:
-  - Simple
-  - Full
-  content: Specifies whether Finder should operate in Simple or Full mode.
 - key: ProhibitConnectTo
   type: <boolean>
   presence: optional

mdm/profiles/com.apple.loginwindow.yaml

@@ -198,6 +198,28 @@ payloadkeys:
   presence: optional
   content: An optional user password to set up auto login. This must match the `AutologinUsername`
     user's current password.
+- key: ForceWifiConfigurationOnLockScreen
+  title: Enable WiFi network selection for login and unlock
+  supportedOS:
+    macOS:
+      introduced: '27.0'
+      allowmanualinstall: false
+  type: <boolean>
+  presence: optional
+  default: false
+  content: If `true`, the system allows the user to select WiFi networks at login
+    or unlock.
+- key: ForceCaptivePortalConnectionFromLockScreen
+  title: Enable captive WiFi portal for login and unlock
+  supportedOS:
+    macOS:
+      introduced: '27.0'
+      allowmanualinstall: false
+  type: <boolean>
+  presence: optional
+  default: false
+  content: If `true`, the system allows use of the captive WiFi portal at login or
+    unlock.
 examples:
 - title: Profile example
   files:

mdm/profiles/com.apple.networkusagerules.yaml

@@ -43,7 +43,7 @@ payloadkeys:
 
 
 
-        Each string in the `AppIdentifierMatches` array may either be an exact app identifier match (for example, `com.mycompany.myapp`) or it may specify a prefix match for the bundle ID by using the \* wildcard character. If used, this character must appear after a period (.) and may only appear once, at the end of the string; for example, `com.mycompany.*`.
+        Each string in the `AppIdentifierMatches` array may either be an exact app identifier match (for example, `com.mycompany.myapp`) or it may specify a prefix match for the bundle ID by using the \* wildcard character. If used, this character must appear after a period (.) and may only appear once, at the end of the string; for example, `com.mycompany.\*`.
       subkeys:
       - key: AppIdentifierMatchesItem
         type: <string>

mdm/profiles/com.apple.relay.managed.yaml

@@ -5,6 +5,7 @@ payload:
   supportedOS:
     iOS:
       introduced: '17.0'
+      deprecated: '27.0'
       multiple: true
       supervised: false
       allowmanualinstall: true
@@ -16,6 +17,7 @@ payload:
         mode: allowed
     macOS:
       introduced: '14.0'
+      deprecated: '27.0'
       multiple: true
       devicechannel: true
       userchannel: true
@@ -32,6 +34,7 @@ payload:
       allowmanualinstall: true
     visionOS:
       introduced: '1.0'
+      deprecated: '27.0'
       multiple: true
       supervised: false
       allowmanualinstall: true

mdm/profiles/com.apple.screensaver.user.yaml

@@ -22,7 +22,7 @@ payload:
       introduced: n/a
     watchOS:
       introduced: n/a
-  content: Specifies *user* screen saver settings. (Settings for Login Window screen
+  content: Specifies user screen saver settings. (Settings for Login Window screen
     saver use a different payload)
 payloadkeys:
 - key: moduleName

mdm/profiles/com.apple.security.FDERecoveryRedirect.yaml

@@ -23,7 +23,7 @@ payload:
     watchOS:
       introduced: n/a
   content: |-
-    *** This payload will be ignored on macOS 10.13 and later. See "com.apple.security.FDERecoveryKeyEscrow" payload. ***
+    This payload will be ignored on macOS 10.13 and later. See "com.apple.security.FDERecoveryKeyEscrow" payload.
     Old notes:
     Once installed, this payload will cause any FDE (Full Disk Encryption) recovery keys to be redirected to the specified URL instead of being sent to Apple. This will require sites to implement their own HTTPS server that will receive the recovery keys via a POST request. Details of the data sent to the server will be provided in a different document.
     Notes:

mdm/profiles/com.apple.security.firewall.yaml

@@ -58,28 +58,6 @@ payloadkeys:
       type: <boolean>
       presence: required
       content: If `true`, the system allows connections for the app.
-- key: EnableLogging
-  supportedOS:
-    macOS:
-      introduced: '12.0'
-      deprecated: '15.0'
-      removed: '15.0'
-  type: <boolean>
-  presence: optional
-  content: If `true`, the system enables logging.
-- key: LoggingOption
-  supportedOS:
-    macOS:
-      introduced: '12.0'
-      deprecated: '15.0'
-      removed: '15.0'
-  type: <string>
-  presence: optional
-  rangelist:
-  - throttled
-  - brief
-  - detail
-  content: The type of logging.
 - key: AllowSigned
   supportedOS:
     macOS:

mdm/profiles/com.apple.sso.yaml

@@ -69,7 +69,7 @@ payloadkeys:
     content: |-
       The list of app identifiers that the system allows to use this login. If this field missing, the system matches all app identifiers with this login.
 
-      Don't set an empty array. The array needs to contain strings that match App Bundle IDs. These strings can be exact matches such as `com.mycompany.myapp`, or they may specify a prefix match on the Bundle ID by using the `*` wildcard character. The wildcard character needs to appear after a period (`.`), and may only appear once, at the end of the string, for example, `com.mycompany.*`. When you provide a wildcard, the system grants access to the account to any app with a Bundle ID that begins with the prefix.
+      Don't set an empty array. The array needs to contain strings that match App Bundle IDs. These strings can be exact matches such as `com.mycompany.myapp`, or they may specify a prefix match on the Bundle ID by using the `\*` wildcard character. The wildcard character needs to appear after a period (`.`), and may only appear once, at the end of the string, for example, `com.mycompany.\*`. When you provide a wildcard, the system grants access to the account to any app with a Bundle ID that begins with the prefix.
     subkeys:
     - key: AppIdentifierMatchesItem
       type: <string>

mdm/profiles/com.apple.vpn.managed.yaml

@@ -483,7 +483,7 @@ payloadkeys:
         presence: optional
         content: |-
           An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list.
-          The system supports a wildcard (`*`) prefix. For example, `*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.
+          The system supports a wildcard (`\*`) prefix. For example, `\*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.
         subkeys:
         - key: DNSDomainMatchElement
           title: DNS domain match element
@@ -494,7 +494,7 @@ payloadkeys:
         presence: optional
         content: |-
           An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array.
-          The system supports matching with a single wildcard. For example, `17.*` matches any DNS server in the `17.0.0.0/8` subnet.
+          The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8` subnet.
         subkeys:
         - key: DNSServerAddressMatchElement
           title: DNS server address match element

mdm/profiles/com.apple.wifi.managed.yaml

@@ -207,7 +207,7 @@ payloadkeys:
     content: |-
       The list of accepted server certificate common names. If a server presents a certificate that isn't in this list, the system doesn't trust it.
       If you specify this property, the system disables dynamic trust (the certificate dialog) unless you also specify 'TLSAllowTrustExceptions' with the value 'true'.
-      If necessary, use a single "*" character to specify a wildcard for an individual component of the name, such as 'wpa.*.example.com'.
+      If necessary, use a single "\*" character to specify a wildcard for an individual component of the name, such as 'wpa.\*.example.com'.
     subkeys:
     - key: TLSTrustedServerName
       title: Individual trusted TLS server name