CalvinBackup/apple_device-management
1
0
Fork 0
mirror of https://github.com/apple/device-management.git synced 2026-08-27 18:40:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

Release_iOS-17-0_macOS-14-0

Browse Source
This commit is contained in:
Cyrus Daboo
2023-09-14 17:37:41 -04:00
parent 5a8fb0deb2
commit 72c2a0a69f
254 changed files with 6787 additions and 969 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mdm/checkin/authenticate.yaml
+29
View File
@@ -23,6 +23,9 @@ payload:
tvOS:
introduced: '10.2'
supervised: false
watchOS:
introduced: '10.0'
supervised: false
content: Check-in protocol authenticate request and response.
payloadkeys:
- key: DeviceName
@@ -31,6 +34,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: required
content: The device's name.
@@ -40,6 +45,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: required
content: The device's model name.
@@ -49,6 +56,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: required
content: The device's model.
@@ -85,6 +94,8 @@ payloadkeys:
mode: required
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: required
content: The per-enrollment identifier for the device. Available in macOS 10.15
@@ -94,6 +105,9 @@ payloadkeys:
iOS:
introduced: '9.0'
accessrights: AllowQueryDeviceInformation
watchOS:
introduced: '10.0'
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The device's OS version.
@@ -102,6 +116,9 @@ payloadkeys:
iOS:
introduced: '9.0'
accessrights: AllowQueryDeviceInformation
watchOS:
introduced: '10.0'
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The device's build version.
@@ -110,6 +127,9 @@ payloadkeys:
iOS:
introduced: '9.0'
accessrights: AllowQueryDeviceInformation
watchOS:
introduced: '10.0'
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The device's product name ('iPhone3,1').
@@ -124,6 +144,9 @@ payloadkeys:
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
watchOS:
introduced: '10.0'
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The device's serial number.
@@ -138,6 +161,9 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: '10.0'
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The device's IMEI (International Mobile Station Equipment Identity).
@@ -152,6 +178,9 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: '10.0'
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The device's MEID (Mobile Equipment Identifier).
mdm/checkin/checkout.yaml
+5
View File
@@ -23,6 +23,9 @@ payload:
tvOS:
introduced: '10.2'
supervised: false
watchOS:
introduced: '10.0'
supervised: false
content: Check-in protocol check out request and response.
payloadkeys:
- key: MessageType
@@ -55,6 +58,8 @@ payloadkeys:
mode: required
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: required
content: The per-enrollment identifier for the device. Available in macOS 10.15
mdm/checkin/declarativemanagement.yaml
+14
View File
@@ -25,6 +25,10 @@ payload:
introduced: '16.0'
supervised: false
requiresdep: false
watchOS:
introduced: '10.0'
supervised: false
requiresdep: false
content: Check-in protocol declarative management request and response.
payloadkeys:
- key: MessageType
@@ -67,6 +71,8 @@ payloadkeys:
mode: required
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: required
content: The per-enrollment identifier for the device.
@@ -80,6 +86,8 @@ payloadkeys:
mode: required
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: required
content: A per-enrollment identifier that identifies the user for user enrollments.
@@ -92,6 +100,8 @@ payloadkeys:
devicechannel: false
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: On Shared iPad, this value returns the Managed Apple ID of the user. When
@@ -106,6 +116,8 @@ payloadkeys:
devicechannel: false
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: On macOS, this value always returns the ID of the user. On Shared iPad,
@@ -119,6 +131,8 @@ payloadkeys:
devicechannel: false
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: required
content: The full name of the user.
mdm/checkin/gettoken.yaml
+160
View File
@@ -0,0 +1,160 @@
title: Get Token
description: Check-in protocol get token data.
payload:
requesttype: GetToken
supportedOS:
iOS:
introduced: '17.0'
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
macOS:
introduced: '14.0'
devicechannel: true
userchannel: true
supervised: false
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: n/a
watchOS:
introduced: n/a
content: Check-in protocol get token data request and response.
payloadkeys:
- key: MessageType
type: <string>
presence: required
rangelist:
- GetToken
content: A string that specifies this is a get-token request.
- key: TokenServiceType
type: <string>
presence: required
rangelist:
- com.apple.maid
- com.apple.watch.pairing
content: A string that specifies the service for the requested token.
- key: TokenParameters
type: <dictionary>
presence: optional
content: Parameters that the system uses to generate the token.
subkeys:
- key: SecurityToken
title: Security Token
supportedOS:
iOS:
sharedipad:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: n/a
type: <string>
presence: optional
content: A security token to generate the server token. Required by the 'com.apple.watch.pairing'
service type.
- key: PhoneUDID
title: Phone Identifier
supportedOS:
iOS:
sharedipad:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: n/a
type: <string>
presence: optional
content: The identifier of the phone paired to the watch. Required by the 'com.apple.watch.pairing'
service type.
- key: WatchUDID
title: Watch Identifier
supportedOS:
iOS:
sharedipad:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: n/a
type: <string>
presence: optional
content: The identifier of the watch paired to the phone. Required by the 'com.apple.watch.pairing'
service type.
- key: UDID
supportedOS:
iOS:
userenrollment:
mode: forbidden
macOS:
userenrollment:
mode: forbidden
type: <string>
presence: required
content: The device's UDID.
- key: EnrollmentID
supportedOS:
iOS:
userenrollment:
mode: required
macOS:
userenrollment:
mode: required
type: <string>
presence: required
content: A per-enrollment identifier that identifies the device for user enrollments.
- key: EnrollmentUserID
supportedOS:
iOS:
introduced: n/a
macOS:
devicechannel: false
userenrollment:
mode: required
type: <string>
presence: required
content: A per-enrollment identifier that identifies the user for user enrollments.
- key: UserShortName
supportedOS:
iOS:
sharedipad:
mode: required
macOS:
devicechannel: false
type: <string>
presence: optional
content: On Shared iPad, this value returns the Managed Apple ID of the user. When
present, it indicates that the token is for the user channel. In macOS, this value
returns the short name of the user.
- key: UserID
supportedOS:
iOS:
sharedipad:
mode: required
macOS:
devicechannel: false
type: <string>
presence: optional
content: In macOS, this value returns the ID of the user. On Shared iPad, this value
is 'FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF' to indicate that no authentication occurs.
- key: UserLongName
supportedOS:
iOS:
introduced: n/a
macOS:
devicechannel: false
type: <string>
presence: required
content: The full name of the user.
responsekeys:
- key: TokenData
type: <data>
presence: required
content: The token represented as data. If the token is a string value, this will
be the UTF-8 encoded string data.
mdm/checkin/tokenupdate.yaml
+23 -3
View File
@@ -23,6 +23,9 @@ payload:
tvOS:
introduced: '10.2'
supervised: false
watchOS:
introduced: '10.0'
supervised: false
content: Check-in protocol token update request and response.
payloadkeys:
- key: NotOnConsole
@@ -32,9 +35,11 @@ payloadkeys:
macOS:
introduced: '10.11'
devicechannel: false
watchOS:
introduced: n/a
type: <boolean>
presence: required
content: If true, the device is not on console.
content: If 'true', the device is not on console.
- key: MessageType
type: <string>
presence: required
@@ -68,6 +73,8 @@ payloadkeys:
mode: required
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: required
content: The per-enrollment identifier for the device. Available in macOS 10.15
@@ -83,6 +90,8 @@ payloadkeys:
mode: required
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: required
content: The per-enrollment identifier for the user. Available in macOS 10.15 and
@@ -97,6 +106,8 @@ payloadkeys:
devicechannel: false
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: |-
@@ -112,6 +123,8 @@ payloadkeys:
devicechannel: false
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: |-
@@ -125,6 +138,8 @@ payloadkeys:
devicechannel: false
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: required
content: The full name of the user.
@@ -146,6 +161,8 @@ payloadkeys:
mode: forbidden
macOS:
introduced: n/a
watchOS:
accessrights: AllowPasscodeRemovalAndLock
type: <data>
presence: optional
content: The data that can be used to unlock the device. If provided, the server
@@ -157,8 +174,11 @@ payloadkeys:
macOS:
introduced: '10.11'
userchannel: false
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', the device is awaiting a Release Device from Await Configuration
MDM command before proceeding through Setup Assistant.
content: |-
If 'true' from the device channel, the device is awaiting a Release Device from Await Configuration MDM command before proceeding through Setup Assistant.
If 'true' from the user channel (Shared iPad only), the device is awaiting a UserConfiguredCommand MDM command before proceeding through Setup Assistant.
mdm/commands/account.configuration.yaml
+5 -5
View File
@@ -91,20 +91,20 @@ payloadkeys:
title: fullName
type: <string>
presence: optional
content: The full name of the user. This defaults to shortName if not specified.
content: The full name of the user, which defaults to 'shortName' if not specified.
- key: passwordHash
title: passwordHash
type: <data>
presence: optional
content: Contains the pre-created salted PBKDF2 SHA512 password hash for the
account.
content: Data that contains the pre-created salted PBKDF2 SHA512 password hash
for the account.
- key: hidden
title: hidden
type: <boolean>
presence: optional
default: false
content: If true, this sets the account attribute to make the account hidden
to loginwindow and Users&Groups. OD attribute dsAttrTypeNative:IsHidden.
content: If 'true', this sets the account attribute to make the account hidden
in the login window and Users & Groups.
- key: ManagedLocalUserShortName
supportedOS:
macOS:
mdm/commands/application.install.enterprise.yaml
+2 -2
View File
@@ -59,8 +59,8 @@ payloadkeys:
presence: optional
default: false
content: |-
If 'true', install the app as a managed app. For manifest-based installation, if this value is 'true', but the package doesn't meet the criteria for management, the installation fails. Reinstall a managed app with this value set to 'false' to change the app to an unmanaged app.
To satisfy the criteria for management, the pkg must contain a single, signed application installed into '/Applications'.
If 'true', install the app as a managed app.
For manifest-based installs, if 'true' the system considers only the .app bundles installed into '/Applications' as managed (macOS 11 through 13 required the pkg to contain a single .app bundle). Reinstalling a managed app without this flag causes it to become unmanaged.
This value is available in macOS 11 and later.
- key: ManagementFlags
supportedOS:
mdm/commands/application.install.yaml
+79 -21
View File
@@ -33,6 +33,10 @@ payload:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowAppInstallation
supervised: false
content: This command allows the server to install an application on a device. If
the app is already being managed, this command will update the app. macOS change
- 10.9 user channel for VPP, 10.10 device channel, 10.11 both.
@@ -120,28 +124,46 @@ payloadkeys:
to provide it. This value is available in iOS 7 and later, and tvOS 10.2 and later.
subkeys:
- key: VPNUUID
supportedOS:
tvOS:
introduced: n/a
type: <string>
presence: optional
content: A per-app VPN unique identifier for this app. This value is available
in iOS 7 and later, and tvOS 10.2 and later.
content: A per-app VPN unique identifier for this app. Available in iOS 7 and
later.
- key: ContentFilterUUID
supportedOS:
iOS:
introduced: '16.0'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: Content Filter UUID assigned to this app.
content: The content filter UUID for this app. Available in iOS 16 and later.
- key: DNSProxyUUID
supportedOS:
iOS:
introduced: '16.0'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: DNS Proxy UUID assigned to this app.
content: The DNS proxy UUID for this app. Available in iOS 16 and later.
- key: RelayUUID
supportedOS:
iOS:
introduced: '17.0'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The relay UUID for this app. Available in iOS 17 and later.
- key: AssociatedDomains
supportedOS:
iOS:
@@ -150,8 +172,8 @@ payloadkeys:
introduced: n/a
type: <array>
presence: optional
content: An array that contains the associated domains to add to this app. This
value is available in iOS 13 and later.
content: An array that contains the associated domains to add to this app. Available
in iOS 13 and later.
subkeys:
- key: AssociatedDomain
type: <string>
@@ -166,7 +188,7 @@ payloadkeys:
default: false
content: If 'true', perform claimed site association verification directly at
the domain instead of on Apple's servers. Only set this to 'true' for domains
that can't access the internet. This value is available in iOS 14 and later.
that can't access the internet. Available in iOS 14 and later.
- key: Removable
supportedOS:
iOS:
@@ -176,23 +198,35 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: If 'false', this app isn't removable while it's a managed app. This value
is available in iOS 14 and later, and tvOS 14 and later.
content: If 'false', this app isn't removable while it's a managed app. Available
in iOS 14 and later, and tvOS 14 and later.
- key: TapToPayScreenLock
supportedOS:
iOS:
introduced: '16.4'
macOS:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: Enabling this setting will require Tap to Pay on iPhone users to use
Face ID or a passcode to unlock their device after every transaction that requires
a customer’s card PIN. Disabling this setting will allow users to configure
this setting on their device based on personal preference.
content: |-
If 'true', Tap to Pay on iPhone requires users to use Face ID or a passcode to unlock their device after every transaction that requires a customer's card PIN. If 'false', the user can configure this setting on their device.
Available in iOS 16.4 and later.
- key: CellularSliceUUID
supportedOS:
iOS:
introduced: '17.0'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: |-
The data network name (DNN) or app category. For DNN, the value is 'DNN:name', where 'name' is the carrier provided DNN name. For app category, the value is 'AppCategory:category', where 'category' is a carrier provided string like “Enterprise1”.
Available in iOS 17 and later.
- key: ChangeManagementState
supportedOS:
iOS:
@@ -210,7 +244,7 @@ payloadkeys:
content: |-
The change management state. The only supported state is:
* 'Managed': Take management of the app if the user installed it already. This also requires that you pass 'true' for 'InstallAsManaged'.
This value doesn't work with the User Enrollment feature introduced in iOS 13.
This value doesn't work with Profile Based User Enrollment, Account Driven User Enrollment and Account Driven Device Enrollment.
Available in iOS 9 and later, macOS 11 and later, and tvOS 10.2 and later.
- key: InstallAsManaged
supportedOS:
@@ -222,14 +256,16 @@ payloadkeys:
mode: forbidden
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', install the app as a managed app. For manifest-based installation,
if this value is 'true', but the package doesn't meet the criteria for management,
the installation fails. Reinstall a managed app with this value set to 'false'
to change the app to an unmanaged app. This value is available in macOS 11 and
later.
content: |-
If 'true', install the app as a managed app.
For manifest-based installs, if this value is 'true', the system only considers the '.app' bundles installed into '/Applications 'as managed (macOS 11 through 13 required the 'pkg' to contain a single '.app' bundle).
Reinstall a managed app with this value set to 'false' to change the app to an unmanaged app.
This value is available in macOS 11 and later.
- key: iOSApp
supportedOS:
iOS:
@@ -238,6 +274,8 @@ payloadkeys:
introduced: '11.0'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
@@ -251,6 +289,26 @@ responsekeys:
- key: State
type: <string>
presence: optional
rangelist:
- Queued
- NeedsRedemption
- Redeeming
- Prompting
- PromptingForLogin
- ValidatingPurchase
- Installing
- Managed
- ManagedButUninstalled
- UserInstalledApp
- UserRejectedFailed
- PromptingForUpdate
- PromptingForUpdateLogin
- ValidatingUpdate
- Updating
- UpdateRejected
- PromptingForManagement
- ManagementRejected
- Unknown
content: The app's installation state, if the user accepted the request. If this
value is 'NeedsRedemption', the server must send a redemption code to complete
the app installation.
mdm/commands/application.installed.list.yaml
+6
View File
@@ -26,6 +26,10 @@ payload:
introduced: '10.2'
accessrights: AllowQueryApplications
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowQueryApplications
supervised: false
content: This command allows the server to query for installed 3rd party applications.
payloadkeys:
- key: Identifiers
@@ -254,6 +258,8 @@ responsekeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
mdm/commands/application.invitetoprogram.yaml
+2 -1
View File
@@ -25,7 +25,8 @@ payload:
content: This command allows a server to invite a user to join a program. This command
issues the invitation, but does not allow the server to monitor whether the user
has joined the program. This command is supported in the user channel. This command
will yield a NotNow status until the user exits Setup Assistant.
will yield a NotNow status until the user exits Setup Assistant. This command
does not work with Account Driven Device Enrollment.
payloadkeys:
- key: ProgramID
type: <string>
mdm/commands/application.managed.list.yaml
+5 -1
View File
@@ -28,6 +28,10 @@ payload:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowAppInstallation
supervised: false
content: This command allows the server to query the status of managed apps. Certain
statuses are transient. Once they are reported to the server, the entries for
the apps are removed from the next query. macOS supports this command on the user
@@ -50,7 +54,7 @@ responsekeys:
content: A dictionary that contains status information about each managed app.
subkeytype: ManagedApplicationListItem
subkeys:
- key: <app identifier>
- key: ANY app identifier
type: <dictionary>
presence: required
content: The bundle identifier of the managed app.
mdm/commands/application.remove.yaml
+4
View File
@@ -25,6 +25,10 @@ payload:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowAppInstallation
supervised: false
content: This command allows a server to remove a managed app.
payloadkeys:
- key: Identifier
mdm/commands/certificate.list.yaml
+4
View File
@@ -32,6 +32,10 @@ payload:
introduced: '6.0'
accessrights: AllowInspection
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowInspection
supervised: false
content: |-
This command allows the server to retrieve the list of installed certificates on the device. The command requires that the server has the Inspect Profile Manifest privilege.
For userenrollment, this request will limit to certificates pushed via MDM.
mdm/commands/declarativemanagement.yaml
+3
View File
@@ -27,6 +27,9 @@ payload:
introduced: '16.0'
supervised: false
requiresdep: false
watchOS:
introduced: '10.0'
supervised: false
content: This command allows the server to turn on the Declarative Management engine
on the device (the first time it is used), or to trigger a Declarative Management
synchronization operation.
mdm/commands/device.activationlock.bypasscode.yaml
+1 -1
View File
@@ -1,5 +1,5 @@
title: Activation Lock Bypass Code Command
description: Retrievies the Activation Lock bypass code from the device.
description: Retrieves the Activation Lock bypass code from the device.
payload:
requesttype: ActivationLockBypassCode
supportedOS:
mdm/commands/device.erase.yaml
+42
View File
@@ -27,6 +27,10 @@ payload:
introduced: '10.2'
accessrights: AllowDeviceErase
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowDeviceErase
supervised: false
content: This command allows the server to remotely erase the device. This command
requires the Device Erase right.
payloadkeys:
@@ -53,6 +57,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
@@ -67,6 +73,8 @@ payloadkeys:
introduced: '10.8'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The six-character PIN for Find My. This value is available in macOS 10.8
@@ -79,6 +87,8 @@ payloadkeys:
introduced: '12.0'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
rangelist:
@@ -106,3 +116,35 @@ payloadkeys:
'Default':
If EACS preflight fails, the device responds to the server with an 'Error' status and then attempts to erase itself.
If EACS preflight succeeds but EACS fails, then the device attempts to erase itself.
- key: ReturnToService
supportedOS:
iOS:
introduced: '17.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: The configuration settings for Return to Service. This value is available
in iOS 17 and later.
subkeys:
- key: Enabled
title: Use Return to Service
type: <boolean>
presence: required
content: If 'true', the device tries to re-enroll itself automatically after erasure.
The user needs to deactivate all activation locks for this feature to work correctly.
- key: WiFiProfileData
type: <data>
presence: optional
content: The WiFi profile that installed after erasure, when using Return to Service.
This is required when the device doesn't have ethernet access.
- key: MDMProfileData
type: <data>
presence: optional
content: |-
The MDM profile installed after erasure, when using Return to Service. This key is required for all unsupervised devices, as well as supervised devices that weren't enrolled with ADE. If provided, the device uses this profile directly instead of fetching it from the server. For ADE enrolled devices, this key isn't necessary unless the cloud configuration profile of the device contains the 'configuration-web-url' key.
The cloud configuration is still downloaded from Apple's servers when the profile contains this key, so the supervision identity, MDM removability and other settings from the cloud configuration still applies. However, the device doesn't use the URL specified in the cloud configuration to fetch the MDM profile.
mdm/commands/device.lock.yaml
+6
View File
@@ -23,6 +23,10 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
watchOS:
introduced: '10.0'
accessrights: AllowPasscodeRemovalAndLock
supervised: false
content: This command allows the server to immediately lock the device. This command
requires the Device Lock and Passcode Removal right.
payloadkeys:
@@ -58,6 +62,8 @@ payloadkeys:
introduced: n/a
macOS:
introduced: '10.8'
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The six-character PIN for Find My. This value is available in macOS 10.8
mdm/commands/device.restrictions.list.yaml
+4
View File
@@ -20,6 +20,10 @@ payload:
introduced: '6.1'
accessrights: AllowQueryRestrictions
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowQueryRestrictions
supervised: false
content: This command allows the server to determine what restrictions are being
enforced on the device, and the total sum of all restrictions. This command requires
the Restrictions Query access right. This technically does work on macOS but it
mdm/commands/information.contentcaching.yaml
+3 -2
View File
@@ -43,11 +43,12 @@ responsekeys:
The error conditions the content cache detected in the 'PeerFilterRanges' in the installed 'com.apple.AssetCache.managed' payload.
To display these alerts on the device, set 'DisplayAlerts' to 'true' in the installed ContentCaching profile.
subkeys:
- key: Index into the PeerFilterRanges in the installed com.apple.AssetCache.managed
payload
- key: ANY index
type: <dictionary>
presence: required
content: A dictionary that describes the alerts for the peer filter ranges.
The key name is the index into the PeerFilterRanges array in the installed
com.apple.AssetCache.managed payload.
subkeys:
- key: className
type: <string>
mdm/commands/information.device.yaml
+508 -122
View File
File diff suppressed because it is too large Load Diff
mdm/commands/information.security.yaml
+57 -4
View File
@@ -27,6 +27,10 @@ payload:
introduced: '6.0'
accessrights: AllowQuerySecurity
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowQuerySecurity
supervised: false
content: This command queries the device for security-related information. Queries
are available if the MDM host has the Security Query right.
responsekeys:
@@ -80,8 +84,6 @@ responsekeys:
supportedOS:
iOS:
introduced: 9.3.2
sharedipad:
mode: required
userenrollment:
mode: forbidden
macOS:
@@ -94,8 +96,6 @@ responsekeys:
supportedOS:
iOS:
introduced: 9.3.2
sharedipad:
mode: required
userenrollment:
mode: forbidden
macOS:
@@ -105,6 +105,23 @@ responsekeys:
the device passcode to unlock it. If a device has a passcode, changing 'PasscodeLockGracePeriod'
to a larger value doesn't take effect until the user logs out or removes the
passcode. This value is only available for Shared iPad.
- key: AutoLockTime
supportedOS:
iOS:
introduced: '17.0'
sharedipad:
mode: required
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <integer>
content: The number of seconds before a device goes to sleep after being idle.
This value is only available for Shared iPad.
- key: FDE_Enabled
supportedOS:
iOS:
@@ -114,6 +131,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If 'true', the device has enabled FileVault full disk encryption (FDE).
This value is available in macOS 10.9 and later.
@@ -128,6 +147,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If 'true', FileVault FDE has a personal recovery key. This value is available
in macOS 10.9 and later.
@@ -142,6 +163,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If 'true', FileVault FDE has an institutional recovery key. This value
is available in macOS 10.9 and later.
@@ -156,6 +179,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <data>
content: If the FileVault personal recovery key has enabled escrow with a recovery
key, this value contains the key. The certificate from the FDERecoveryKeyEscrow
@@ -172,6 +197,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: If the FileVault personal recovery key has enabled escrow with a recovery
key, this value is the device serial number. This is the value that displays
@@ -189,6 +216,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If 'true', System Integrity Protection (SIP) is active on the device.
This value is available in macOS 10.12 and later.
@@ -201,6 +230,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
content: A dictionary that contains the firewall settings. This value is available
in macOS 10.12 and later.
@@ -260,6 +291,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
content: A dictionary that contains the status of the EFI firmware password. This
value is available in macOS 10.13 and later.
@@ -292,6 +325,8 @@ responsekeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If 'true', the device enrolled in MDM through the Device Enrollment
Program (DEP). This value is available in macOS 10.13.2 and later.
@@ -301,6 +336,8 @@ responsekeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If 'true', the enrollment was user-approved. If 'false', the device
may reject certain security-sensitive payloads or commands. This value is
@@ -320,6 +357,8 @@ responsekeys:
introduced: '10.15'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If 'true', the type of enrollment allows the MDM to manage Activation
Lock for this device. This value is available in macOS 10.15 and later.
@@ -332,6 +371,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
content: A dictionary that contains the device's Secure Boot settings. This value
is available in macOS 10.15 and later.
@@ -386,6 +427,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If 'true', Remote Desktop is active on the device. This value is available
in macOS 10.14.4 and later.
@@ -398,6 +441,8 @@ responsekeys:
userchannel: false
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If 'true', the system booted using an Authenticated Root Volume. This
value is available in macOS 11 and later.
@@ -412,6 +457,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
rangelist:
- allowed
@@ -431,6 +478,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: |-
If 'true', the device can accept a Bootstrap Token from the MDM server instead of prompting for user authentication prior to installation. This only applies when 'BootstrapTokenAllowedForAuthentication' is 'true' in the SecurityInfoResponse.SecurityInfo response.
@@ -446,6 +495,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: |-
If 'true', the device can accept a Bootstrap Token from the MDM server instead of prompting for user authentication prior to enabling kernel extensions. This includes enabling kexts through the 'com.apple.syspolicy.kernel-extension-policy' payload or triggering the 'RestartDevice' command with 'RebuildKernelCache' set to 'true'. This only applies when 'BootstrapTokenAllowedForAuthentication' is 'true' in the SecurityInfoResponse.SecurityInfo response.
@@ -461,6 +512,8 @@ responsekeys:
mode: forbidden
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If 'true', a password is required to enter recovery (see SetRecoveryLockCommand).
Available in macOS 11.5 and later and only on Apple silicon devices.
mdm/commands/managed.application.attributes.yaml
+52
View File
@@ -19,6 +19,10 @@ payload:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowAppInstallation
supervised: false
content: Queries managed application attributes. Attributes can be set on managed
apps. These attributes can be changed over time.
payloadkeys:
@@ -48,6 +52,9 @@ responsekeys:
content: The app's attributes.
subkeys:
- key: VPNUUID
supportedOS:
tvOS:
introduced: n/a
type: <string>
presence: optional
content: A per-app VPN unique identifier for this app.
@@ -57,6 +64,8 @@ responsekeys:
introduced: '16.0'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: |-
@@ -68,11 +77,24 @@ responsekeys:
introduced: '16.0'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: |-
The DNS Proxy UUID assigned to this app.
Available in iOS 16 and later.
- key: RelayUUID
supportedOS:
iOS:
introduced: '17.0'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The relay UUID for this app.
- key: AssociatedDomains
supportedOS:
iOS:
@@ -110,3 +132,33 @@ responsekeys:
default: true
content: If 'false', this app isn't removable while it's a managed app. This
value is available in iOS 14 and later.
- key: TapToPayScreenLock
supportedOS:
iOS:
introduced: '16.4'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: Enabling this setting will require Tap to Pay on iPhone users to
use Face ID or a passcode to unlock their device after every transaction
that requires a customer’s card PIN. Disabling this setting will allow users
to configure this setting on their device based on personal preference.
- key: CellularSliceUUID
supportedOS:
iOS:
introduced: '17.0'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: Either data network name (DNN) or traffic category can be set as
the enterprise slice identifier. For DNN, the value must be encoded as "DNN:name”,
where "name" is the carrier provided DNN name. For app category, the value
must be encoded as "AppCategory:category", where "category" is a carrier
provided string like "Enterprise1".
mdm/commands/managed.application.configuration.yaml
+4
View File
@@ -30,6 +30,10 @@ payload:
introduced: '10.2'
accessrights: AllowAppInstallation
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowAppInstallation
supervised: false
content: This command queries the device for the current configuration of managed
applications. This command requires the App Management right.
payloadkeys:
mdm/commands/passcode.clear.yaml
+4
View File
@@ -13,6 +13,10 @@ payload:
mode: forbidden
userenrollment:
mode: forbidden
watchOS:
introduced: '10.0'
accessrights: AllowPasscodeRemovalAndLock
supervised: false
content: This command allows the server to clear the passcode on the device. This
command requires the Device Lock and Passcode Removal right.
payloadkeys:
mdm/commands/passcode.firmware.set.yaml
+8 -3
View File
@@ -31,7 +31,12 @@ payloadkeys:
default: false
content: If 'true', enable ROMs.
responsekeys:
- key: PasswordChanged
type: <boolean>
- key: SetFirmwarePassword
type: <dictionary>
presence: required
content: If 'true', the password change succeeded.
content: Command result.
subkeys:
- key: PasswordChanged
type: <boolean>
presence: required
content: If 'true', the password change succeeded.
mdm/commands/passcode.firmware.verify.yaml
+9 -3
View File
@@ -19,7 +19,13 @@ payloadkeys:
presence: required
content: The password to verify.
responsekeys:
- key: PasswordVerified
type: <boolean>
- key: VerifyFirmwarePassword
type: <dictionary>
presence: required
content: If 'true', the provided password matches the firmware password on the device.
content: Command result.
subkeys:
- key: PasswordVerified
type: <boolean>
presence: required
content: If 'true', the provided password matched the firmware password set for
the device.
mdm/commands/passcode.recovery.set.yaml
+1 -1
View File
@@ -11,7 +11,7 @@ payload:
requiresdep: false
userenrollment:
mode: forbidden
content: Sets or clears the recovery lock password (AppleSilicon devices only).
content: Sets or clears the recovery lock password (Apple Silicon devices only).
Requires the "Device lock and passcode removal right".
payloadkeys:
- key: CurrentPassword
mdm/commands/profile.install.yaml
+4
View File
@@ -29,6 +29,10 @@ payload:
introduced: '6.0'
accessrights: AllowInstallationRemoval
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowInstallationRemoval
supervised: false
content: This command allows the host to install a configuration profile. The profile
may be encrypted using any installed identity certificate. The profile may also
be signed. This command requires the Profile Installation and Removal right. It's
mdm/commands/profile.list.yaml
+21 -8
View File
@@ -28,6 +28,10 @@ payload:
introduced: '6.0'
accessrights: AllowInspection
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowInspection
supervised: false
content: This command allows the MDM server to query for the profiles installed
on the device. This command requires the Inspect Profile Manifest right. It's
supported on the user channel.
@@ -129,26 +133,35 @@ responsekeys:
- key: PayloadType
type: <string>
presence: required
content: The type of payload for the profile. The only supported value is
'Configuration'.
content: The payload type, which each payload domain’s reference page specifies.
- key: PayloadVersion
type: <integer>
presence: required
content: The version of the configuration profile as a whole, not of the
individual profiles within it. The value should be '1'.
content: The version of the configuration payload. The value should be '1'.
- key: PayloadIdentifier
type: <string>
presence: required
content: The reverse-DNS-style identifier of the profile; for example, 'com.example.myprofile'.
content: The reverse-DNS-style identifier of the payload; for example, 'com.example.myprofile.payload1'.
- key: PayloadUUID
supportedOS:
iOS:
introduced: '17.0'
macOS:
introduced: '14.0'
tvOS:
introduced: '17.0'
type: <string>
presence: required
content: The unique identifier for the profile.
- key: PayloadDisplayName
type: <string>
presence: optional
content: The human-readable name of the profile.
content: The human-readable name of the payload.
- key: PayloadDescription
type: <string>
presence: optional
content: The description of the profile.
content: The description of the payload.
- key: PayloadOrganization
type: <string>
presence: optional
content: The human-readable name of the organization that provided the profile.
content: The human-readable name of the organization that provided the payload.
mdm/commands/profile.provisioning.install.yaml
+4
View File
@@ -29,6 +29,10 @@ payload:
introduced: '10.2'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
content: This command allows the server to install a provisioning profile. No error
occurs if the provisioning profile is already installed. This command requires
the Provisioning Profile Installation and Removal right. On macOS, this command
mdm/commands/profile.provisioning.list.yaml
+4
View File
@@ -29,6 +29,10 @@ payload:
introduced: '10.2'
accessrights: AllowProvisioningInspection
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowProvisioningInspection
supervised: false
content: This command allows the server to retrieve the list of installed provisioning
profiles on the device. This command requires the Inspect Provisioning Profiles
right. On macOS, this command is for iOS and iPadOS style provisioning profiles
mdm/commands/profile.provisioning.remove.yaml
+4
View File
@@ -28,6 +28,10 @@ payload:
introduced: '10.2'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowProvisioningInstallationRemoval
supervised: false
content: This command allows the server to remove a provisioning profile. This command
requires the Provisioning Profile Installation and Removal right. On macOS, this
command is for iOS and iPadOS style provisioning profiles only.
mdm/commands/profile.remove.yaml
+4
View File
@@ -27,6 +27,10 @@ payload:
introduced: '6.0'
accessrights: AllowInstallationRemoval
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowInstallationRemoval
supervised: false
content: This command allows the server to remove a profile. This command requires
the Profile Installation and Removal Right. It's supported in the user channel.
payloadkeys:
mdm/commands/settings.yaml
+179 -30
View File
@@ -26,6 +26,10 @@ payload:
introduced: '6.0'
accessrights: AllowSettings
supervised: false
watchOS:
introduced: '10.0'
accessrights: AllowSettings
supervised: false
content: This command allows the server to set settings on the device. These settings
take effect on a one-time basis. The user may still be able to change the settings
at a later time. This command requires the ApplySettings right.
@@ -50,6 +54,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains wallpaper settings. This setting doesn't support
@@ -90,6 +96,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains data roaming settings. This setting requires
@@ -121,6 +129,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains voice roaming settings. This setting requires
@@ -153,6 +163,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains Personal Hotspot settings. This setting requires
@@ -186,6 +198,8 @@ payloadkeys:
mode: forbidden
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains Bluetooth settings. This setting requires
@@ -220,6 +234,8 @@ payloadkeys:
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
watchOS:
accessrights: AllowAppInstallation
type: <dictionary>
presence: optional
content: A dictionary that contains the configurations to apply to the app. Omit
@@ -261,6 +277,8 @@ payloadkeys:
tvOS:
introduced: '10.2'
accessrights: AllowAppInstallation
watchOS:
accessrights: AllowAppInstallation
type: <dictionary>
presence: optional
content: A dictionary that contains the attributes to apply to the app. Omit this
@@ -285,28 +303,46 @@ payloadkeys:
7 and later, and tvOS 10.2 and later.
subkeys:
- key: VPNUUID
supportedOS:
tvOS:
introduced: n/a
type: <string>
presence: optional
content: A per-app VPN unique identifier for this app. This value is available
in iOS 7 and later, and tvOS 10.2 and later.
content: A per-app VPN unique identifier for this app. Available in iOS 7
and later.
- key: ContentFilterUUID
supportedOS:
iOS:
introduced: '16.0'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: Content Filter UUID assigned to this app.
content: The content filter UUID for this app. Available in iOS 16 and later.
- key: DNSProxyUUID
supportedOS:
iOS:
introduced: '16.0'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: DNS Proxy UUID assigned to this app.
content: The DNS proxy UUID for this app. Available in iOS 16 and later.
- key: RelayUUID
supportedOS:
iOS:
introduced: '17.0'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The relay UUID for this app. Available in iOS 17 and later.
- key: AssociatedDomains
supportedOS:
iOS:
@@ -316,7 +352,7 @@ payloadkeys:
type: <array>
presence: optional
content: An array that contains the associated domains to add to this app.
This setting is available in iOS 7 and later, and tvOS 10.2 and later.
Available in iOS 7 and later.
subkeys:
- key: AssociatedDomain
type: <string>
@@ -331,8 +367,7 @@ payloadkeys:
default: false
content: If 'true', perform claimed site association verification directly
at the domain, instead of on Apple's servers. Only set this to 'true' for
domains that can't access the internet. This value is available in iOS 14
and later.
domains that can't access the internet. Available in iOS 14 and later.
- key: Removable
supportedOS:
iOS:
@@ -342,23 +377,35 @@ payloadkeys:
type: <boolean>
presence: optional
default: true
content: If 'false', this app isn't removable while it's managed. This value
is available in iOS 14 and later, and tvOS 14 and later.
content: If 'false', this app isn't removable while it's managed. Available
in iOS 14 and later, and tvOS 14 and later.
- key: TapToPayScreenLock
supportedOS:
iOS:
introduced: '16.4'
macOS:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: Enabling this setting will require Tap to Pay on iPhone users to
use Face ID or a passcode to unlock their device after every transaction
that requires a customer’s card PIN. Disabling this setting will allow users
to configure this setting on their device based on personal preference.
content: |-
If true, the system require Tap to Pay on iPhone users to use Face ID or a passcode to unlock their device after every transaction that requires a customer's card PIN. If 'false', the user can configure this setting on their device.
Available in iOS 16.4 and later.
- key: CellularSliceUUID
supportedOS:
iOS:
introduced: '17.0'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: |-
The data network name (DNN) or app category. For DNN, the value is 'DNN:name', where 'name' is the carrier provided DNN name. For app category, the value is 'AppCategory:category', where 'category' is a carrier provided string like “Enterprise1”'.'
Available in iOS 17 and later.
- key: DeviceName
supportedOS:
iOS:
@@ -373,6 +420,8 @@ payloadkeys:
introduced: '10.10'
userenrollment:
mode: forbidden
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains device name settings. This setting doesn't
@@ -399,6 +448,8 @@ payloadkeys:
mode: forbidden
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains hostname settings. This setting doesn't support
@@ -492,6 +543,8 @@ payloadkeys:
mode: forbidden
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains settings related to the MDM protocol. This
@@ -565,6 +618,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains settings for maximum resident users. Apple
@@ -599,6 +654,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains shared device configuration settings. This
@@ -680,9 +737,65 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: Whether the language & locale pane will be skipped for new users of
Shared iPad. If 'true', system language & locale will be picked automatically
for the new user.
content: |-
If 'true', the system picks the system language and locale automatically for the new Shared iPad user.
Available in iOS 16.2 and later.
- key: AwaitUserConfiguration
supportedOS:
iOS:
introduced: '17.0'
type: <dictionary>
presence: optional
content: |-
If enabled, the Shared iPad device enters Setup Assistant after the user triggers a login. The MDM server has a chance to configure the device and user. After configuration, a UserConfiguredCommand needs be sent to the user channel to unblock the login. This feature requires the device to have network access during the login process.
Available in iOS 17 and later.
subkeys:
- key: Enabled
type: <boolean>
presence: required
content: If 'true', the device stops at a Setup Assistant pane after user
login. The user won't be able to use the device until a UserConfiguredCommand
command is received.
- key: PasscodePolicy
supportedOS:
iOS:
introduced: '17.0'
type: <dictionary>
presence: optional
content: A dictionary that contains passcode related policies.
subkeys:
- key: PasscodeLockGracePeriod
type: <integer>
presence: optional
rangelist:
- 0
- 60
- 300
- 900
- 3600
- 14400
content: Sets the user preference for the amount of time (in seconds) the
screen must be locked before unlock attempts will require the device passcode.
This should ideally be set when no passcode is set on device. If a passcode
is on device, only more restrictive values than the currently enforced passcode
lock grace period will take effect; any changes to a less restrictive value
will not take effect until the user logs out. This setting will not take
effect if TemporarySessionOnly is set to true (since there is no passcode
for the temporary session). This setting can only be applied on Shared iPads.
devpubs-override: The number of seconds before a locked screen requires the
user to enter the device passcode to unlock it. The minimum value is '0'
seconds and the maximum value is '14400' seconds. If a device has a passcode,
a change to a larger value doesn't take effect until the user logs out or
removes the passcode. For this reason, it's better to set this value before
the user sets a passcode. If the value set is less than one of the known
values the next lowest value will be used. For example a value of 299 will
result in an effective setting of 60.
- key: AutoLockTime
type: <integer>
presence: optional
content: Sets the user preference for the amount of time (in seconds) before
a device goes to sleep after being idle. The mininum value for this setting
is 120 seconds. This setting can only be applied on Shared iPad.
- key: DiagnosticSubmission
supportedOS:
iOS:
@@ -697,6 +810,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains diagnostic submission settings. This setting
@@ -728,6 +843,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains settings for sharing app analytics. This setting
@@ -749,6 +866,7 @@ payloadkeys:
supportedOS:
iOS:
introduced: 9.3.2
deprecated: '17.0'
sharedipad:
mode: required
devicechannel: true
@@ -759,6 +877,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains password lock grace period settings. This
@@ -774,9 +894,21 @@ payloadkeys:
- key: PasscodeLockGracePeriod
type: <integer>
presence: required
content: |-
The number of seconds before a locked screen requires the user to enter the device passcode to unlock it. The minimum value is '0' seconds and the maximum value is '14400' seconds.
If a device has a passcode, a change to a larger value doesn't take effect until the user logs out or removes the passcode. For this reason, it's better to set this value before the user sets a passcode.
rangelist:
- 0
- 60
- 300
- 900
- 3600
- 14400
content: The number of seconds before a locked screen requires the user to enter
the device passcode to unlock it. The minimum value is '0' seconds and the
maximum value is '14400' seconds. If a device has a passcode, a change to
a larger value doesn't take effect until the user logs out or removes the
passcode. For this reason, it's better to set this value before the user sets
a passcode. If the value set is less than one of the known values the next
lowest value will be used. For example a value of 299 will result in an effective
setting of 60.
- key: TimeZone
supportedOS:
iOS:
@@ -793,6 +925,8 @@ payloadkeys:
tvOS:
introduced: '14.0'
supervised: true
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains time zone settings. This setting is only available
@@ -826,6 +960,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
presence: optional
content: A dictionary that contains software update settings. This setting doesn't
@@ -866,6 +1002,8 @@ payloadkeys:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
supervised: true
type: <dictionary>
presence: optional
content: A dictionary that contains accessibility settings. Available in iOS 16
@@ -882,22 +1020,25 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', enables bold text.
content: If 'true', the system enables bold text.
- key: IncreaseContrastEnabled
supportedOS:
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', enables increase contrast.
content: If 'true', the system enables increase contrast.
- key: ReduceMotionEnabled
type: <boolean>
presence: optional
default: false
content: If 'true', enables reduced motion.
content: If 'true', the system enables reduced motion.
- key: ReduceTransparencyEnabled
type: <boolean>
presence: optional
default: false
content: If 'true', enables reduced transparency.
content: If 'true', the system enables reduced transparency.
- key: TextSize
type: <integer>
presence: optional
@@ -915,23 +1056,31 @@ payloadkeys:
- 10
- 11
default: 4
content: The accessibility text size apps that support dynamic text use. 0 is
the smallest value, and 11 is the largest available.
content: The accessibility text size apps that support dynamic text use. '0'
is the smallest value, and '11' is the largest available.
- key: TouchAccommodationsEnabled
type: <boolean>
presence: optional
default: false
content: If true, enables touch accommodations.
content: If 'true', the system enables touch accommodations.
- key: VoiceOverEnabled
type: <boolean>
presence: optional
default: false
content: If true, enables voiceover.
content: If 'true', the system enables voiceover.
- key: ZoomEnabled
type: <boolean>
presence: optional
default: false
content: If true, enables zoom.
content: If 'true', the system enables zoom.
- key: GrayscaleEnabled
supportedOS:
iOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If 'true', the system enables grayscale display.
responsekeys:
- key: Settings
type: <dictionary>
mdm/commands/system.update.available.yaml
+5 -5
View File
@@ -206,7 +206,7 @@ responsekeys:
introduced: '16.2'
type: <boolean>
presence: required
content: If true, this update is a Rapid Security Response.
content: If 'true', this update is a Rapid Security Response.
- key: SupplementalBuildVersion
supportedOS:
iOS:
@@ -217,8 +217,8 @@ responsekeys:
introduced: '16.2'
type: <string>
presence: optional
content: The build version associated with the Rapid Security Response update,
e.g. 13A999. This is always the same as 'build'.
content: The build version for the Rapid Security Response update, for example,
'13A999', which is the same as 'Build'.
- key: SupplementalOSVersionExtra
supportedOS:
iOS:
@@ -229,5 +229,5 @@ responsekeys:
introduced: '16.2'
type: <string>
presence: optional
content: The Rapid Security Response OS version suffix, e.g. '(a)'. Only present
if this is a Rapid Security Response update.
content: The Rapid Security Response OS version suffix, for example, '(a)'.
Only present if this is a Rapid Security Response update.
mdm/commands/system.update.status.yaml
+2
View File
@@ -35,6 +35,8 @@ responsekeys:
type: <array>
presence: required
content: An array of dictionaries that describes the statuses of software updates.
If an activated declaration of configuration.softwareupdate.enforcement.specific
is present on a Mac, OSUpdateStatus will only return non OS update statuses.
subkeys:
- key: OSUpdateStatusItem
type: <dictionary>
mdm/commands/user.configured.yaml
+20
View File
@@ -0,0 +1,20 @@
title: User Configured Command
description: Informs the device that it can continue past Setup Assistant and finish
login. Only works on Shared iPads that have the AwaitUserConfiguration feature enabled.
payload:
requesttype: UserConfigured
supportedOS:
iOS:
introduced: '17.0'
accessrights: None
supervised: true
requiresdep: true
sharedipad:
mode: allowed
devicechannel: false
userchannel: true
userenrollment:
mode: forbidden
content: Informs the device that it can continue past Setup Assistant and finish
login. Only works on Shared iPads that have the AwaitUserConfiguration feature
enabled.
mdm/errors/softwareupdate.required.yaml
+55
View File
@@ -0,0 +1,55 @@
title: Error Code Software Update Required
description: Error response for software update required.
payload:
supportedOS:
iOS:
introduced: '17.0'
macOS:
introduced: '14.0'
tvOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
The schema for a JSON or property list XML document returned in an MDM server's 403 response body. The response headers
must include a "Content-Type" header indicating whether JSON or XML is being returned.
This response is returned when a device is enrolling with an MDM server during Setup Assistant, and the MDM server
requires the device to perform a software update before enrollment is allowed and setup can proceed.
payloadkeys:
- key: code
type: <string>
presence: required
rangelist:
- com.apple.softwareupdate.required
content: Indicates that a software update is required before enrollment and setup
can proceed.
- key: description
type: <string>
presence: optional
content: The description of the error. This will only be used by the client for
logging purposes and will not be displayed to the user.
- key: message
type: <string>
presence: optional
content: A description of the error suitable for displaying to the user. If needed,
the client will make a best-effort attempt to display the message, but may not
be able to, due to local conditions.
- key: details
type: <dictionary>
presence: required
content: A dictionary of additional data specific to the error code.
subkeys:
- key: OSVersion
type: <string>
presence: required
content: The OS version that the device is required to update to (e.g., "16.1").
A supplemental version identifier can be included (e.g., "16.1 (a)").
- key: BuildVersion
type: <string>
presence: optional
content: The build version that the device is required to update to (e.g., "20A242).
The build version is used for testing during seeding periods. A supplemental
version identifier can be included (e.g., "20A242a"). If the build version is
not consistent with the OS version specified in the 'OSVersion' key, the OS
version will take precedence.
mdm/errors/watch.pairing.token.missing.yaml
+48
View File
@@ -0,0 +1,48 @@
title: Error Code Pairing Token Missing
description: Error response for missing pairing token.
payload:
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: '10.0'
content: |-
The schema for a JSON or property list XML document returned in an MDM server's 403 response body. The response headers
must include a "Content-Type" header indicating whether JSON or XML is being returned.
This response is returned when an Apple Watch is attempting to enroll in MDM and the watch did not include a pairing token
in the machine info request sent to the server to initiate enrollment. After receiving this response, the watch will fetch
a pairing token from the phone's MDM server via a request to the phone. The watch will then repeat the enrollment request
with the pairing token included.
payloadkeys:
- key: code
type: <string>
presence: required
rangelist:
- com.apple.watch.pairing.token.missing
content: Indicates that pairing token required to enroll a watch is missing.
- key: description
type: <string>
presence: optional
content: The description of the error. This will only be used by the client for
logging purposes and will not be displayed to the user.
- key: message
type: <string>
presence: optional
content: A description of the error suitable for displaying to the user. If needed,
the client will make a best-effort attempt to display the message, but may not
be able to, due to local conditions.
- key: details
type: <dictionary>
presence: required
content: A dictionary of additional data specific to the error code.
subkeys:
- key: security-token
type: <string>
presence: required
content: The security token to pass to the phone's MDM server to use to form the
pairing token. This should be a random UUID string.
mdm/profiles/CommonPayloadKeys.yaml
+4
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
iOS:
introduced: '4.0'
multiple: false
supervised: false
allowmanualinstall: true
sharedipad:
@@ -15,6 +16,7 @@ payload:
mode: allowed
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
@@ -24,10 +26,12 @@ payload:
mode: allowed
tvOS:
introduced: '5.0'
multiple: false
supervised: false
allowmanualinstall: true
watchOS:
introduced: '1.0'
multiple: false
allowmanualinstall: true
payloadkeys:
- key: PayloadIdentifier
mdm/profiles/GlobalPreferences.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/TopLevel.yaml
+4 -4
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
iOS:
introduced: '4.0'
multiple: false
supervised: false
allowmanualinstall: true
sharedipad:
@@ -15,6 +16,7 @@ payload:
mode: allowed
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
@@ -24,10 +26,12 @@ payload:
mode: allowed
tvOS:
introduced: '5.0'
multiple: false
supervised: false
allowmanualinstall: true
watchOS:
introduced: '1.0'
multiple: false
allowmanualinstall: true
payloadkeys:
- key: PayloadIdentifier
@@ -104,10 +108,6 @@ payloadkeys:
supervised: true
userenrollment:
mode: forbidden
macOS:
supervised: true
userenrollment:
mode: forbidden
tvOS:
supervised: true
watchOS:
mdm/profiles/com.apple.ADCertificate.managed.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: true
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.AIM.account.yaml
+1
View File
@@ -7,6 +7,7 @@ payload:
introduced: '10.7'
deprecated: '10.13'
removed: '10.14'
multiple: true
devicechannel: false
userchannel: true
requiresdep: false
mdm/profiles/com.apple.AssetCache.managed.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: 10.13.4
multiple: false
devicechannel: true
userchannel: false
requiresdep: false
mdm/profiles/com.apple.Dictionary.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.DirectoryService.managed.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.8'
multiple: true
devicechannel: true
userchannel: false
requiresdep: false
mdm/profiles/com.apple.DiscRecording.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.MCX(Accounts).yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: true
devicechannel: true
userchannel: false
requiresdep: false
mdm/profiles/com.apple.MCX(EnergySaver).yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: true
devicechannel: true
userchannel: false
requiresdep: false
mdm/profiles/com.apple.MCX(FileVault2).yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: false
requiresdep: false
mdm/profiles/com.apple.MCX(Mobililty).yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.MCX(TimeServer).yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: 10.12.4
multiple: false
devicechannel: true
userchannel: false
requiresdep: false
mdm/profiles/com.apple.MCX(WiFi).yaml
+4 -3
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.9'
multiple: true
devicechannel: true
userchannel: false
requiresdep: false
@@ -20,7 +21,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If YES, requires administrator authorization to enable IBSS.
content: If 'true', requires administrator authorization to enable IBSS.
- key: RequireAdminForAirPortNetworkChange
supportedOS:
macOS:
@@ -28,7 +29,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If YES, requires administrator authorization for network changes.
content: If 'true', requires administrator authorization for network changes.
- key: RequireAdminToTurnAirPortOnOff
supportedOS:
macOS:
@@ -36,4 +37,4 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If YES, requires administrator authorization to turn Wi-Fi on or off.
content: If 'true', requires administrator authorization to turn Wi-Fi on or off.
mdm/profiles/com.apple.MCX.FileVault2.yaml
+13
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.9'
multiple: false
devicechannel: true
userchannel: false
requiresdep: false
@@ -93,3 +94,15 @@ payloadkeys:
presence: optional
default: false
content: If 'true', prevents requests for enabling FileVault at user logout time.
- key: ForceEnableInSetupAssistant
supportedOS:
macOS:
introduced: '14.0'
requiresdep: true
allowmanualinstall: false
type: <boolean>
presence: optional
default: false
content: |-
If 'true', and this payload is installed after enrolling with MDM in Setup Assistant, it requests Setup Assistant to enable FileVault at setup time.
To use this, enable the Await Device Configured DEP configuration option, send this profile with this key set, before sending the DeviceConfigured command. An admin SecureToken user is required, otherwise the FileVault pane does not appear.
mdm/profiles/com.apple.MCX.TimeMachine.yaml
+2 -1
View File
@@ -4,6 +4,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: false
requiresdep: false
@@ -21,7 +22,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If true, backs up only the startup volume by default.
content: If 'true', backs up only the startup volume by default.
- key: BackupDestURL
type: <string>
presence: required
mdm/profiles/com.apple.ManagedClient.preferences.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: true
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.NSExtension.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.13'
multiple: true
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.SetupAssistant.managed.yaml
+12 -10
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
iOS:
introduced: '14.0'
multiple: false
supervised: true
allowmanualinstall: true
sharedipad:
@@ -15,6 +16,7 @@ payload:
mode: forbidden
macOS:
introduced: '10.12'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
@@ -32,7 +34,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', skips the Apple ID setup window.
content: If 'true', the system skips the Apple ID setup window.
- key: SkipSiriSetup
supportedOS:
iOS:
@@ -40,7 +42,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', skips the Siri setup window.
content: If 'true', the system skips the Siri setup window.
- key: SkipPrivacySetup
supportedOS:
iOS:
@@ -50,7 +52,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', skips the Privacy consent window.
content: If 'true', the system skips the Privacy consent window.
- key: SkipiCloudStorageSetup
supportedOS:
iOS:
@@ -60,7 +62,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', skips the iCloud Storage window.
content: If 'true', the system skips the iCloud Storage window.
- key: SkipTrueTone
supportedOS:
iOS:
@@ -70,7 +72,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', skips the True Tone Display window.
content: If 'true', the system skips the True Tone Display window.
- key: SkipAppearance
supportedOS:
iOS:
@@ -80,7 +82,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', skips the Choose Your Look window.
content: If 'true', the system skips the Choose Your Look window.
- key: SkipTouchIDSetup
supportedOS:
iOS:
@@ -90,7 +92,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If true, skips the Touch ID setup window.
content: If 'true', the system skips the Touch ID setup window.
- key: SkipScreenTime
supportedOS:
iOS:
@@ -100,7 +102,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If true, skips the Screen Time window.
content: If 'true', the system skips the Screen Time window.
- key: SkipAccessibility
supportedOS:
iOS:
@@ -110,7 +112,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: Skips Accessibility window
content: If 'true', the system skips the Accessibility window.
- key: SkipSetupItems
supportedOS:
iOS:
@@ -134,4 +136,4 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: Skips Unlock With Apple Watch window
content: If 'true', the system skips the Unlock With Apple Watch window.
mdm/profiles/com.apple.ShareKitHelper.yaml
+1
View File
@@ -6,6 +6,7 @@ payload:
macOS:
introduced: '10.9'
deprecated: '10.12'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.SoftwareUpdate.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: false
requiresdep: false
mdm/profiles/com.apple.SystemConfiguration.yaml
+1
View File
@@ -4,6 +4,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: false
requiresdep: false
mdm/profiles/com.apple.TCC.configuration-profile-policy.yaml
+11 -1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.14'
multiple: true
devicechannel: true
userchannel: false
requiresdep: false
@@ -46,7 +47,7 @@ payloadkeys:
- key: CodeRequirement
type: <string>
presence: required
content: Obtained via the command ''codesign –display -r -''.
content: Obtained via the command ''codesign -display -r -''.
- key: StaticCode
type: <boolean>
presence: optional
@@ -269,3 +270,12 @@ payloadkeys:
13 and later.
subkeytype: Identity
subkeys: *id001
- key: SystemPolicyAppData
supportedOS:
macOS:
introduced: '14.0'
type: <array>
presence: optional
content: Allows the application to access data of other apps.
subkeytype: Identity
subkeys: *id001
mdm/profiles/com.apple.airplay.security.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
tvOS:
introduced: '11.0'
multiple: false
supervised: false
allowmanualinstall: true
content: Manages the AirPlay Security settings on Apple TV (Settings > AirPlay >
mdm/profiles/com.apple.airplay.yaml
+2
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
iOS:
introduced: '7.0'
multiple: true
supervised: false
allowmanualinstall: true
sharedipad:
@@ -15,6 +16,7 @@ payload:
mode: allowed
macOS:
introduced: '10.10'
multiple: true
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.airprint.yaml
+2
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
iOS:
introduced: '7.0'
multiple: true
supervised: false
allowmanualinstall: true
sharedipad:
@@ -15,6 +16,7 @@ payload:
mode: allowed
macOS:
introduced: '10.10'
multiple: true
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.apn.managed.yaml
+1
View File
@@ -6,6 +6,7 @@ payload:
iOS:
introduced: '4.0'
deprecated: '7.0'
multiple: false
supervised: false
allowmanualinstall: true
sharedipad:
mdm/profiles/com.apple.app.lock.yaml
+2
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
iOS:
introduced: '6.0'
multiple: false
supervised: true
allowmanualinstall: true
sharedipad:
@@ -15,6 +16,7 @@ payload:
mode: forbidden
tvOS:
introduced: '10.2'
multiple: false
supervised: true
allowmanualinstall: true
payloadkeys:
mdm/profiles/com.apple.applicationaccess.new.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: true
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.applicationaccess.yaml
+588 -34
View File
File diff suppressed because it is too large Load Diff
mdm/profiles/com.apple.appstore.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.9'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.asam.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: 10.13.4
multiple: false
devicechannel: true
userchannel: false
requiresdep: false
mdm/profiles/com.apple.associated-domains.yaml
+1
View File
@@ -6,6 +6,7 @@ payload:
supportedOS:
macOS:
introduced: '10.15'
multiple: true
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.caldav.account.yaml
+2
View File
@@ -6,6 +6,7 @@ payload:
supportedOS:
iOS:
introduced: '4.0'
multiple: true
supervised: false
allowmanualinstall: true
sharedipad:
@@ -16,6 +17,7 @@ payload:
mode: allowed
macOS:
introduced: '10.7'
multiple: true
devicechannel: false
userchannel: true
requiresdep: false
mdm/profiles/com.apple.carddav.account.yaml
+2
View File
@@ -6,6 +6,7 @@ payload:
supportedOS:
iOS:
introduced: '4.0'
multiple: true
supervised: false
allowmanualinstall: true
sharedipad:
@@ -16,6 +17,7 @@ payload:
mode: allowed
macOS:
introduced: '10.7'
multiple: true
devicechannel: false
userchannel: true
requiresdep: false
mdm/profiles/com.apple.cellular.yaml
+2
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
iOS:
introduced: '7.0'
multiple: false
supervised: false
allowmanualinstall: true
sharedipad:
@@ -15,6 +16,7 @@ payload:
mode: forbidden
watchOS:
introduced: '3.2'
multiple: false
allowmanualinstall: true
content: |-
This payload cannot be installed if an APN payload is already installed.
mdm/profiles/com.apple.cellularprivatenetwork.managed.yaml
+73
View File
@@ -0,0 +1,73 @@
title: Cellular Private Network
description: Cellular Private Network Settings and Device Configuration
payload:
payloadtype: com.apple.cellularprivatenetwork.managed
supportedOS:
iOS:
introduced: '17.0'
multiple: false
supervised: false
allowmanualinstall: true
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
content: Payload can be used to provide device info on private network deployments
including geographical location, preference over wifi, and network deployment
type.
payloadkeys:
- key: Geofences
type: <array>
presence: optional
content: A list of up to 1000 geofences for private networks. Geofencing is only
used on iPhone.
subkeys:
- key: GeofenceItem
type: <dictionary>
subkeys:
- key: Longitude
type: <real>
presence: required
range:
min: -180.0
max: 180.0
content: The longitude of the geofence.
- key: Latitude
type: <real>
presence: required
range:
min: -90.0
max: 90.0
content: The latitude of the geofence.
- key: Radius
type: <real>
presence: required
range:
min: 100.0
max: 6500.0
content: Specifies the radius of the geofence in meters. Set this value slightly
greater than the private cellular network coverage area.
- key: GeofenceId
type: <string>
presence: required
content: A geofence identifier that's unique within a list of geofences.
- key: DataSetName
type: <string>
presence: required
content: The name of the private network configuration data set.
- key: VersionNumber
type: <string>
presence: required
content: The version number of this dataset that the system uses to track updates.
- key: CellularDataPreferred
type: <boolean>
presence: optional
default: false
content: Set to 'true' to prefer this private network over Wi-Fi.
- key: EnableNRStandalone
type: <boolean>
presence: optional
default: false
content: Set to 'true' if this private network is NR Standalone.
mdm/profiles/com.apple.conferenceroomdisplay.yaml
+1
View File
@@ -6,6 +6,7 @@ payload:
supportedOS:
tvOS:
introduced: '10.2'
multiple: false
supervised: true
allowmanualinstall: true
content: Configures an Apple TV to enter Conference Room Display mode, and restrictions
mdm/profiles/com.apple.configurationprofile.identification.yaml
+1
View File
@@ -4,6 +4,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.dashboard.yaml
+1
View File
@@ -7,6 +7,7 @@ payload:
introduced: '10.7'
deprecated: '10.15'
removed: '10.15'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.declarations.yaml
+51
View File
@@ -0,0 +1,51 @@
title: Declarations
description: Declarations
payload:
payloadtype: com.apple.declarations
supportedOS:
iOS:
introduced: '17.0'
multiple: true
supervised: false
allowmanualinstall: true
sharedipad:
mode: forbidden
userenrollment:
mode: forbidden
macOS:
introduced: '14.0'
multiple: true
devicechannel: true
userchannel: true
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: '17.0'
multiple: true
supervised: false
allowmanualinstall: true
watchOS:
introduced: '10.0'
multiple: true
supervised: false
allowmanualinstall: true
content: This profile applies a set of declarations to the device via the Settings
app. This allows manual installations of declarations in cases where an MDM enrollment
is not present. This profile can only be manually installed, and cannot be installed
via an MDM server.
payloadkeys:
- key: Declarations
title: Declarations
type: <array>
presence: required
content: The set of declarations to apply. The items in this array are Base64-encoded
data representations of the declaration JSON data.
subkeys:
- key: DeclarationsItem
title: Declarations Content Item
type: <data>
presence: required
content: An item in the declarations list
mdm/profiles/com.apple.desktop.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.10'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.dnsProxy.managed.yaml
+2
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
iOS:
introduced: '11.0'
multiple: false
supervised: false
allowmanualinstall: false
sharedipad:
@@ -15,6 +16,7 @@ payload:
mode: allowed
macOS:
introduced: '10.15'
multiple: false
devicechannel: true
userchannel: false
requiresdep: false
mdm/profiles/com.apple.dnsSettings.managed.yaml
+14
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
iOS:
introduced: '14.0'
multiple: true
supervised: false
allowmanualinstall: true
sharedipad:
@@ -15,6 +16,7 @@ payload:
mode: forbidden
macOS:
introduced: '11.0'
multiple: true
devicechannel: true
userchannel: false
requiresdep: false
@@ -185,3 +187,15 @@ payloadkeys:
default: false
content: If 'true', prohibits users from disabling DNS settings. This key is only
available on supervised devices.
- key: PayloadCertificateUUID
title: Certificate UUID
supportedOS:
iOS:
introduced: '16.0'
macOS:
introduced: '13.0'
type: <string>
presence: optional
format: ^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$
content: The UUID that points to an identity certificate payload. The system uses
this identity to authenticate the user to the DNS resolver.
mdm/profiles/com.apple.dock.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.domains.yaml
+2
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
iOS:
introduced: '8.0'
multiple: false
supervised: false
allowmanualinstall: true
sharedipad:
@@ -15,6 +16,7 @@ payload:
mode: forbidden
macOS:
introduced: '10.10'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.eas.account.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
iOS:
introduced: '4.0'
multiple: true
supervised: false
allowmanualinstall: true
sharedipad:
mdm/profiles/com.apple.education.yaml
+2
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
iOS:
introduced: '9.3'
multiple: false
supervised: false
allowmanualinstall: true
sharedipad:
@@ -15,6 +16,7 @@ payload:
mode: allowed
macOS:
introduced: '10.14'
multiple: false
devicechannel: false
userchannel: true
requiresdep: false
mdm/profiles/com.apple.ews.account.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: true
devicechannel: false
userchannel: true
requiresdep: false
mdm/profiles/com.apple.extensiblesso(kerberos).yaml
+2
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
iOS:
introduced: '13.0'
multiple: true
supervised: false
allowmanualinstall: false
sharedipad:
@@ -15,6 +16,7 @@ payload:
mode: allowed
macOS:
introduced: '10.15'
multiple: true
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.extensiblesso.yaml
+129 -3
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
iOS:
introduced: '13.0'
multiple: true
supervised: false
allowmanualinstall: false
sharedipad:
@@ -15,6 +16,7 @@ payload:
mode: allowed
macOS:
introduced: '10.15'
multiple: true
devicechannel: true
userchannel: true
requiresdep: false
@@ -60,7 +62,7 @@ payloadkeys:
- key: ANY
type: <any>
presence: optional
content: Keys and values to be passed to the app extension.
content: Keys and values to pass to the app extension.
- key: URLs
type: <array>
presence: optional
@@ -123,6 +125,7 @@ payloadkeys:
introduced: n/a
macOS:
introduced: '13.0'
deprecated: '14.0'
type: <string>
presence: optional
rangelist:
@@ -130,7 +133,7 @@ payloadkeys:
- UserSecureEnclaveKey
content: |-
The Platform SSO authentication method the extension uses. Requires that the SSO Extension also supports the method.
Available in macOS 13 and later.
Available in macOS 13 and later and deprecated in macOS 14.
- key: RegistrationToken
supportedOS:
iOS:
@@ -140,5 +143,128 @@ payloadkeys:
type: <string>
presence: optional
content: |-
The token this device uses for registration with Platform SSO. Use it for silent registration with the Identity Provider. Requires that 'AuthenticationMethod' isn't empty.
The token this device uses for registration with Platform SSO. Use it for silent registration with the Identity Provider. Requires that 'PlatformSSO' 'AuthenticationMethod' isn't empty.
Available in macOS 13 and later.
- key: PlatformSSO
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '14.0'
type: <dictionary>
presence: optional
content: The dictionary to configure Platform SSO.
subkeys:
- key: AuthenticationMethod
type: <string>
presence: optional
rangelist:
- Password
- UserSecureEnclaveKey
- SmartCard
content: The Platform SSO authentication method to use with the extension. Requires
that the SSO Extension also support the method.
- key: UseSharedDeviceKeys
type: <boolean>
presence: optional
default: false
content: If 'true', the system uses the same signing and encryption keys for all
users.
- key: AccountDisplayName
type: <string>
presence: optional
content: The display name for the account in notifications and authentication
requests.
- key: LoginFrequency
type: <integer>
presence: optional
range:
min: 3600
default: 64800
content: The duration, in seconds, until the system requires a full login instead
of a refresh. The default value is 64,800 (18 hours). The minimum value is 3600
(1 hour).
- key: EnableCreateUserAtLogin
type: <boolean>
presence: optional
default: false
content: Enables creating new users at the login window with an 'AuthenticationMethod'
of either 'Password' or 'SmartCard'. Requires that 'UseSharedDeviceKeys' is
'true'.
- key: EnableAuthorization
type: <boolean>
presence: optional
default: false
content: Enables using identity provider accounts at authorization prompts. Requires
that 'UseSharedDeviceKeys' is 'true'. The system assigns groups using 'AdministratorGroups',
'AdditionalGroups', or 'AuthorizationGroups'.
- key: TokenToUserMapping
type: <dictionary>
presence: optional
content: The attribute mapping to use when creating new users or for authorization.
subkeys:
- key: AccountName
type: <string>
presence: optional
content: The claim name to use for the user's account name.
- key: FullName
type: <string>
presence: optional
content: The claim name to use for the user's full name.
- key: NewUserAuthorizationMode
type: <string>
presence: optional
rangelist:
- Standard
- Admin
- Groups
content: |-
The permission to apply to newly created accounts at login, which has the following values:
* 'Standard': The account is a standard user.
* 'Admin': The system adds the account to the local administrators group.
* 'Groups': The system assigns group to the account using 'AdministratorGroups', 'AdditionalGroups', or 'AuthorizationGroups'.
- key: UserAuthorizationMode
type: <string>
presence: optional
rangelist:
- Standard
- Admin
- Groups
content: |-
The permission to apply to an account each time the user authenticates, which has the following values:
* 'Standard': The account is a standard user.
* 'Admin': The system adds the account to the local administrators group.
* 'Groups': The system assigns group to the account using 'AdministratorGroups', 'AdditionalGroups', or 'AuthorizationGroups'.
- key: AdministratorGroups
type: <array>
presence: optional
content: The list of groups to use for administrator access. The system requests
membership during authentication.
subkeys:
- key: Group
type: <string>
presence: optional
content: The group name.
- key: AdditionalGroups
type: <array>
presence: optional
content: The list of created groups that don't have administrator access.
subkeys:
- key: Group
type: <string>
presence: optional
content: The group name.
- key: AuthorizationGroups
type: <dictionary>
presence: optional
content: The pairing of Authorization Rights to group names. The system updates
the Authorization Right to use the group when used.
subkeys:
- key: Authorization Right
type: <string>
presence: required
content: The Authorization Right to update.
- key: Group
type: <string>
presence: required
content: The group to use for the Authorization Right.
mdm/profiles/com.apple.familycontrols.contentfilter.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.familycontrols.timelimits.v2.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.fileproviderd.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '11.0'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.finder.yaml
+11 -10
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
@@ -17,7 +18,7 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If 'true', disables the Finder's burn support.
content: If 'true', the system disables the Finder's burn support.
- key: InterfaceLevel
supportedOS:
macOS:
@@ -27,44 +28,44 @@ payloadkeys:
rangelist:
- Simple
- Full
content: If Finder should operate in Simple or Full mode.
content: Specifies whether Finder should operate in Simple or Full mode.
- key: ProhibitConnectTo
type: <boolean>
presence: optional
default: false
content: If set to true, Connect to Server will be disabled.
content: If 'true', the system disables Connect to Server.
- key: ProhibitEject
type: <boolean>
presence: optional
default: false
content: If set to true, Eject will be disabled.
content: If 'true', the system disables Eject.
- key: ProhibitGoToFolder
type: <boolean>
presence: optional
default: false
content: If set to true, Go To Folder will be disabled.
content: If 'true', the system disables Go to Folder.
- key: ShowExternalHardDrivesOnDesktop
type: <boolean>
presence: optional
default: true
content: If set to false, external hard drives will not appear on the desktop.
content: If 'false', external hard drives don't appear on the Desktop.
- key: ShowHardDrivesOnDesktop
type: <boolean>
presence: optional
default: false
content: If set to false, internal hard drives will not appear on the desktop.
content: If 'false', internal hard drives don't appear on the Desktop.
- key: ShowMountedServersOnDesktop
type: <boolean>
presence: optional
default: false
content: If set to false, mounted file servers will not appear on the desktop.
content: If 'false', mounted file servers don't appear on the Desktop.
- key: ShowRemovableMediaOnDesktop
type: <boolean>
presence: optional
default: true
content: If set to false, removable media will not appear on the desktop.
content: If 'false', removable media items don't appear on the Desktop.
- key: WarnOnEmptyTrash
type: <boolean>
presence: optional
default: true
content: If set to false, user will not be warned before emptying the trash.
content: If 'false', the user isn't warned before emptying the trash.
mdm/profiles/com.apple.firstactiveethernet.managed.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.firstethernet.managed.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.7'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.font.yaml
+2
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
iOS:
introduced: '7.0'
multiple: true
supervised: false
allowmanualinstall: true
sharedipad:
@@ -13,6 +14,7 @@ payload:
mode: allowed
macOS:
introduced: '10.9'
multiple: true
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.gamed.yaml
+1
View File
@@ -5,6 +5,7 @@ payload:
supportedOS:
macOS:
introduced: '10.9'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
mdm/profiles/com.apple.globalethernet.managed.yaml
+19 -2
View File
@@ -3,8 +3,20 @@ description: ''
payload:
payloadtype: com.apple.globalethernet.managed
supportedOS:
iOS:
introduced: '17.0'
multiple: false
supervised: false
allowmanualinstall: true
sharedipad:
mode: allowed
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
macOS:
introduced: '10.13'
multiple: false
devicechannel: true
userchannel: true
requiresdep: false
@@ -12,10 +24,15 @@ payload:
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: '17.0'
multiple: false
supervised: false
allowmanualinstall: true
payloadkeys:
- key: ANY
type: <any>
presence: optional
content: Keys relevant to 802.1x configuration. User enrollment payloads do not
content: Keys relevant to 802.1X configuration. User enrollment payloads do not
support the various proxy keys including ProxyType, ProxyServer, ProxyServerPort,
ProxyUsername, ProxyPassword,, ProxyPACURL and ProxyPACFallbackAllowed.
ProxyUsername, ProxyPassword, ProxyPACURL and ProxyPACFallbackAllowed.

Some files were not shown because too many files have changed in this diff Show More