CalvinBackup/apple_device-management
1
0
Fork 0
mirror of https://github.com/apple/device-management.git synced 2026-08-26 02:02:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Release_iOS-18-0_macOS-15-0

Browse Source
This commit is contained in:
Cyrus Daboo
2024-09-11 16:35:18 -04:00
parent dcc320a6a6
commit 85fae8ac89
140 changed files with 2312 additions and 303 deletions
Download Patch File Download Diff File Expand all files Collapse all files
declarative/declarations/assets/credential.acme.yaml
+2
View File
@@ -16,6 +16,8 @@ payload:
payloadkeys:
- key: Reference
type: <dictionary>
asset-content-types:
- application/json
presence: required
content: |-
The external reference. Ensure that the asset data:
declarative/declarations/assets/credential.certificate.yaml
+3
View File
@@ -16,6 +16,9 @@ payload:
payloadkeys:
- key: Reference
type: <dictionary>
asset-content-types:
- application/pkcs1
- application/pem
presence: required
content: The external reference. Ensure that the asset data uses a media type of
'application/pkcs1' or 'application/pem' to correctly identify the type of encoded
declarative/declarations/assets/credential.identity.yaml
+2
View File
@@ -16,6 +16,8 @@ payload:
payloadkeys:
- key: Reference
type: <dictionary>
asset-content-types:
- application/json
presence: required
content: |-
The external reference. Ensure that the asset data:
declarative/declarations/assets/credential.scep.yaml
+2
View File
@@ -16,6 +16,8 @@ payload:
payloadkeys:
- key: Reference
type: <dictionary>
asset-content-types:
- application/json
presence: required
content: |-
The external reference. Ensure that the asset data:
declarative/declarations/assets/credential.userpassword.yaml
+2
View File
@@ -17,6 +17,8 @@ payload:
payloadkeys:
- key: Reference
type: <dictionary>
asset-content-types:
- application/json
presence: required
content: |-
The external reference. Ensure that the asset data:
declarative/declarations/assets/credentials/acme.yaml
+18 -6
View File
@@ -24,11 +24,12 @@ payloadkeys:
title: Client identifier
type: <string>
presence: required
content: The server can use this as a nonce to prevent issuing multiple certificates.
It also indicates to the ACME server that the device has access to a valid client
identifier that the enterprise infrastructure issued. This can help the ACME server
determine whether to trust the device, however this is a relatively weak indication
because of the risk that an attacker may intercept and duplicate the client identifier.
content: The server can use this as a one-time code to prevent issuing multiple
certificates. It also indicates to the ACME server that the device has access
to a valid client identifier that the enterprise infrastructure issued. This can
help the ACME server determine whether to trust the device, however this is a
relatively weak indication because of the risk that an attacker may intercept
and duplicate the client identifier.
- key: KeySize
title: Key Size
type: <integer>
@@ -137,4 +138,15 @@ payloadkeys:
evidence that the key is bound to the device, and that the device has properties
listed in the attestation. The server can use that as part of a trust score to
decide whether to issue the requested certificate. When 'Attest' is 'true', set
'HardwareBound' to 'true'. On macOS, set this key, if present, to 'false'.
'HardwareBound' to 'true'. See the ACME attestation hardware support note for
hardware requirements.
notes:
- title: ACME attestation hardware support
content: |-
The following table indicates which System on Chips (SoCs) support ACME attestation.
If the Attest key is ignored, the ACME server does not receive an attestation.
| Attest key support | iPhone, iPad | Mac | Apple TV | Apple Watch | Vision Pro |
|--------------------|--------------------------------------|----------------|-------------------------|----------------|------------|
| Ignored | A10x Fusion and earlier | Intel | A10x Fusion and earlier | S3 and earlier | none |
| Supported | A11 Bionic and later<br>All M series | Apple Silicon | A12 Bionic and later | S4 and later | All |
declarative/declarations/configurations/account.caldav.yaml
+1
View File
@@ -28,6 +28,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/declarations/configurations/account.carddav.yaml
+1
View File
@@ -28,6 +28,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/declarations/configurations/account.exchange.yaml
+1 -15
View File
@@ -29,6 +29,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
@@ -268,9 +269,6 @@ payloadkeys:
content: If 'true', the system enables the per-message encryption switch in
the compose view.
- key: MailServiceActive
supportedOS:
macOS:
introduced: n/a
type: <boolean>
presence: optional
default: true
@@ -285,9 +283,6 @@ payloadkeys:
content: If 'true', the system prevents the user from changing the status of the
mail service for this account.
- key: ContactsServiceActive
supportedOS:
macOS:
introduced: n/a
type: <boolean>
presence: optional
default: true
@@ -302,9 +297,6 @@ payloadkeys:
content: If 'true', the system prevents the user from changing the status of the
address book service for this account.
- key: CalendarServiceActive
supportedOS:
macOS:
introduced: n/a
type: <boolean>
presence: optional
default: true
@@ -319,9 +311,6 @@ payloadkeys:
content: If 'true', the system prevents the user from changing the status of the
calendar service for this account.
- key: RemindersServiceActive
supportedOS:
macOS:
introduced: n/a
type: <boolean>
presence: optional
default: true
@@ -336,9 +325,6 @@ payloadkeys:
content: If 'true', the system prevents the user from changing the status of the
reminders service for this account.
- key: NotesServiceActive
supportedOS:
macOS:
introduced: n/a
type: <boolean>
presence: optional
default: true
declarative/declarations/configurations/account.google.yaml
+1
View File
@@ -28,6 +28,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/declarations/configurations/account.ldap.yaml
+1
View File
@@ -28,6 +28,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/declarations/configurations/account.mail.yaml
+1
View File
@@ -28,6 +28,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/declarations/configurations/account.subscribed-calendar.yaml
+1
View File
@@ -28,6 +28,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/declarations/configurations/app.managed.yaml
+23 -5
View File
@@ -29,19 +29,20 @@ payloadkeys:
title: App Store ID
type: <string>
presence: optional
content: The App Store ID of the managed app. One and only one of 'AppStoreID',
'BundleID', or 'ManifestURL' must be present.
content: The App Store ID of the managed app that is downloaded from the App Store.
One and only one of 'AppStoreID', 'BundleID', or 'ManifestURL' must be present.
- key: BundleID
title: Bundle ID
type: <string>
presence: optional
content: The bundle ID of the managed app. One and only one of 'AppStoreID', 'BundleID',
or 'ManifestURL' must be present.
content: The bundle ID of the managed app that is downloaded from the App Store.
One and only one of 'AppStoreID', 'BundleID', or 'ManifestURL' must be present.
- key: ManifestURL
title: Manifest URL
type: <string>
presence: optional
content: The URL of the manifest for the managed app. One and only one of 'AppStoreID',
content: The URL of the manifest for the managed app that is downloaded from a web
site. The manifest is returned as a property list. One and only one of 'AppStoreID',
'BundleID', or 'ManifestURL' must be present.
- key: InstallBehavior
title: Install Behavior
@@ -70,8 +71,25 @@ payloadkeys:
presence: optional
content: A dictionary that describes the app's license.
subkeys:
- key: Assignment
title: Assignment
type: <string>
presence: optional
rangelist:
- Device
- User
content: |-
Indicates what type of license to use when an App Store app is installed:
* Device - the license is assigned to the device.
* User - the license is assigned to the user.
This key must be present for App Store apps, when either 'AppStoreID' or 'BundleID' are present in the configuration.
- key: VPPType
title: VPP Type
supportedOS:
iOS:
removed: '18.0'
macOS:
removed: '15.0'
type: <string>
presence: optional
rangelist:
declarative/declarations/configurations/diskmanagement.settings.yaml
+55
View File
@@ -0,0 +1,55 @@
title: Disk Management:Settings
description: Use this configuration to install disk management settings on the device.
payload:
declarationtype: com.apple.configuration.diskmanagement.settings
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '15.0'
allowed-enrollments:
- supervised
- local
allowed-scopes:
- system
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
apply: combined
payloadkeys:
- key: Restrictions
type: <dictionary>
presence: optional
content: Defines the restrictions for disks
subkeys:
- key: ExternalStorage
title: External Storage
type: <string>
presence: optional
rangelist:
- Allowed
- ReadOnly
- Disallowed
combinetype: enum-last
content: |-
Specifies the mount policy for external storage:
* Allowed - external storage that is read-write or read-only will be mounted.
* ReadOnly - only external storage that is read-only will be automatically mounted. Note that external storage that is read-write will not be mounted read-only.
* Disallowed - no external storage will be mounted.
- key: NetworkStorage
title: Network Storage
type: <string>
presence: optional
rangelist:
- Allowed
- ReadOnly
- Disallowed
combinetype: enum-last
content: |-
Specifies the mount policy for network storage:
* Allowed - network storage that is read-write or read-only will be mounted.
* ReadOnly - only network storage that is read-only will be mounted. Note that network storage that is read-write will not be mounted read-only.
* Disallowed - no network storage will be mounted.
declarative/declarations/configurations/legacy.interactive.yaml
+2 -1
View File
@@ -32,6 +32,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
allowed-scopes:
@@ -45,7 +46,7 @@ payloadkeys:
type: <string>
presence: required
content: |-
The URL of the profile to download and install, which needs to start with 'https://', and must be hosted by the MDM server. The system silently ignores any account or passcode payloads in the profile. Use their declarative configurations instead.
The URL of the profile to download and install, which needs to start with 'https://', and must be hosted by the MDM server.
If a user enrollment triggers this configuration, the system silently ignores any MDM 1 payloads in macOS where the User Enrollment Mode setting is 'forbidden'. In iOS, the system rejects the entire profile.
- key: VisibleName
title: Configuration Visible Name
declarative/declarations/configurations/legacy.yaml
+2 -1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
@@ -55,5 +56,5 @@ payloadkeys:
type: <string>
presence: required
content: |-
The URL of the profile to download and install, which needs to start with 'https://', and must be hosted by the MDM server. The system silently ignores any account or passcode payloads in the profile. Use their declarative configurations instead.
The URL of the profile to download and install, which needs to start with 'https://', and must be hosted by the MDM server.
If a user enrollment triggers this configuration, the system silently ignores any MDM 1 payloads in macOS where the User Enrollment Mode setting is 'forbidden'. In iOS and tvOS, the system rejects the entire profile.
declarative/declarations/configurations/management.status-subscriptions.yaml
+1
View File
@@ -34,6 +34,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
allowed-scopes:
declarative/declarations/configurations/management.test.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/declarations/configurations/math.settings.yaml
+118
View File
@@ -0,0 +1,118 @@
title: Math Settings
description: Use this configuration to configure math-related settings
payload:
declarationtype: com.apple.configuration.math.settings
supportedOS:
iOS:
introduced: '18.0'
allowed-enrollments:
- supervised
allowed-scopes:
- system
sharedipad:
allowed-scopes:
- system
- user
macOS:
introduced: '15.0'
allowed-enrollments:
- supervised
allowed-scopes:
- user
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
apply: combined
content: Configures the built-in math and calculator app settings.
payloadkeys:
- key: Calculator
type: <dictionary>
presence: optional
content: If present, configures the built-in Calculator app.
subkeys:
- key: BasicMode
type: <dictionary>
presence: optional
content: If present, configures the basic mode of the calculator. Basic mode is
always enabled.
subkeys:
- key: AddSquareRoot
type: <boolean>
presence: required
combinetype: boolean-or
content: Add the square root button to the basic calculator by replacing the
+/- button. Normally, the square root button is available in scientific mode,
so this key can be used to make it available when the scientific mode is restricted.
- key: ScientificMode
type: <dictionary>
presence: optional
content: If present, configures the scientific mode of the calculator. If not
present, scientific mode is enabled.
subkeys:
- key: Enabled
type: <boolean>
presence: required
combinetype: boolean-and
content: Controls whether the mode is enabled.
- key: ProgrammerMode
supportedOS:
iOS:
introduced: n/a
type: <dictionary>
presence: optional
content: If present, configures the programmer mode of the calculator. If not
present, programmer mode is enabled.
subkeys:
- key: Enabled
type: <boolean>
presence: required
combinetype: boolean-and
content: Controls whether the mode is enabled.
- key: MathNotesMode
type: <dictionary>
presence: optional
content: If present, configures the Math Notes mode of the calculator. If not
present, math notes mode is enabled.
subkeys:
- key: Enabled
type: <boolean>
presence: required
combinetype: boolean-and
content: Controls whether the mode is enabled.
- key: InputModes
type: <dictionary>
presence: optional
content: If present, controls global input options of the calculator. If not present,
all input modes are enabled.
subkeys:
- key: UnitConversion
type: <boolean>
presence: required
combinetype: boolean-and
content: Configures whether unit conversions are enabled.
- key: RPN
supportedOS:
iOS:
introduced: n/a
type: <boolean>
presence: required
combinetype: boolean-and
content: Configures whether RPN input is enabled.
- key: SystemBehavior
type: <dictionary>
presence: optional
content: If present, configures math behavior in the system.
subkeys:
- key: KeyboardSuggestions
type: <boolean>
presence: required
combinetype: boolean-and
content: Controls whether keyboard suggestions include math solutions
- key: MathNotes
type: <boolean>
presence: required
combinetype: boolean-and
content: Controls whether Math Notes is allowed in other apps such as Notes.
declarative/declarations/configurations/passcode.settings.yaml
+14 -1
View File
@@ -25,7 +25,14 @@ payload:
tvOS:
introduced: n/a
visionOS:
introduced: n/a
introduced: '2.0'
allowed-enrollments:
- supervised
- device
- user
- local
allowed-scopes:
- system
watchOS:
introduced: '10.0'
allowed-enrollments:
@@ -116,6 +123,8 @@ payloadkeys:
introduced: n/a
macOS:
introduced: '13.1'
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <integer>
@@ -181,6 +190,8 @@ payloadkeys:
introduced: n/a
macOS:
introduced: '13.1'
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
@@ -197,6 +208,8 @@ payloadkeys:
introduced: n/a
macOS:
introduced: '14.0'
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
declarative/declarations/configurations/safari.extensions.settings.yaml
+101
View File
@@ -0,0 +1,101 @@
title: Safari:Extension Settings
description: Use this configuration to manage Safari Extensions.
payload:
declarationtype: com.apple.configuration.safari.extensions.settings
supportedOS:
iOS:
introduced: '18.0'
allowed-enrollments:
- supervised
allowed-scopes:
- system
sharedipad:
allowed-scopes:
- user
macOS:
introduced: '15.0'
allowed-enrollments:
- supervised
allowed-scopes:
- user
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
apply: combined
payloadkeys:
- key: ManagedExtensions
title: Managed Extensions
type: <dictionary>
presence: optional
content: Extensions being managed
subkeys:
- key: ANY
type: <dictionary>
presence: optional
content: The composed identifier of the managed extension, or "*" for all extensions.
In order for the extension to be managed, its host app must be present on the
device. To generate this string use codesign -dv <path_to_appex>. The browser
extension is located in the PlugIns folder inside the app bundle. The expected
format is "Identifier (TeamIdentifier)". For extensions that are not also available
on macOS the app developer will need to provide this information.
subkeytype: ExtensionDictionary
subkeys:
- key: State
title: Extension state
type: <string>
presence: optional
rangelist:
- Allowed
- AlwaysOn
- AlwaysOff
combinetype: enum-last
content: |-
Controls whether an extension is allowed.
* Allowed - The user is allowed to turn the extension on or off
* AlwaysOn - The extension will always be on
* AlwaysOff - The extension will always be off
- key: PrivateBrowsing
title: Private Browsing state
type: <string>
presence: optional
rangelist:
- Allowed
- AlwaysOn
- AlwaysOff
combinetype: enum-last
content: |-
Controls whether an extension is allowed in Private Browsing.
* Allowed - The user is allowed to turn the extension on or off in Private Browsing
* AlwaysOn - The extension will always be on in Private Browsing if the extension is on outside of Private Browsing
* AlwaysOff - The extension will never be on in Private Browsing
- key: AllowedDomains
title: Allowed domains
type: <array>
presence: optional
combinetype: set-union
content: Controls the domains and sub-domains the extension is granted access
to. Any non-prefixed domains take precedence over prefixed domains, and DeniedDomains
takes precedence over AllowedDomains. Any domains not specified in AllowedDomains
or DeniedDomains are configurable by the user.
subkeys:
- key: Domain
title: Domain
type: <string>
content: A domain or set of sub-domains where the extension is allowed
- key: DeniedDomains
title: Denied domains
type: <array>
presence: optional
combinetype: set-union
content: Controls the domains and sub-domains the extension is not allowed to
access. Any non-prefixed domains take precedence over prefixed domains, and
DeniedDomains takes precedence over AllowedDomains. Any domains not specified
in AllowedDomains or DeniedDomains are configurable by the user.
subkeys:
- key: Domain
title: Domain
type: <string>
content: A domain or set of sub-domains where the extension is not allowed
declarative/declarations/configurations/security.certificate.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/declarations/configurations/security.identity.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/declarations/configurations/services.background-tasks.yaml
+91
View File
@@ -0,0 +1,91 @@
title: Services Background Tasks
description: Specifies management of a background tasks
payload:
declarationtype: com.apple.configuration.services.background-tasks
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '15.0'
allowed-enrollments:
- supervised
allowed-scopes:
- system
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
apply: multiple
payloadkeys:
- key: TaskType
title: Task Type
type: <string>
presence: required
content: The unique identifier of the set of background tasks managed with this
configuration. This should be a reverse DNS style identifier. This is used solely
by the management system to differentiate between tasks in different configurations.
- key: TaskDescription
title: Task Description
type: <string>
presence: optional
content: A description of the set of background tasks managed by this configuration.
- key: ExecutableAssetReference
title: Executable Asset Reference
type: <string>
assettypes:
- com.apple.asset.data
asset-content-types:
- application/zip
presence: optional
content: |-
Specifies the identifier of an asset declaration containing a reference
to the files to be used for the background task configuration. The corresponding
asset must be of type "com.apple.asset.data". The referenced data must be a zip
archive of an entire directory, that will be expanded and stored in a well known
location for the background task. The asset's "ContentType" and "Hash-SHA-256"
keys in the "Reference" key are required.
This file should contain background task executables, scripts, and configuration
files, but not the launchd configuration files.
- key: LaunchdConfigurations
title: Launchd Configurations
type: <array>
presence: optional
content: An array of launchd configuration files used to run the background tasks.
subkeys:
- key: launchd-item
type: <dictionary>
presence: required
subkeys:
- key: FileAssetReference
title: File Asset Reference
type: <string>
assettypes:
- com.apple.asset.data
asset-content-types:
- application/plist
- application/x-plist
- application/xml
- text/xml
presence: required
content: |-
Specifies the identifier of an asset declaration containing a reference
to the launchd configuration file for the background task. The referenced data must be a
property list file conforming to the launchd.plist format. The asset's "ContentType" and "Hash-SHA-256"
keys in the "Reference" key are required.
- key: Context
title: Launchd Context
type: <string>
presence: required
rangelist:
- daemon
- agent
content: Indicates whether the launchd configuration file is applied to the
system daemon, or system agent domain.
related-status-items:
- status-items:
- services.background-task
note: Each service managed by a configuration will have a corresponding status item
that will contain a reference to the configuration.
declarative/declarations/configurations/services.configuration-files.yaml
+2
View File
@@ -37,6 +37,8 @@ payloadkeys:
type: <string>
assettypes:
- com.apple.asset.data
asset-content-types:
- application/zip
presence: required
content: |-
The identifier of an asset declaration that contains a reference to the files to use for system service configuration. Ensure that the corresponding asset:
declarative/declarations/configurations/softwareupdate.settings.yaml
+304
View File
@@ -0,0 +1,304 @@
title: Software Update:Settings
description: Software update settings
payload:
declarationtype: com.apple.configuration.softwareupdate.settings
supportedOS:
iOS:
introduced: '18.0'
allowed-enrollments:
- supervised
- device
allowed-scopes:
- system
sharedipad:
allowed-scopes:
- system
macOS:
introduced: '15.0'
allowed-enrollments:
- supervised
allowed-scopes:
- system
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
apply: combined
payloadkeys:
- key: Notifications
title: Software Update Notifications
type: <boolean>
presence: optional
default: true
combinetype: boolean-and
content: If 'true', the device shows all software update enforcement notifications.
If 'false', the device only shows notifications triggered one hour before the
enforcement deadline, and the restart countdown notification.
- key: Deferrals
title: Software Update Deferrals
supportedOS:
iOS:
allowed-enrollments:
- supervised
type: <dictionary>
presence: optional
content: Controls the deferral of software updates. Rapid Security Responses are
not considered within 'Major', 'Minor', or 'System' deferral mechanism.
subkeys:
- key: CombinedPeriodInDays
title: Combined Major/Minor Update Deferral Period
supportedOS:
macOS:
introduced: n/a
type: <integer>
presence: optional
range:
min: 1
max: 90
combinetype: number-max
content: Specifies the number of days to defer a major or minor OS software update
on the device. When set, software updates only appear after the specified delay,
following the release of the software update.
- key: MajorPeriodInDays
title: Major Update Deferral Period
supportedOS:
iOS:
introduced: n/a
type: <integer>
presence: optional
range:
min: 1
max: 90
combinetype: number-max
content: Specifies the number of days to defer a major OS software update on the
device. When set, software updates only appear after the specified delay, following
the release of the software update.
- key: MinorPeriodInDays
title: Minor Update Deferral Period
supportedOS:
iOS:
introduced: n/a
type: <integer>
presence: optional
range:
min: 1
max: 90
combinetype: number-max
content: Specifies the number of days to defer a minor OS software update on the
device. When set, software updates only appear after the specified delay, following
the release of the software update.
- key: SystemPeriodInDays
title: System Update Deferral Period
supportedOS:
iOS:
introduced: n/a
type: <integer>
presence: optional
range:
min: 1
max: 90
combinetype: number-max
content: Specifies the number of days to defer system or non-OS updates. When
set, updates only appear after the specified delay, following the release of
the update.
- key: RecommendedCadence
title: Software Update Recommended Cadence
supportedOS:
macOS:
introduced: n/a
type: <string>
presence: optional
rangelist:
- All
- Oldest
- Newest
combinetype: enum-last
content: |-
Specifies how the device shows software updates to the user. When more than one update is available update, the device behaves as follows:
* "All" - Shows all software update versions.
* "Oldest" - Shows only the oldest (lower numbered) software update version.
* "Newest" - Shows only the newest (highest numbered) software update version.
- key: AutomaticActions
title: Automatic Software Update Settings
supportedOS:
iOS:
allowed-enrollments:
- supervised
type: <dictionary>
presence: optional
content: Specifies various automatic Software Update functionality.
subkeys:
- key: Download
title: Automatic downloads of available updates.
type: <string>
presence: optional
rangelist:
- Allowed
- AlwaysOn
- AlwaysOff
default: Allowed
combinetype: enum-last
content: |-
Specifies whether automatic downloads of available updates can be controlled by the user:
* "Allowed" - the user can enable or disable automatic downloads.
* "AlwaysOn" - automatic downloads are always enabled.
* "AlwaysOff" - automatic downloads are always disabled.
- key: InstallOSUpdates
title: Automatic installs of OS updates.
type: <string>
presence: optional
rangelist:
- Allowed
- AlwaysOn
- AlwaysOff
default: Allowed
combinetype: enum-last
content: |-
Specifies whether automatic install of available OS updates can be controlled by the user:
* "Allowed" - the user can enable or disable automatic installs.
* "AlwaysOn" - automatic installs are always enabled.
* "AlwaysOff" - automatic installs are always disabled.
- key: InstallSecurityUpdate
title: Automatic installs of available security updates.
supportedOS:
iOS:
introduced: n/a
type: <string>
presence: optional
rangelist:
- Allowed
- AlwaysOn
- AlwaysOff
default: Allowed
combinetype: enum-last
content: |-
Specifies whether automatic install of available security updates can be controlled by the user:
* "Allowed" - the user can enable or disable automatic installs.
* "AlwaysOn" - automatic installs are always enabled.
* "AlwaysOff" - automatic installs are always disabled.
- key: RapidSecurityResponse
title: Rapid Security Response Settings
supportedOS:
iOS:
allowed-enrollments:
- supervised
type: <dictionary>
presence: optional
content: These configurations allow for setting user access to interacting with
Rapid Security Responses (RSRs).
subkeys:
- key: Enable
title: Enable Rapid Security Response Installation
type: <boolean>
presence: optional
default: true
combinetype: boolean-and
content: If 'false', Rapid Security Responses are not offered for user installation.
Rapid Security Responses can still be installed via 'com.apple.configuration.softwareupdate.enforcement.specific'
configurations. If 'true', Rapid Security Responses are offered to the user.
- key: EnableRollback
title: Enable Rapid Security Response Rollbacks
type: <boolean>
presence: optional
default: true
combinetype: boolean-and
content: If 'false', Rapid Security Response rollbacks are not offered to the
user. If 'true', Rapid Security Response rollbacks are offered to the user.
- key: AllowStandardUserOSUpdates
title: Allow Standard User OS Updates
supportedOS:
iOS:
introduced: n/a
type: <boolean>
presence: optional
default: true
combinetype: boolean-and
content: If 'true', a standard user can perform Major and Minor Software Updates.
If 'false', only administrators can perform Major and Minor Software Updates.
- key: Beta
supportedOS:
macOS:
introduced: n/a
type: <dictionary>
presence: optional
content: Configurations for controlling or specifying the beta programs associated
with a device.
subkeys:
- key: ProgramEnrollment
supportedOS:
iOS:
allowed-enrollments:
- supervised
type: <string>
presence: optional
rangelist:
- Allowed
- AlwaysOn
- AlwaysOff
default: Allowed
combinetype: enum-last
content: |-
Specifies whether beta program enrollment can be controlled by the user in software update settings UI:
* "Allowed" - the user can enroll in any applicable beta programs associated with their
logged in Apple Account. If the `OfferPrograms` key is present, then the programs listed in
that key are also presented to the user.
* "AlwaysOn" - the beta programs specified by the organization are used, and the user
is not be able to enroll in a beta program using their logged in Apple Account. The device
is automatically enrolled into the beta program specified by the `RequireProgram` key if
it is present. Otherwise, the programs listed in the `OfferPrograms` key are
presented to the user to choose which to enroll with.
* "AlwaysOff" - The device is not allowed to enroll in any beta programs. The device is
removed from any beta programs, if already enrolled.
- key: OfferPrograms
type: <array>
presence: optional
combinetype: set-union
content: An array of beta programs allowed on the device. This key must only be
present if the `ProgramEnrollment` key is set to `Allowed` or `AlwaysOn`. This
key must not be present if the `RequireProgram` key is present. This key can
be present on unsupervised devices where the `ProgramEnrollment` key is not
supported but is implicitly set to `Allowed`.
subkeys:
- key: Program
type: <dictionary>
presence: required
content: The name and token associated with a specific beta program to be allowed.
subkeys:
- key: Description
type: <string>
presence: required
content: A human readable description of the beta program.
- key: Token
type: <string>
presence: required
content: The Apple Business Manager or Apple School Manager seeding service
token for the organization the MDM server is part of. This token is used
to enroll the device in the corresponding beta program.
- key: RequireProgram
supportedOS:
iOS:
allowed-enrollments:
- supervised
type: <dictionary>
presence: optional
combinetype: first
content: The device automatically enrolls in this beta program. This key must
only be present if the `ProgramEnrollment` key is set to `AlwaysOn`. The `OfferPrograms`
key must not be present if this key is present.
subkeys:
- key: Description
type: <string>
presence: required
content: A human readable description of the beta program.
- key: Token
type: <string>
presence: required
content: The Apple Business Manager or Apple School Manager seeding service
token for the organization the MDM server is part of. This token is used to
enroll the device in the corresponding beta program.
related-status-items:
- status-items:
- softwareupdate.beta-enrollment
- softwareupdate.pending-version
declarative/declarations/configurations/watch.enrollment.yaml
+4 -3
View File
@@ -36,9 +36,10 @@ payloadkeys:
assettypes:
- com.apple.asset.credential.certificate
presence: optional
content: An array of identifiers of asset declarations that contain anchor certificates
to use to evaluate the trust of the enrollment profile server. Set the type of
the corresponding assets to 'com.apple.asset.credential.certificate'.
content: |-
An array of identifiers of asset declarations that contain anchor certificates to use to evaluate the trust of the enrollment profile server. Set the type of the corresponding assets to 'com.apple.asset.credential.certificate'.
These certificates are pinned, meaning that the server specified by the 'EnrollmentProfileURL' must use a certificate that chains to one of the certs in this array.
If it chains to one of the built-in trusted root certificates but not one of the 'AnchorCertificateAssetReferences' certs, the connection will fail.
subkeys:
- key: AnchorCertificateAssetReferenceItem
type: <string>
declarative/status/account.list.caldav.yaml
+1
View File
@@ -28,6 +28,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/account.list.carddav.yaml
+1
View File
@@ -28,6 +28,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/account.list.exchange.yaml
+1
View File
@@ -28,6 +28,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/account.list.google.yaml
+1
View File
@@ -28,6 +28,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/account.list.ldap.yaml
+1
View File
@@ -28,6 +28,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/account.list.mail.incoming.yaml
+1
View File
@@ -28,6 +28,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/account.list.mail.outgoing.yaml
+1
View File
@@ -28,6 +28,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/account.list.subscribed-calendar.yaml
+1
View File
@@ -28,6 +28,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/device.identifier.serial-number.yaml
+1
View File
@@ -34,6 +34,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- local
allowed-scopes:
declarative/status/device.identifier.udid.yaml
+1
View File
@@ -34,6 +34,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- local
allowed-scopes:
declarative/status/device.model.family.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/device.model.identifier.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/device.model.marketing-name.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/device.model.number.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/device.operating-system.build-version.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/device.operating-system.family.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/device.operating-system.marketing-name.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/device.operating-system.supplemental.build-version.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/device.operating-system.supplemental.extra-version.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/device.operating-system.version.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/management.client-capabilities.yaml
+1
View File
@@ -33,6 +33,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
allowed-scopes:
declarative/status/management.declarations.yaml
+1
View File
@@ -33,6 +33,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
allowed-scopes:
declarative/status/mdm.app.yaml
+3 -1
View File
@@ -27,6 +27,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
allowed-scopes:
@@ -61,7 +62,8 @@ payloadkeys:
default: false
content: To indicate removal of an app, this key's value is set to true, and
only this key and the "identifier" key will be present in the status item
object.
object. An MDM installed app will be reported as removed if management of
the app has been transferred to declarative device management.
- key: name
title: App name
type: <string>
declarative/status/passcode.is-compliant.yaml
+1
View File
@@ -23,6 +23,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/passcode.is-present.yaml
+1
View File
@@ -23,6 +23,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/security.certificate.list.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/services.background-task.yaml
+30
View File
@@ -110,3 +110,33 @@ payloadkeys:
type: <string>
presence: required
content: The hash value of the 'launchd' 'plist' file.
- key: device-management
title: Device Management
supportedOS:
macOS:
introduced: '15.0'
type: <dictionary>
presence: optional
content: If present, indicates this background task was created by a 'services.background-tasks'
configuration. This dictionary contains properties that identify the configuration
and specific version of the declaration asset that provided the launchd
plist for the task.
subkeys:
- key: configuration-identifier
title: Configuration Identifier
type: <string>
presence: required
content: The identifier of the 'services.background-tasks' configuration
that created this task.
- key: asset-identifier
title: Asset Identifier
type: <string>
presence: required
content: The identifier of the declaration asset that provided the launchd
plist for this task.
- key: asset-server-token
title: Asset Server Token
type: <string>
presence: required
content: The server token of the declaration asset that provided the launchd
plist for this task.
declarative/status/softwareupdate.beta-enrollment.yaml
+34
View File
@@ -0,0 +1,34 @@
title: Status Software Update Beta Enrollment
description: The device's enrolled beta program.
payload:
statusitemtype: softwareupdate.beta-enrollment
supportedOS:
iOS:
introduced: '18.0'
allowed-enrollments:
- supervised
- device
allowed-scopes:
- system
sharedipad:
allowed-scopes:
- system
macOS:
introduced: '15.0'
allowed-enrollments:
- supervised
allowed-scopes:
- system
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: softwareupdate.beta-enrollment
title: The device's enrolled beta program.
type: <string>
presence: required
content: The device's enrolled beta program name, or an empty string if there is
no enrolled beta program.
declarative/status/softwareupdate.device-id.yaml
+34
View File
@@ -0,0 +1,34 @@
title: Status Software Update Device ID
description: The device's software update device ID.
payload:
statusitemtype: softwareupdate.device-id
supportedOS:
iOS:
introduced: '18.0'
allowed-enrollments:
- supervised
- device
allowed-scopes:
- system
sharedipad:
allowed-scopes:
- system
macOS:
introduced: '15.0'
allowed-enrollments:
- supervised
allowed-scopes:
- system
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
payloadkeys:
- key: softwareupdate.device-id
title: The device's software update device ID.
type: <string>
presence: required
content: The device identifier to use when looking up available software updates
via <https://gdmf.apple.com/v2/pmv>.
declarative/status/test.array-value.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/test.boolean-value.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/test.dictionary-value.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/test.error-value.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/test.integer-value.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/test.real-value.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local
declarative/status/test.string-value.yaml
+1
View File
@@ -36,6 +36,7 @@ payload:
visionOS:
introduced: '1.1'
allowed-enrollments:
- supervised
- device
- user
- local