CalvinBackup/apple_device-management
1
0
Fork 0
mirror of https://github.com/apple/device-management.git synced 2026-08-28 02:50:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

Release_iOS-17-0_macOS-14-0

Browse Source
This commit is contained in:
Cyrus Daboo
2023-09-14 17:37:41 -04:00
parent 5a8fb0deb2
commit 72c2a0a69f
254 changed files with 6787 additions and 969 deletions
Download Patch File Download Diff File Expand all files Collapse all files
declarative/declarations/configurations/account.caldav.yaml
+20 -11
View File
@@ -5,20 +5,27 @@ payload:
supportedOS:
iOS:
introduced: '15.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
sharedipad:
mode: allowed
devicechannel: false
userchannel: true
userenrollment:
mode: allowed
allowed-scopes:
- user
macOS:
introduced: '13.0'
devicechannel: false
userchannel: true
userenrollment:
mode: allowed
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- user
tvOS:
introduced: n/a
watchOS:
introduced: n/a
content: A CalDAV configuration defines a CalDAV calendar and reminders account
for a user.
payloadkeys:
@@ -32,7 +39,7 @@ payloadkeys:
title: Server Host Name
type: <string>
presence: required
content: The hostname of the CalDAV server (or IP address).
content: The hostname or IP address of the CalDAV server.
- key: Port
title: Server Port
type: <integer>
@@ -46,6 +53,8 @@ payloadkeys:
- key: AuthenticationCredentialsAssetReference
title: Authentication Credentials Asset Reference
type: <string>
assettypes:
- com.apple.asset.credential.userpassword
presence: optional
content: The identifier of an asset declaration that contains the credentials for
this account. The corresponding asset must be of type CredentialUserNameAndPassword.
this account. Set the corresponding asset type to 'CredentialUserNameAndPassword'.
declarative/declarations/configurations/account.carddav.yaml
+20 -11
View File
@@ -5,20 +5,27 @@ payload:
supportedOS:
iOS:
introduced: '15.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
sharedipad:
mode: allowed
devicechannel: false
userchannel: true
userenrollment:
mode: allowed
allowed-scopes:
- user
macOS:
introduced: '13.0'
devicechannel: false
userchannel: true
userenrollment:
mode: allowed
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- user
tvOS:
introduced: n/a
watchOS:
introduced: n/a
content: A CardDAV configuration defines a CardDAV contacts account for a user.
payloadkeys:
- key: VisibleName
@@ -31,7 +38,7 @@ payloadkeys:
title: Server Host Name
type: <string>
presence: required
content: The hostname of the CardDAV server (or IP address).
content: The hostname or IP address of the CardDAV server.
- key: Port
title: Server Port
type: <integer>
@@ -45,6 +52,8 @@ payloadkeys:
- key: AuthenticationCredentialsAssetReference
title: Authentication Credentials Asset Reference
type: <string>
assettypes:
- com.apple.asset.credential.userpassword
presence: optional
content: The identifier of an asset declaration that contains the credentials for
this account. The corresponding asset must be of type CredentialUserNameAndPassword.
this account. Set the corresponding asset type to 'CredentialUserNameAndPassword'.
declarative/declarations/configurations/account.exchange.yaml
+122 -12
View File
@@ -6,20 +6,27 @@ payload:
supportedOS:
iOS:
introduced: '15.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
sharedipad:
mode: allowed
devicechannel: false
userchannel: true
userenrollment:
mode: allowed
allowed-scopes:
- user
macOS:
introduced: '13.0'
devicechannel: false
userchannel: true
userenrollment:
mode: allowed
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- user
tvOS:
introduced: n/a
watchOS:
introduced: n/a
content: This payload configures an Exchange ActiveSync account on an iOS device.
payloadkeys:
- key: VisibleName
@@ -48,9 +55,11 @@ payloadkeys:
- key: UserIdentityAssetReference
title: User Identity Asset Reference
type: <string>
assettypes:
- com.apple.asset.useridentity
presence: optional
content: The identifier of an asset declaration that contains the user identity
for this account. The corresponding asset must be of type UserIdentity.
for this account. The corresponding asset must be of type 'UserIdentity'.
- key: HostName
title: Server Host Name
type: <string>
@@ -133,10 +142,111 @@ payloadkeys:
- key: AuthenticationCredentialsAssetReference
title: Authentication Credentials Asset Reference
type: <string>
assettypes:
- com.apple.asset.credential.userpassword
presence: optional
content: The identifier of an asset declaration that contains the credentials for
this account to authenticate with an Exchange server. The corresponding asset
must be of type CredentialUserNameAndPassword.
this account to authenticate with an Exchange server. Set the corresponding asset
type to 'CredentialUserNameAndPassword'.
- key: AuthenticationIdentityAssetReference
title: Authentication Identity Asset Reference
type: <string>
assettypes:
- com.apple.asset.credential.acme
- com.apple.asset.credential.identity
- com.apple.asset.credential.scep
presence: optional
content: Specifies the identifier of a credential asset declaration that contains
the identity that this account requires to authenticate with the Exchange server.
- key: SMIME
title: S/MIME Settings
supportedOS:
iOS:
introduced: '17.0'
macOS:
introduced: n/a
type: <dictionary>
presence: optional
content: Settings for S/MIME.
subkeys:
- key: Signing
title: S/MIME Signing Settings
type: <dictionary>
presence: optional
content: Settings for S/MIME signing.
subkeys:
- key: Enabled
title: Signing Enabled
type: <boolean>
presence: required
content: If 'true', the system enables S/MIME signing.
- key: IdentityAssetReference
title: S/MIME Signing Identity Asset Reference
type: <string>
assettypes:
- com.apple.asset.credential.acme
- com.apple.asset.credential.identity
- com.apple.asset.credential.scep
presence: optional
content: Specifies the identifier of an asset declaration containing the identity
required for S/MIME signing of messages sent from this account.
- key: UserOverrideable
title: Signing User Overrideable
type: <boolean>
presence: optional
default: false
content: If 'true', the user can turn S/MIME signing on or off in Settings.
- key: IdentityUserOverrideable
title: Signing Identity User Overrideable
type: <boolean>
presence: optional
default: false
content: If 'true', the user can select an S/MIME signing identity in Settings.
- key: Encryption
title: S/MIME Encryption Settings
type: <dictionary>
presence: optional
content: Settings for S/MIME encryption.
subkeys:
- key: Enabled
title: Encryption By Default Enabled
type: <boolean>
presence: required
content: If 'true', the system enables S/MIME encryption by default, which the
user can't override if 'PerMessageSwitchEnabled' is 'false'.
- key: IdentityAssetReference
title: S/MIME Encryption Identity Asset Reference
type: <string>
assettypes:
- com.apple.asset.credential.acme
- com.apple.asset.credential.identity
- com.apple.asset.credential.scep
presence: optional
content: Specifies the identifier of an asset declaration containing the identity
required for S/MIME encryption. The system attaches the public certificate
to outgoing mail to allow the user to receive encrypted mail. When the user
sends encrypted mail, the system uses the public certificate to encrypt the
copy of the mail in their Sent mailbox.
- key: UserOverrideable
title: Encryption By Default User Overrideable
type: <boolean>
presence: optional
default: false
content: If 'true', the user can turn S/MIME encryption by default on or off
in Settings.
- key: IdentityUserOverrideable
title: Encryption Identity User Overrideable
type: <boolean>
presence: optional
default: false
content: If 'true', the user can select an S/MIME signing identity in Settings.
- key: PerMessageSwitchEnabled
title: Per Message Switch Enabled
type: <boolean>
presence: optional
default: false
content: If 'true', the system enables the per-message encryption switch in
the compose view.
- key: MailServiceActive
supportedOS:
macOS:
declarative/declarations/configurations/account.google.yaml
+20 -11
View File
@@ -5,20 +5,27 @@ payload:
supportedOS:
iOS:
introduced: '15.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
sharedipad:
mode: allowed
devicechannel: false
userchannel: true
userenrollment:
mode: allowed
allowed-scopes:
- user
macOS:
introduced: '13.0'
devicechannel: false
userchannel: true
userenrollment:
mode: allowed
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- user
tvOS:
introduced: n/a
watchOS:
introduced: n/a
content: A Google configuration defines a Google account for a user. The user will
be prompted to enter their credentials shortly after the configuration successfully
installs.
@@ -32,8 +39,10 @@ payloadkeys:
- key: UserIdentityAssetReference
title: User Identity Asset Reference
type: <string>
assettypes:
- com.apple.asset.useridentity
presence: required
content: The identifier of an asset declaration that contains the user identity
for this Google account. The corresponding asset must be of type UserIdentity.
The asset must contain an 'EmailAddress' key that specifies the full Google email
for this Google account. Set the corresponding asset type to 'UserIdentity' and
ensure that it contains an 'EmailAddress' key that specifies the full Google email
address for the account.
declarative/declarations/configurations/account.ldap.yaml
+21 -12
View File
@@ -5,20 +5,27 @@ payload:
supportedOS:
iOS:
introduced: '15.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
sharedipad:
mode: allowed
devicechannel: false
userchannel: true
userenrollment:
mode: allowed
allowed-scopes:
- user
macOS:
introduced: '13.0'
devicechannel: false
userchannel: true
userenrollment:
mode: allowed
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- user
tvOS:
introduced: n/a
watchOS:
introduced: n/a
content: An LDAP configuration defines an LDAP directory account for a user.
payloadkeys:
- key: VisibleName
@@ -31,18 +38,20 @@ payloadkeys:
title: Server Host Name
type: <string>
presence: required
content: The hostname of the LDAP server (or IP address).
content: The hostname or IP address of the LDAP server.
- key: Port
title: Server Port
type: <integer>
presence: optional
content: The port number of the LDAP server (or IP address).
content: The port number or IP address of the LDAP server.
- key: AuthenticationCredentialsAssetReference
title: Authentication Credentials Asset Reference
type: <string>
assettypes:
- com.apple.asset.credential.userpassword
presence: optional
content: The identifier of an asset declaration that contains the credentials for
this account. The corresponding asset must be of type CredentialUserNameAndPassword.
this account. Set the corresponding asset type to 'CredentialUserNameAndPassword'.
- key: SearchSettings
title: Search Settings
type: <array>
declarative/declarations/configurations/account.mail.yaml
+114 -12
View File
@@ -5,20 +5,27 @@ payload:
supportedOS:
iOS:
introduced: '15.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
sharedipad:
mode: allowed
devicechannel: false
userchannel: true
userenrollment:
mode: allowed
allowed-scopes:
- user
macOS:
introduced: '13.0'
devicechannel: false
userchannel: true
userenrollment:
mode: allowed
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- user
tvOS:
introduced: n/a
watchOS:
introduced: n/a
content: An email configuration defines an email account for a user.
payloadkeys:
- key: VisibleName
@@ -30,9 +37,11 @@ payloadkeys:
- key: UserIdentityAssetReference
title: User Identity Asset Reference
type: <string>
assettypes:
- com.apple.asset.useridentity
presence: optional
content: The identifier of an asset declaration that contains the user identity
for this account. The corresponding asset must be of type UserIdentity.
for this account. Set the corresponding asset type to 'UserIdentity'.
- key: IncomingServer
title: Incoming Server Settings
type: <dictionary>
@@ -71,9 +80,11 @@ payloadkeys:
- key: AuthenticationCredentialsAssetReference
title: Authentication Credentials Asset Reference
type: <string>
assettypes:
- com.apple.asset.credential.userpassword
presence: optional
content: |-
The identifier of an asset declaration that contains the credentials for this account to authenticate with an incoming mail server. The corresponding asset must be of type CredentialUserNameAndPassword.
The identifier of an asset declaration that contains the credentials for this account to authenticate with an incoming mail server. The corresponding asset must be of type 'CredentialUserNameAndPassword'.
If the 'AuthenticationMethod' is 'None', this field must be blank. Otherwise, the declaration must contain this field.
- key: IMAPPathPrefix
title: IMAP Path Prefix
@@ -111,7 +122,98 @@ payloadkeys:
- key: AuthenticationCredentialsAssetReference
title: Authentication Credentials Asset Reference
type: <string>
assettypes:
- com.apple.asset.credential.userpassword
presence: optional
content: |-
The identifier of an asset declaration that contains the credentials for this account to authenticate with an outgoing mail server. The corresponding asset must be of type CredentialUserNameAndPassword.
The identifier of an asset declaration that contains the credentials for this account to authenticate with an outgoing mail server. The corresponding asset must be of type 'CredentialUserNameAndPassword'.
If the 'AuthenticationMethod' is 'None', this field must be blank. Otherwise, the declaration must contain this field.
- key: SMIME
title: S/MIME Settings
supportedOS:
iOS:
introduced: '17.0'
macOS:
introduced: n/a
type: <dictionary>
presence: optional
content: Settings for S/MIME.
subkeys:
- key: Signing
title: S/MIME Signing Settings
type: <dictionary>
presence: optional
content: Settings for S/MIME signing.
subkeys:
- key: Enabled
title: Signing Enabled
type: <boolean>
presence: required
content: If 'true', the system enables S/MIME signing.
- key: IdentityAssetReference
title: S/MIME Signing Identity Asset Reference
type: <string>
assettypes:
- com.apple.asset.credential.acme
- com.apple.asset.credential.identity
- com.apple.asset.credential.scep
presence: optional
content: Specifies the identifier of an asset declaration containing the identity
required for S/MIME signing of messages sent from this account.
- key: UserOverrideable
title: Signing User Overrideable
type: <boolean>
presence: optional
default: false
content: If 'true', the user can turn S/MIME signing on or off in Settings.
- key: IdentityUserOverrideable
title: Signing Identity User Overrideable
type: <boolean>
presence: optional
default: false
content: If 'true', the user can select an S/MIME signing identity in Settings.
- key: Encryption
title: S/MIME Encryption Settings
type: <dictionary>
presence: optional
content: Settings for S/MIME encryption.
subkeys:
- key: Enabled
title: Encryption By Default Enabled
type: <boolean>
presence: required
content: If 'true', the system enables S/MIME encryption by default, which the
user can't override if 'PerMessageSwitchEnabled' is 'false'.
- key: IdentityAssetReference
title: S/MIME Encryption Identity Asset Reference
type: <string>
assettypes:
- com.apple.asset.credential.acme
- com.apple.asset.credential.identity
- com.apple.asset.credential.scep
presence: optional
content: Specifies the identifier of an asset declaration containing the identity
required for S/MIME encryption. The system attaches the public certificate
to outgoing mail to allow the user to receive encrypted mail. When the user
sends encrypted mail, the system uses the public certificate to encrypt the
copy of the mail in their Sent mailbox.
- key: UserOverrideable
title: Encryption By Default User Overrideable
type: <boolean>
presence: optional
default: false
content: If 'true', the user can set the default value for S/MIME encryption
to on or off in Settings.
- key: IdentityUserOverrideable
title: Encryption Identity User Overrideable
type: <boolean>
presence: optional
default: false
content: If 'true', the user can select an S/MIME signing identity in Settings.
- key: PerMessageSwitchEnabled
title: Per Message Switch Enabled
type: <boolean>
presence: optional
default: false
content: If 'true', the system enables the per-message encryption switch in
the compose view.
declarative/declarations/configurations/account.subscribed-calendar.yaml
+22 -9
View File
@@ -5,16 +5,27 @@ payload:
supportedOS:
iOS:
introduced: '15.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
sharedipad:
mode: allowed
devicechannel: false
userchannel: true
userenrollment:
mode: allowed
allowed-scopes:
- user
macOS:
introduced: n/a
introduced: '14.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- user
tvOS:
introduced: n/a
watchOS:
introduced: n/a
content: A subscribed calendar configuration defines a subscribed calendar for a
user.
payloadkeys:
@@ -28,11 +39,13 @@ payloadkeys:
title: Calendar URL
type: <string>
presence: required
content: The URL of the subscribed calendar. The URL must start with 'https://'.
content: The URL of the subscribed calendar, which needs to start with 'https://'.
- key: AuthenticationCredentialsAssetReference
title: Authentication Credentials Asset Reference
type: <string>
assettypes:
- com.apple.asset.credential.userpassword
presence: optional
content: The identifier of an asset declaration that contains the credentials for
this account to authenticate with a calendar server. The corresponding asset must
be of type CredentialUserNameAndPassword.
this account to authenticate with a calendar server. Set the corresponding asset
type to 'CredentialUserNameAndPassword'.
declarative/declarations/configurations/legacy.interactive.yaml
+20 -9
View File
@@ -6,26 +6,37 @@ payload:
supportedOS:
iOS:
introduced: '15.0'
allowed-enrollments:
- device
- user
allowed-scopes:
- system
sharedipad:
mode: forbidden
userenrollment:
mode: allowed
allowed-scopes: []
macOS:
introduced: '13.0'
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
allowed-enrollments:
- device
- user
allowed-scopes:
- system
- user
tvOS:
introduced: '16.0'
allowed-enrollments:
- device
allowed-scopes:
- system
watchOS:
introduced: n/a
payloadkeys:
- key: ProfileURL
title: Profile's URL.
type: <string>
presence: required
content: |-
The URL of the profile to download and install. This must be an 'https://' URL.
If a user enrollment triggers this configuration, the system silently ignores any MDM 1 payloads in macOS where the User Enrollment Mode setting is 'forbidden'. In iOS and tvOS, the system rejects the entire profile.
The URL of the profile to download and install, which needs to start with 'https://', and must be hosted by the MDM server. The system silently ignores any account or passcode payloads in the profile. Use their declarative configurations instead.
If a user enrollment triggers this configuration, the system silently ignores any MDM 1 payloads in macOS where the User Enrollment Mode setting is 'forbidden'. In iOS, the system rejects the entire profile.
- key: VisibleName
title: Configuration Visible Name
type: <string>
declarative/declarations/configurations/legacy.yaml
+29 -10
View File
@@ -5,25 +5,44 @@ payload:
supportedOS:
iOS:
introduced: '15.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
sharedipad:
mode: allowed
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
allowed-scopes:
- system
- user
macOS:
introduced: '13.0'
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
- user
tvOS:
introduced: '16.0'
allowed-enrollments:
- device
- local
allowed-scopes:
- system
watchOS:
introduced: '10.0'
allowed-enrollments:
- device
- local
allowed-scopes:
- system
payloadkeys:
- key: ProfileURL
title: Profile's URL.
type: <string>
presence: required
content: |-
The URL of the profile to download and install. This must be an 'https://' URL.
The URL of the profile to download and install, which needs to start with 'https://', and must be hosted by the MDM server. The system silently ignores any account or passcode payloads in the profile. Use their declarative configurations instead.
If a user enrollment triggers this configuration, the system silently ignores any MDM 1 payloads in macOS where the User Enrollment Mode setting is 'forbidden'. In iOS and tvOS, the system rejects the entire profile.
declarative/declarations/configurations/management.status-subscriptions.yaml
+24 -9
View File
@@ -6,20 +6,35 @@ payload:
supportedOS:
iOS:
introduced: '15.0'
allowed-enrollments:
- device
- user
allowed-scopes:
- system
sharedipad:
mode: allowed
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
allowed-scopes:
- system
- user
macOS:
introduced: '13.0'
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
allowed-enrollments:
- device
- user
allowed-scopes:
- system
- user
tvOS:
introduced: '16.0'
allowed-enrollments:
- device
allowed-scopes:
- system
watchOS:
introduced: '10.0'
allowed-enrollments:
- device
allowed-scopes:
- system
payloadkeys:
- key: StatusItems
title: Status Items
declarative/declarations/configurations/management.test.yaml
+43 -9
View File
@@ -5,26 +5,60 @@ payload:
supportedOS:
iOS:
introduced: '15.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
sharedipad:
mode: allowed
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
allowed-scopes:
- system
- user
macOS:
introduced: '13.0'
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
- user
tvOS:
introduced: '16.0'
allowed-enrollments:
- device
- local
allowed-scopes:
- system
watchOS:
introduced: '10.0'
allowed-enrollments:
- device
- local
allowed-scopes:
- system
payloadkeys:
- key: Echo
title: Status Echo
type: <string>
presence: required
content: The string to echo back in a status response reason.
- key: EchoDataAssetReference
title: Status Echo from Asset
supportedOS:
iOS:
introduced: '17.0'
macOS:
introduced: '14.0'
tvOS:
introduced: '17.0'
type: <string>
assettypes:
- com.apple.asset.data
presence: optional
content: The string to read from a data asset to echo back in status response reason
description.
- key: ReturnStatus
title: Status to Return
type: <string>
declarative/declarations/configurations/passcode.settings.yaml
+79 -21
View File
@@ -5,16 +5,31 @@ payload:
supportedOS:
iOS:
introduced: '15.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
sharedipad:
mode: forbidden
userenrollment:
mode: allowed
allowed-scopes: []
macOS:
introduced: '13.0'
userenrollment:
mode: forbidden
allowed-enrollments:
- device
- local
allowed-scopes:
- system
- user
tvOS:
introduced: n/a
watchOS:
introduced: '10.0'
allowed-enrollments:
- device
- local
allowed-scopes:
- system
payloadkeys:
- key: RequirePasscode
title: Require Passcode on Device
@@ -31,18 +46,20 @@ payloadkeys:
introduced: '16.2'
macOS:
introduced: '13.1'
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If set to true, the passcode must consist of at least one alphabetic characters
("abcd"), and at least one number.
content: If 'true', the passcode needs to consist of at least one alphabetic character
and at least one number.
- key: RequireComplexPasscode
title: Require Complex Passcode
type: <boolean>
presence: optional
default: false
content: If 'true', requires a complex passcode. A complex passcode is one that
doesn't contain repeated characters or increasing/decreasing characters (such
doesn't contain repeated characters or increasing or decreasing characters (such
as 123 or CBA).
- key: MinimumLength
title: Minimum Passcode Length
@@ -60,14 +77,17 @@ payloadkeys:
introduced: '16.2'
macOS:
introduced: '13.1'
watchOS:
introduced: n/a
type: <integer>
presence: optional
range:
min: 0
max: 4
default: 1
content: Specifies the minimum number of complex characters that must be present.
Only used when RequireComplexPasscode is true.
default: 0
content: Specifies the minimum number of complex characters in the password. A complex
character is a character other than a number or a letter, such as '&', '%', '$',
and '#'.
- key: MaximumFailedAttempts
title: Maximum Number of Failed Attempts
type: <integer>
@@ -86,11 +106,13 @@ payloadkeys:
introduced: n/a
macOS:
introduced: '13.1'
watchOS:
introduced: n/a
type: <integer>
presence: optional
content: The number of minutes before the login will be reset after the maximum
number of failed attempts has been reached. The MaximumFailedAttempts key must
be set for this to take effect.
content: The number of minutes before the login is reset after the maximum number
of failed attempts. Also set the 'MaximumFailedAttempts' key for this to take
effect.
- key: MaximumGracePeriodInMinutes
title: Maximum Grace Period
type: <integer>
@@ -120,9 +142,9 @@ payloadkeys:
range:
min: 0
max: 730
content: Specifies the maximum number of days for which the passcode can remain
unchanged. After this number of days, the user is forced to change the passcode
before the device is unlocked.
content: Specifies the maximum number of days that the passcode can remain unchanged.
After this number of days, the system forces the user to change the passcode before
it unlocks the device.
- key: PasscodeReuseLimit
title: Passcode Reuse Limit
type: <integer>
@@ -141,10 +163,46 @@ payloadkeys:
introduced: n/a
macOS:
introduced: '13.1'
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If set to true, forces a password reset to occur the next time the user
tries to authenticate. If this key is set in a configuration in the system scope
(device channel), the setting takes effect for all users, and admin authentications
may fail until the admin user password is also reset.
content: If 'true', the system forces a password reset the next time the user tries
to authenticate. If you set this key in a configuration in the system scope (device
channel), the setting takes effect for all users, and admin authentication may
fail until the admin user password is also reset.
- key: CustomRegex
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '14.0'
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: Specifies a regular expression, and its description, to enforce password
compliance. Use the simpler passcode settings whenever possible, and rely on regular
expression matching only when necessary. Mistakes in regular expressions can lead
to frustrating user experiences, such as unsatisfiable passcode policies, or policy
descriptions that don't match the enforced policy.
subkeys:
- key: Regex
type: <string>
presence: required
content: A regular expression string to match against the password to determine
whether it complies with a policy. The regular expression uses the ICU syntax.
The string can't exceed 2048 characters in length.
- key: Description
type: <dictionary>
presence: optional
content: A dictionary with supported OS language IDs for the keys (such as 'en-US'),
and values that represent a localized description of the policy that the regular
expression enforces. Use the special 'default' key for languages that the dictionary
doesn't contain.
subkeys:
- key: ANY
type: <string>
presence: optional
content: A localized description.
declarative/declarations/configurations/screensharing.connection.group.yaml
+42
View File
@@ -0,0 +1,42 @@
title: Screen Sharing:Connection Group
description: Use this configuration to define a group of Screen Sharing connections.
payload:
declarationtype: com.apple.configuration.screensharing.connection.group
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '14.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
- user
tvOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: ConnectionGroupUUID
title: Unique Identifier
type: <string>
presence: required
content: A string which uniquely identifies this connection group.
- key: GroupName
title: Group Name
type: <string>
presence: required
content: The name of the Connection Group.
- key: Members
title: Group Members
type: <array>
presence: required
content: |-
Array of ConnectionUUIDs (matching a connection declared in a
com.apple.configuration.screensharing.connection configuration) of the Connections
that should be members of this group.
subkeys:
- key: ConnectionUUID
type: <string>
declarative/declarations/configurations/screensharing.connection.yaml
+66
View File
@@ -0,0 +1,66 @@
title: Screen Sharing:Connection
description: Use this configuration to define a connection to a Screen Sharing host.
payload:
declarationtype: com.apple.configuration.screensharing.connection
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '14.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
- user
tvOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: ConnectionUUID
title: Unique Identifier
type: <string>
presence: required
content: A unique identifier for this connection when it's in a connection group.
- key: DisplayName
title: The name of the connection.
type: <string>
presence: required
content: The name of the connection.
- key: HostName
title: Host Name
type: <string>
presence: required
content: The host name or IP address of the Mac that hosts the screen-sharing connection.
- key: Port
title: TCP Port
type: <integer>
presence: optional
content: Specifies the TCP port number on the host to initiate the connection.
- key: DisplayConfiguration
title: Display Configuration
type: <dictionary>
presence: required
content: The display configuration for this connection.
subkeys:
- key: DisplayType
type: <string>
presence: required
rangelist:
- Virtual1
- Virtual2
content: |-
The type of display for the connection, which has these allowed values:
* 'Virtual1': Create one virtual display.
* 'Virtual2': Create two virtual displays.
- key: AuthenticationCredentialsAssetReference
title: Authentication Credentials Asset Reference
type: <string>
assettypes:
- com.apple.asset.credential.userpassword
presence: optional
content: Specifies the identifier of an asset declaration that contains the required
credentials for this connection to authenticate with the screen-sharing server.
Set the corresponding asset type to 'com.apple.asset.credential.userpassword'.
declarative/declarations/configurations/screensharing.host.settings.yaml
+58
View File
@@ -0,0 +1,58 @@
title: Screen Sharing:Host Settings
description: Use this configuration to define Screen Sharing host settings and restrictions.
payload:
declarationtype: com.apple.configuration.screensharing.host.settings
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '14.0'
allowed-enrollments:
- device
- local
allowed-scopes:
- system
tvOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: MaximumVirtualDisplays
title: Maximum number of Virtual Displays
type: <integer>
presence: optional
range:
min: 0
max: 2
content: Sets the maximum number of Virtual Displays to make available to clients.
- key: PortBase
title: UDP Port base
type: <integer>
presence: optional
range:
min: 1024
max: 65535
content: |-
Specifies the initial UDP port number for connecting to the host. Screen Sharing needs multiple connections
so additional connections will increment this base port number by 1 for each needed connection. This does not
change the port number used to initially establish a connection with a host, which is always TCP port 5900.
- key: PreventCopyFilesFromHost
title: Prevent copying files from host
type: <boolean>
presence: optional
default: false
content: Set to true to prevent users from copying files from the Screen Sharing
host.
- key: PreventCopyFilesToHost
title: Prevent copying files to host
type: <boolean>
presence: optional
default: false
content: Set to true to prevent users from copying files to the Screen Sharing host.
- key: PreventHighPerformanceConnections
title: Prevent High Performance connections
type: <boolean>
presence: optional
default: false
content: Set to true to prevent clients from establishing High Performance connections
to the host.
declarative/declarations/configurations/security.certificate.yaml
+49
View File
@@ -0,0 +1,49 @@
title: Security:Certificate
description: Use this configuration to add a certificate to the device.
payload:
declarationtype: com.apple.configuration.security.certificate
supportedOS:
iOS:
introduced: '17.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
sharedipad:
allowed-scopes:
- system
- user
macOS:
introduced: '14.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
- user
tvOS:
introduced: '17.0'
allowed-enrollments:
- device
- local
allowed-scopes:
- system
watchOS:
introduced: '10.0'
allowed-enrollments:
- device
- local
allowed-scopes:
- system
payloadkeys:
- key: CredentialAssetReference
title: Credential asset reference
type: <string>
assettypes:
- com.apple.asset.credential.certificate
presence: required
content: Specifies the identifier of an asset declaration that contains the certificate
to install.
declarative/declarations/configurations/security.identity.yaml
+73
View File
@@ -0,0 +1,73 @@
title: Security:Identity
description: Use this configuration to install an identity on the device.
payload:
declarationtype: com.apple.configuration.security.identity
supportedOS:
iOS:
introduced: '17.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
sharedipad:
allowed-scopes:
- system
- user
macOS:
introduced: '14.0'
allowed-enrollments:
- device
- user
- local
allowed-scopes:
- system
- user
tvOS:
introduced: '17.0'
allowed-enrollments:
- device
- local
allowed-scopes:
- system
watchOS:
introduced: '10.0'
allowed-enrollments:
- device
- local
allowed-scopes:
- system
payloadkeys:
- key: CredentialAssetReference
title: Credential asset reference
type: <string>
assettypes:
- com.apple.asset.credential.identity
- com.apple.asset.credential.scep
- com.apple.asset.credential.acme
presence: required
content: Specifies the identifier of an asset declaration that contains the identity
to install.
- key: AllowAllAppsAccess
title: Allow all apps access
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', apps can access the private key.
- key: KeyIsExtractable
title: Key is extractable
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
type: <boolean>
presence: optional
default: true
content: If 'true', the private key is extractable in the keychain.
declarative/declarations/configurations/security.passkey.attestation.yaml
+54
View File
@@ -0,0 +1,54 @@
title: Security:Passkey:Attestation
description: Configures the device to allow WebAuthn enterprise attestation for certain
passkeys.
payload:
declarationtype: com.apple.configuration.security.passkey.attestation
supportedOS:
iOS:
introduced: '17.0'
allowed-enrollments:
- device
allowed-scopes:
- system
sharedipad:
allowed-scopes: []
macOS:
introduced: '14.0'
allowed-enrollments:
- device
allowed-scopes:
- user
tvOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: AttestationIdentityAssetReference
title: Attestation identity asset reference.
type: <string>
assettypes:
- com.apple.asset.credential.identity
- com.apple.asset.credential.scep
- com.apple.asset.credential.acme
presence: required
content: Specifies the identifier of an asset declaration that contains the identity
to install and use for passkey attestation.
- key: AttestationIdentityKeyIsExtractable
title: Attestation identity key is extractable
supportedOS:
iOS:
introduced: n/a
type: <boolean>
presence: optional
default: true
content: If 'true', the private key for the attestation identity is extractable
in the keychain.
- key: RelyingParties
title: Relying parties
type: <array>
presence: required
content: Relying parties to allow enterprise attestation.
subkeys:
- key: RelyingParty
title: Relying party
type: <string>
declarative/declarations/configurations/services.configuration-files.yaml
+45
View File
@@ -0,0 +1,45 @@
title: Services Configuration Files
description: Specifies managed configuration files for services
payload:
declarationtype: com.apple.configuration.services.configuration-files
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '14.0'
allowed-enrollments:
- device
allowed-scopes:
- system
tvOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: ServiceType
title: Service Type
type: <string>
presence: required
content: |-
The identifier of the system service with managed configuration files.
Use a reverse DNS style for this identifier. However, the system reserves 'com.apple.' prefix for built-in services.
The available built-in services are:
* 'com.apple.sshd' configures sshd
* 'com.apple.sudo' configures sudo
* 'com.apple.pam' configures PAM
* 'com.apple.cups' configures CUPS
* 'com.apple.apache.httpd' configures Apache httpd
* 'com.apple.bash' configures bash
* 'com.apple.zsh' configures zsh
- key: DataAssetReference
title: Data Asset Reference
type: <string>
assettypes:
- com.apple.asset.data
presence: required
content: |-
Specifies the identifier of an asset declaration that contains a reference to the files to use for system service configuration. Ensure that the corresponding asset:
* Is of type 'com.apple.asset.data'
* Is a zip archive of an entire directory
* Has a 'Reference' key that includes the 'ContentType' and 'Hash-SHA-256' keys, which the system requires
The system expands the zip archive and stores the data in a well-known location for the service.
declarative/declarations/configurations/softwareupdate.enforcement.specific.yaml
+55
View File
@@ -0,0 +1,55 @@
title: Software Update:Enforcement:Specific
description: A software update enforcement policy for a specific OS release
payload:
declarationtype: com.apple.configuration.softwareupdate.enforcement.specific
supportedOS:
iOS:
introduced: '17.0'
allowed-enrollments:
- device
allowed-scopes:
- system
sharedipad:
allowed-scopes:
- system
macOS:
introduced: '14.0'
allowed-enrollments:
- device
allowed-scopes:
- system
tvOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: TargetOSVersion
title: Target OS Version
type: <string>
presence: required
content: The target OS version to update the device to by the appropriate time.
This is the OS version number, for example, '16.1'. It may also include a supplemental
version identifier, for example, '16.1.1'.
- key: TargetBuildVersion
title: Target Build Version
type: <string>
presence: optional
content: The target build version to update the device to by the appropriate time,
for example, '20A242'. The system uses the build version for testing during seeding
periods. The build version can include a supplemental version identifier, for
example, '20A242a'. If the build version isn't consistent with the target OS version
specified in the 'TargetOSVersion' key, the target OS version takes precedence.
- key: TargetLocalDateTime
title: Target Local Date Time
type: <string>
presence: required
content: The local date time value that specifies when to force install the software
update. Use the format 'yyyy-mm-ddThh:mm:ss', which is derived from RFC3339 but
doesn't include a time zone offset. If the user doesn't trigger the software update
before this time, the device force installs it.
- key: DetailsURL
title: Details URL
type: <string>
presence: optional
content: The URL of a web page that shows details that the organization provides
about the enforced update.
declarative/declarations/configurations/watch.enrollment.yaml
+43
View File
@@ -0,0 +1,43 @@
title: Watch:Enrollment
description: Specifies an MDMv1 Apple Watch enrollment profile
payload:
declarationtype: com.apple.configuration.watch.enrollment
supportedOS:
iOS:
introduced: '17.0'
allowed-enrollments:
- device
allowed-scopes:
- system
sharedipad:
allowed-scopes: []
macOS:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: EnrollmentProfileURL
title: Watch Enrollment Profile's URL.
type: <string>
presence: required
content: The URL of the profile that the Apple Watch downloads and installs if the
user opts in to management during the pairing process, which needs to start with
'https://'. Successful enrollment requires that the pairing iPhone is supervised
and the profile contains an MDM payload. Apple Watch attempts to install each
payload that the profile contains.
- key: AnchorCertificateAssetReferences
title: Anchor Certificate Asset References.
type: <array>
assettypes:
- com.apple.asset.credential.certificate
presence: optional
content: Specifies an array of identifiers of asset declarations that contain anchor
certificates to use to evaluate the trust of the enrollment profile server. Set
the type of the corresponding assets to 'com.apple.asset.credential.certificate'.
subkeys:
- key: AnchorCertificateAssetReferenceItem
type: <string>
content: Specifies the identifier of an asset declaration containing the anchor
certificate to be used.