CalvinBackup/apple_device-management
1
0
Fork 0
mirror of https://github.com/apple/device-management.git synced 2026-07-11 05:23:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Release-v26.4

Browse Source
This commit is contained in:
Cyrus Daboo
2026-03-25 10:10:17 -04:00
parent f878dea98f
commit 67045e2fa0
17 changed files with 841 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mdm/checkin/returntoservice.yaml
+11
View File
@@ -35,6 +35,17 @@ payloadkeys:
content: The device's UDID (unique device identifier). The system requires this
value if the enrollment type is a device enrollment.
responsekeys:
- key: PreserveDataPlan
supportedOS:
iOS:
introduced: '26.4'
visionOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If `true`, the device preserves the data plan on an iPhone or iPad with
eSIM functionality, if one exists. This value is available in iOS 26.4 and later.
- key: ReturnToService
type: <dictionary>
presence: required
mdm/profiles/com.apple.applicationaccess.yaml
+92 -12
View File
@@ -295,6 +295,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '18.4'
deprecated: '26.4'
supervised: true
sharedipad:
mode: forbidden
@@ -302,6 +303,7 @@ payloadkeys:
mode: forbidden
macOS:
introduced: '15.4'
deprecated: '26.4'
userenrollment:
mode: forbidden
tvOS:
@@ -432,14 +434,17 @@ payloadkeys:
supportedOS:
iOS:
introduced: '5.0'
deprecated: '26.4'
macOS:
introduced: '14.0'
deprecated: '26.4'
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: '2.0'
deprecated: '26.4'
watchOS:
introduced: n/a
type: <boolean>
@@ -450,6 +455,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '7.0'
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
@@ -460,6 +466,7 @@ payloadkeys:
visionOS:
introduced: n/a
watchOS:
deprecated: '26.4'
supervised: true
type: <boolean>
presence: optional
@@ -471,12 +478,15 @@ payloadkeys:
supportedOS:
iOS:
introduced: '5.1'
deprecated: '26.4'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
deprecated: '26.4'
type: <boolean>
presence: optional
default: true
@@ -487,6 +497,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: 8.1.3
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
@@ -1059,6 +1070,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '13.0'
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
@@ -1144,11 +1156,13 @@ payloadkeys:
supportedOS:
iOS:
introduced: 8.1.3
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
macOS:
introduced: '10.11'
deprecated: '26.4'
userenrollment:
mode: forbidden
tvOS:
@@ -1250,11 +1264,13 @@ payloadkeys:
supportedOS:
iOS:
introduced: '10.3'
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
macOS:
introduced: '10.13'
deprecated: '26.4'
userenrollment:
mode: forbidden
tvOS:
@@ -1302,6 +1318,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '18.3'
deprecated: '26.4'
supervised: true
allowmanualinstall: false
sharedipad:
@@ -1310,6 +1327,7 @@ payloadkeys:
mode: forbidden
macOS:
introduced: '15.3'
deprecated: '26.4'
allowmanualinstall: false
userenrollment:
mode: forbidden
@@ -1317,6 +1335,7 @@ payloadkeys:
introduced: n/a
visionOS:
introduced: '2.4'
deprecated: '26.4'
supervised: true
allowmanualinstall: false
userenrollment:
@@ -1519,18 +1538,21 @@ payloadkeys:
supportedOS:
iOS:
introduced: '18.2'
deprecated: '26.4'
sharedipad:
mode: forbidden
userenrollment:
mode: allowed
macOS:
introduced: '15.2'
deprecated: '26.4'
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: '2.4'
deprecated: '26.4'
userenrollment:
mode: allowed
watchOS:
@@ -1547,18 +1569,21 @@ payloadkeys:
supportedOS:
iOS:
introduced: '18.2'
deprecated: '26.4'
sharedipad:
mode: forbidden
userenrollment:
mode: allowed
macOS:
introduced: '15.2'
deprecated: '26.4'
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: '2.4'
deprecated: '26.4'
userenrollment:
mode: allowed
watchOS:
@@ -1777,6 +1802,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '18.0'
deprecated: '26.4'
supervised: true
sharedipad:
mode: forbidden
@@ -1784,12 +1810,14 @@ payloadkeys:
mode: forbidden
macOS:
introduced: '15.0'
deprecated: '26.4'
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: '2.4'
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
@@ -1846,6 +1874,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '18.0'
deprecated: '26.4'
supervised: true
sharedipad:
mode: forbidden
@@ -1853,12 +1882,14 @@ payloadkeys:
mode: forbidden
macOS:
introduced: '15.0'
deprecated: '26.4'
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: '2.4'
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
@@ -1873,6 +1904,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '18.0'
deprecated: '26.4'
supervised: true
sharedipad:
mode: forbidden
@@ -1884,6 +1916,7 @@ payloadkeys:
introduced: n/a
visionOS:
introduced: '2.4'
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
@@ -2025,6 +2058,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '9.0'
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
@@ -2183,6 +2217,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '18.4'
deprecated: '26.4'
supervised: true
sharedipad:
mode: forbidden
@@ -2190,12 +2225,14 @@ payloadkeys:
mode: forbidden
macOS:
introduced: '15.4'
deprecated: '26.4'
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: '2.4'
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
@@ -2209,6 +2246,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '18.1'
deprecated: '26.4'
supervised: true
sharedipad:
mode: forbidden
@@ -2216,12 +2254,14 @@ payloadkeys:
mode: forbidden
macOS:
introduced: '15.1'
deprecated: '26.4'
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: '2.4'
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
@@ -2407,6 +2447,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '18.4'
deprecated: '26.4'
supervised: true
sharedipad:
mode: forbidden
@@ -2414,6 +2455,7 @@ payloadkeys:
mode: forbidden
macOS:
introduced: '15.4'
deprecated: '26.4'
userenrollment:
mode: forbidden
tvOS:
@@ -2430,6 +2472,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '18.3'
deprecated: '26.4'
supervised: true
sharedipad:
mode: forbidden
@@ -2437,6 +2480,7 @@ payloadkeys:
mode: forbidden
macOS:
introduced: '15.3'
deprecated: '26.4'
userenrollment:
mode: forbidden
tvOS:
@@ -2641,6 +2685,7 @@ payloadkeys:
tvOS:
introduced: '12.0'
deprecated: '17.4'
removed: '26.4'
supervised: true
visionOS:
introduced: n/a
@@ -2700,6 +2745,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '18.0'
deprecated: '26.4'
supervised: true
sharedipad:
mode: forbidden
@@ -2761,6 +2807,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: 8.1.3
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
@@ -2817,6 +2864,8 @@ payloadkeys:
presence: optional
default: true
content: If `false`, disables the prompt to set up new devices that are nearby.
Starting with iOS 26.3, this also prevents exporting iOS data to set up new Android
devices.
- key: allowRadioService
title: Allow iTunes Radio
supportedOS:
@@ -2964,6 +3013,29 @@ payloadkeys:
is `false`, the Classroom app doesn't observe remote screens. Requires a supervised
device until iOS 13 and macOS 10.15. Allowed for user enrollments in macOS 12
and later.
- key: allowRosettaUsageAwareness
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '26.4'
allowmanualinstall: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: true
content: If `false`, disables Rosetta usage awareness. When Rosetta usage awareness
is active, a pop-up dialog is displayed to the user when an app that is using
Rosetta is launched. The pop-up dialog indicates that Rosetta will be removed
in a future version of the operating system so that the user can contact the app
vendor regarding a replacement for the current app.
- key: allowSafari
title: Allow use of Safari
supportedOS:
@@ -3045,6 +3117,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '18.4'
deprecated: '26.4'
supervised: true
sharedipad:
mode: forbidden
@@ -3052,12 +3125,14 @@ payloadkeys:
mode: forbidden
macOS:
introduced: '15.4'
deprecated: '26.4'
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: '2.4'
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
@@ -3153,6 +3228,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: 8.1.3
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
@@ -3462,6 +3538,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '18.3'
deprecated: '26.4'
supervised: true
sharedipad:
mode: forbidden
@@ -3573,6 +3650,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: '18.0'
deprecated: '26.4'
supervised: true
sharedipad:
mode: forbidden
@@ -3580,12 +3658,14 @@ payloadkeys:
mode: forbidden
macOS:
introduced: '15.0'
deprecated: '26.4'
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: '2.4'
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
@@ -3922,11 +4002,13 @@ payloadkeys:
supportedOS:
iOS:
introduced: '5.0'
deprecated: '26.4'
supervised: true
userenrollment:
mode: forbidden
macOS:
introduced: '10.13'
deprecated: '26.4'
userenrollment:
mode: forbidden
tvOS:
@@ -4235,12 +4317,17 @@ payloadkeys:
supportedOS:
iOS:
introduced: '14.5'
deprecated: '26.4'
macOS:
introduced: '14.0'
deprecated: '26.4'
tvOS:
introduced: n/a
visionOS:
introduced: '2.0'
deprecated: '26.4'
watchOS:
deprecated: '26.4'
type: <boolean>
presence: optional
default: false
@@ -4250,12 +4337,15 @@ payloadkeys:
supportedOS:
iOS:
introduced: '15.0'
deprecated: '26.4'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
deprecated: '26.4'
type: <boolean>
presence: optional
default: false
@@ -4391,21 +4481,11 @@ payloadkeys:
max: 1000
default: 1000
content: |-
The maximum level of app content allowed on the device. Preinstalled (first-party) apps ignore this restriction.
Possible values, with the U.S. description of the rating level:
- `1000`: All
- `600`: 17+
- `300`: 12+
- `200`: 9+
- `100`: 4+
- `0`: None
The maximum level of app content allowed on the device. Starting with iOS 26.2, this rating may apply to certain system apps.
Age bands and the number of discrete age values vary by region, but the values are consistent across regions. For example, in a region that defines rating level 14+, its value is guaranteed to be larger than 300 (12+) and smaller than 600 (17+). Also, the value of rating level 15+ is guaranteed to be larger than the assigned value of rating level 14+. For more information about age ratings, see [Age ratings values and definitions](https://developer.apple.com/help/app-store-connect/reference/age-ratings-values-and-definitions).
Examples of values in other regions include:
Below is the complete list of age rating values used across all App Store regions.
- `1000`: All
- `621`: 21+
- `620`: 20+
mdm/profiles/com.apple.familycontrols.contentfilter.yaml
+12 -12
View File
@@ -33,7 +33,7 @@ payloadkeys:
presence: optional
default: false
content: If `true`, filters content automatically.
- key: allowlistEnabled
- key: allowListEnabled
supportedOS:
macOS:
introduced: '15.2'
@@ -48,8 +48,8 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: Use `allowlistEnabled` instead.
- key: siteAllowlist
content: Use `allowListEnabled` instead.
- key: siteAllowList
supportedOS:
macOS:
introduced: '15.2'
@@ -58,9 +58,9 @@ payloadkeys:
content: |-
An array of sites that defines an allow list. If specified, this defines additional allowed sites besides those in the automated allow list and deny list, including disallowed adult sites.
This key is required if `allowlistEnabled` is `true`.
This key is required if `allowListEnabled` is `true`.
subkeys:
- key: siteAllowlistItem
- key: siteAllowListItem
type: <dictionary>
content: A dictionary defining a site for the allow list.
subkeys:
@@ -78,7 +78,7 @@ payloadkeys:
deprecated: '15.2'
type: <array>
presence: optional
content: Use `siteAllowlist` instead.
content: Use `siteAllowList` instead.
subkeys:
- key: siteWhitelistItem
type: <dictionary>
@@ -92,7 +92,7 @@ payloadkeys:
type: <string>
presence: optional
content: The site page title.
- key: filterAllowlist
- key: filterAllowList
supportedOS:
macOS:
introduced: '15.2'
@@ -101,7 +101,7 @@ payloadkeys:
content: The array of URLs that defines an allow list. When `restrictWeb` and `useContentFilter`
are enabled, only URLs in the allow list are available to the user.
subkeys:
- key: filterAllowlistItem
- key: filterAllowListItem
type: <string>
presence: required
content: An allowed site.
@@ -111,13 +111,13 @@ payloadkeys:
deprecated: '15.2'
type: <array>
presence: optional
content: Use `filterAllowlist` instead.
content: Use `filterAllowList` instead.
subkeys:
- key: filterWhitelistItem
type: <string>
presence: required
content: An allowed site.
- key: filterDenylist
- key: filterDenyList
supportedOS:
macOS:
introduced: '15.2'
@@ -126,7 +126,7 @@ payloadkeys:
content: The array of URLs that defines a deny list. When `restrictWeb` and `useContentFilter`
are enabled, no URLs in the deny list are available to the user.
subkeys:
- key: filterDenylistItem
- key: filterDenyListItem
type: <string>
presence: required
content: A disallowed site.
@@ -136,7 +136,7 @@ payloadkeys:
deprecated: '15.2'
type: <array>
presence: optional
content: Use `filterDenylist` instead.
content: Use `filterDenyList` instead.
subkeys:
- key: filterBlacklistItem
type: <string>
mdm/profiles/com.apple.fileproviderd.yaml
+86
View File
@@ -23,6 +23,38 @@ payload:
watchOS:
introduced: n/a
payloadkeys:
- key: ManagementAllowsRemoteSyncing
supportedOS:
macOS:
introduced: '26.4'
devicechannel: true
userchannel: false
type: <boolean>
presence: optional
default: true
content: If `false`, the device prevents the File Provider extension from using
synchronization in any app. Also, none of the other options will be evaluated.
Synchronization will be totally disabled for any application.
- key: ManagementRemoteSyncingAllowList
supportedOS:
macOS:
introduced: '26.4'
devicechannel: true
userchannel: false
type: <array>
presence: optional
content: An array of strings representing the composed identifiers of apps. The
device allows the corresponding apps to use File Provider extension synchronization.
If present, and `ManagementAllowsRemoteSyncing` is set to `true`, the device allows
only the apps in this list to use synchronization. This key is ignored if `ManagementAllowsRemoteSyncing`
is set to `false`. If present, the other options will only be evaluated for the
apps in this list. The format of the app identifiers is "Bundle-ID (Team-ID)",
for example `com.example.app (ABCD1234)`.
subkeys:
- key: AllowListItem
type: <string>
presence: required
content: A composed app identifier. The format is "Bundle.Identifier (TeamIdentifier)".
- key: AllowManagedFileProvidersToRequestAttribution
type: <boolean>
presence: optional
@@ -63,3 +95,57 @@ payloadkeys:
type: <string>
presence: required
content: A composed app identifier. The format is "Bundle.Identifier (TeamIdentifier)".
- key: ManagementAllowsExternalVolumeSyncing
supportedOS:
macOS:
introduced: '26.4'
devicechannel: true
userchannel: false
type: <boolean>
presence: optional
default: true
content: If `false`, the device only allows File Provider extension volume synchronization
for the system "home" volume and any data separated volume, and prevents synchronization
with any other volumes. If `true``, the device allows File Provider extension
volume synchronization for the system "home" volume, any data separated volume,
and any encrypted APFS volumes (on either internal or external media).
- key: ManagementExternalVolumeSyncingAllowList
supportedOS:
macOS:
introduced: '26.4'
devicechannel: true
userchannel: false
type: <array>
presence: optional
content: An array of strings representing the composed identifiers of apps. The
device allows the corresponding apps to use File Provider extension volume synchronization.
If present, and `ManagementAllowsExternalVolumeSyncing` is set to `true`, the
device allows only the apps in this list to use volume synchronization. This key
is ignored if `ManagementAllowsExternalVolumeSyncing` is set to `false`. The format
of the app identifiers is "Bundle-ID (Team-ID)", for example `com.example.app
(ABCD1234)`.
subkeys:
- key: AllowListItem
type: <string>
presence: required
content: A composed app identifier. The format is "Bundle.Identifier (TeamIdentifier)".
- key: ManagementDomainAutoEnablementList
supportedOS:
macOS:
introduced: '26.4'
devicechannel: true
userchannel: false
type: <array>
presence: optional
content: An array of strings representing the composed identifiers of apps. The
device automatically enables the File Provider domains for the corresponding apps.
The device doesn't enable existing domains if enrollment happens after they are
created. The device doesn't prevent the user from disabling these File Provider
domains. Users need to manually enable File Provider domains in the Finder if
their corresponding apps aren't listed here. The format of the app identifiers
is "Bundle-ID (Team-ID)", for example `com.example.app (ABCD1234)`.
subkeys:
- key: AllowListItem
type: <string>
presence: required
content: A composed app identifier. The format is "Bundle.Identifier (TeamIdentifier)".