CalvinBackup/apple_device-management
1
0
Fork 0
mirror of https://github.com/apple/device-management.git synced 2026-07-10 21:13:42 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
seed_OS_27_0
apple_device-management/mdm/commands/information.device.yaml
T
Cyrus Daboo 97a11a861f Seed2
2026-06-22 15:55:19 -04:00

3247 lines
96 KiB
YAML
Raw Permalink Blame History

title: Device Information Command
description: Get detailed information about a device.
payload:
requesttype: DeviceInformation
supportedOS:
iOS:
introduced: '4.0'
accessrights: Special Case
supervised: false
requiresdep: false
sharedipad:
mode: allowed
devicechannel: true
userchannel: true
userenrollment:
mode: allowed
macOS:
introduced: '10.7'
accessrights: Special Case
devicechannel: true
userchannel: true
supervised: false
requiresdep: false
userenrollment:
mode: allowed
tvOS:
introduced: '9.0'
accessrights: Special Case
supervised: false
visionOS:
introduced: '1.1'
accessrights: Special Case
supervised: false
requiresdep: false
userenrollment:
mode: allowed
watchOS:
introduced: '10.0'
accessrights: Special Case
supervised: false
content: This command allows the server to query for specific device information.
It's supported in the user channel.
payloadkeys:
- key: Queries
type: <array>
presence: required
content: An array of query dictionaries to get information about a device.
subkeys:
- key: QueriesItem
type: <string>
content: A query dictionary to get information about a device.
subkeys:
- key: UDID
supportedOS:
iOS:
accessrights: n/a
userenrollment:
mode: forbidden
macOS:
accessrights: n/a
userenrollment:
mode: forbidden
tvOS:
accessrights: n/a
visionOS:
accessrights: n/a
userenrollment:
mode: forbidden
watchOS:
accessrights: n/a
type: <string>
presence: optional
content: The key to get the unique identifier of the device.
- key: ProvisioningUDID
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.3'
accessrights: n/a
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the device identifier for provisioning profiles. This
value differs from the UDID for a Mac with Apple silicon.
- key: OrganizationInfo
supportedOS:
iOS:
introduced: '7.0'
accessrights: n/a
macOS:
introduced: '10.11'
tvOS:
introduced: '9.0'
accessrights: n/a
visionOS:
accessrights: n/a
watchOS:
accessrights: n/a
type: <string>
presence: optional
content: The key to get the contents of `OrganizationInfo`.
- key: MDMOptions
supportedOS:
iOS:
introduced: '7.0'
accessrights: n/a
macOS:
introduced: '11.0'
tvOS:
introduced: '9.0'
accessrights: n/a
visionOS:
accessrights: n/a
watchOS:
introduced: '10.0'
type: <string>
presence: optional
content: The key to get the contents of `MDMOptions`.
- key: LastCloudBackupDate
supportedOS:
iOS:
introduced: '8.0'
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
userenrollment:
mode: forbidden
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the date of the most-recent iCloud backup.
- key: AwaitingConfiguration
supportedOS:
iOS:
introduced: '9.0'
accessrights: n/a
userenrollment:
mode: forbidden
macOS:
introduced: '10.11'
accessrights: n/a
userenrollment:
mode: forbidden
tvOS:
introduced: '10.2'
accessrights: n/a
visionOS:
introduced: '2.0'
userenrollment:
mode: forbidden
watchOS:
accessrights: n/a
type: <string>
presence: optional
content: The key to determine whether the device is waiting for a `Device-Configured-Command`
command or `User-Configured-Command` command to continue through Setup Assistant
on the device channel or user channel, respectively.
- key: iTunesStoreAccountIsActive
supportedOS:
iOS:
introduced: '7.0'
accessrights: AllowAppInstallation
userenrollment:
mode: forbidden
macOS:
introduced: '10.9'
accessrights: AllowAppInstallation
userenrollment:
mode: forbidden
tvOS:
introduced: '9.0'
accessrights: AllowAppInstallation
visionOS:
introduced: n/a
watchOS:
accessrights: AllowAppInstallation
type: <string>
presence: optional
content: The key to determine whether the iTunes Store account is active. Requires
the App Installation access right.
- key: iTunesStoreAccountHash
supportedOS:
iOS:
introduced: '8.0'
accessrights: AllowAppInstallation
userenrollment:
mode: forbidden
macOS:
introduced: '10.10'
accessrights: AllowAppInstallation
userenrollment:
mode: forbidden
tvOS:
introduced: '9.0'
accessrights: AllowAppInstallation
visionOS:
introduced: n/a
watchOS:
accessrights: AllowAppInstallation
type: <string>
presence: optional
content: The key to get a hash of the logged-in iTunes Store account. Also see
`GetVppUserRequest`. Requires the App Installation access right.
- key: DeviceName
supportedOS:
iOS:
accessrights: AllowQueryDeviceInformation
macOS:
accessrights: AllowQueryDeviceInformation
tvOS:
accessrights: AllowQueryDeviceInformation
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to get the device name. Requires the Device Information access
right.
- key: OSVersion
supportedOS:
iOS:
accessrights: AllowQueryDeviceInformation
macOS:
accessrights: AllowQueryDeviceInformation
tvOS:
accessrights: AllowQueryDeviceInformation
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to get the operating system version. Requires the Device Information
access right.
- key: SupplementalOSVersionExtra
supportedOS:
iOS:
introduced: '16.1'
accessrights: AllowQueryDeviceInformation
macOS:
introduced: '13.0'
accessrights: AllowQueryDeviceInformation
tvOS:
introduced: '16.1'
accessrights: AllowQueryDeviceInformation
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to get the OS update Background Security Improvement version
letter, if a Background Security Improvement update is installed. Requires
the Device Information access right.
- key: BuildVersion
supportedOS:
iOS:
accessrights: AllowQueryDeviceInformation
macOS:
accessrights: AllowQueryDeviceInformation
tvOS:
accessrights: AllowQueryDeviceInformation
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to get the operating system version. Requires the Device Information
access right.
- key: SupplementalBuildVersion
supportedOS:
iOS:
introduced: '16.1'
accessrights: AllowQueryDeviceInformation
macOS:
introduced: '13.0'
accessrights: AllowQueryDeviceInformation
tvOS:
introduced: '16.1'
accessrights: AllowQueryDeviceInformation
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to get the build version for the currently installed Background
Security Improvement. If there's no installed Background Security Improvement,
this value is the same as `BuildVersion`. Requires the Device Information
access right.
- key: ModelName
supportedOS:
iOS:
accessrights: AllowQueryDeviceInformation
macOS:
accessrights: AllowQueryDeviceInformation
tvOS:
accessrights: AllowQueryDeviceInformation
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to get the model name, such as _iPhone_. Requires the Device
Information access right.
- key: Model
supportedOS:
iOS:
accessrights: AllowQueryDeviceInformation
macOS:
accessrights: AllowQueryDeviceInformation
tvOS:
accessrights: AllowQueryDeviceInformation
visionOS:
introduced: n/a
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to get the model. Requires the Device Information access right.
- key: ModelNumber
supportedOS:
iOS:
introduced: '16.4'
accessrights: AllowQueryDeviceInformation
macOS:
introduced: '13.3'
accessrights: AllowQueryDeviceInformation
tvOS:
introduced: '16.4'
accessrights: AllowQueryDeviceInformation
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to get the device's hardware model number, including region
info, such as `MK1A3LL/A`. Requires the Device Information access right. Requires
a Mac with Apple silicon for macOS.
- key: IsAppleSilicon
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '12.0'
accessrights: AllowQueryDeviceInformation
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the device is a Mac with Apple silicon
(for example, an Apple M1 chip).
- key: ProductName
supportedOS:
iOS:
accessrights: AllowQueryDeviceInformation
macOS:
accessrights: AllowQueryDeviceInformation
tvOS:
accessrights: AllowQueryDeviceInformation
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to get the product name, such as _iPad8,12_. Requires the Device
Information access right.
- key: SerialNumber
supportedOS:
iOS:
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
macOS:
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
tvOS:
accessrights: AllowQueryDeviceInformation
visionOS:
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to get the serial number. Requires the Device Information access
right.
- key: DeviceCapacity
supportedOS:
iOS:
accessrights: AllowQueryDeviceInformation
macOS:
accessrights: AllowQueryDeviceInformation
tvOS:
introduced: n/a
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to get the device's total capacity. Requires the Device Information
access right.
- key: AvailableDeviceCapacity
supportedOS:
iOS:
accessrights: AllowQueryDeviceInformation
macOS:
accessrights: AllowQueryDeviceInformation
tvOS:
introduced: n/a
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to get the available capacity. Requires the Device Information
access right.
- key: IMEI
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the International Mobile Equipment Identity (IMEI) number.
Requires the Device Information access right. Available as of iOS 4 and deprecated
in iOS 16.
- key: MEID
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the mobile equipment ID (MEID). Requires the Device
Information access right. Available as of iOS 4 and deprecated in iOS 16.
- key: ModemFirmwareVersion
supportedOS:
iOS:
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the modem firmware version. Requires the Device Information
access right.
- key: CellularTechnology
supportedOS:
iOS:
introduced: 4.2.6
accessrights: AllowQueryDeviceInformation
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the cellular technology type. Requires the Device Information
access right.
- key: BatteryLevel
supportedOS:
iOS:
introduced: '5.0'
accessrights: AllowQueryDeviceInformation
macOS:
introduced: '13.3'
accessrights: AllowQueryDeviceInformation
tvOS:
introduced: n/a
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to get the battery level. Requires the Device Information access
right.
- key: HasBattery
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '13.3'
accessrights: AllowQueryDeviceInformation
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the device has an internal battery.
- key: IsSupervised
supportedOS:
iOS:
introduced: '6.0'
accessrights: AllowQueryDeviceInformation
macOS:
introduced: '10.15'
tvOS:
introduced: '9.0'
accessrights: AllowQueryDeviceInformation
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to determine whether the device is supervised. Requires the
Device Information access right.
- key: IsMultiUser
supportedOS:
iOS:
introduced: '9.3'
accessrights: AllowQueryDeviceInformation
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the device is a Shared iPad. Requires
the Device Information access right.
- key: IsDeviceLocatorServiceEnabled
supportedOS:
iOS:
introduced: '7.0'
accessrights: AllowQueryDeviceInformation
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to determine whether the system enabled a device locator service
such as Find My on the device. Requires the Device Information access right.
- key: IsActivationLockEnabled
supportedOS:
iOS:
introduced: '7.0'
deprecated: '16.0'
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
macOS:
introduced: '10.15'
deprecated: '13.0'
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
deprecated: '10.0'
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to determine whether the system enabled Activation Lock on
the device. Requires the Device Information access right. Available as of
iOS 7 and macOS 10.15, and deprecated in iOS 16 and macOS 13.
- key: IsActivationLockSupported
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.15'
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the device supports Activation Lock. Also
see `IsActivationLockManageable` in `ManagementStatus`.
- key: IsDoNotDisturbInEffect
supportedOS:
iOS:
introduced: '7.0'
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to determine whether the device is in Do Not Disturb (DND)
mode. Requires the Device Information access right.
- key: DeviceID
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: n/a
tvOS:
introduced: '9.0'
accessrights: AllowQueryDeviceInformation
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the device ID. Requires the Device Information access
right.
- key: EASDeviceIdentifier
supportedOS:
iOS:
introduced: '7.0'
accessrights: AllowQueryDeviceInformation
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the device identifier for Exchange ActiveSync (EAS).
Requires the Device Information access right.
- key: IsCloudBackupEnabled
supportedOS:
iOS:
introduced: '7.1'
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the system enabled iCloud Backup on the
device. Requires the Device Information access right.
- key: ActiveManagedUsers
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
accessrights: AllowQueryDeviceInformation
userchannel: false
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get an array of directory GUIDs for logged-in managed users.
Requires the Device Information access right.
- key: OSUpdateSettings
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
deprecated: '26.0'
removed: '27.0'
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the contents of `OSUpdateSettings`. Requires the Device
Information access right.
- key: LocalHostName
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
accessrights: AllowQueryDeviceInformation
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the local hostname from Bonjour.
- key: HostName
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
accessrights: AllowQueryDeviceInformation
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the hostname.
- key: AutoSetupAdminAccounts
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
accessrights: AllowQueryDeviceInformation
requiresdep: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the contents of `AutoSetupAdminAccountsItem`, which
Setup Assistant automatically creates during enrollment. Requires the Device
Information access right.
- key: SystemIntegrityProtectionEnabled
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.12'
accessrights: AllowQueryDeviceInformation
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the system enabled System Integrity Protection
on the device. Requires the Device Information access right, and is available
in macOS 10.12 and later.
- key: SupportsLOMDevice
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
accessrights: AllowQueryDeviceInformation
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the device can receive `PowerON`, `PowerOFF`,
and `Reset` commands from a lights-out management (LOM) controller.
- key: IsMDMLostModeEnabled
supportedOS:
iOS:
introduced: '9.3'
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to determine whether the system enabled Managed Lost Mode on
the device. Requires the Device Information access right.
- key: MaximumResidentUsers
supportedOS:
iOS:
introduced: '9.3'
accessrights: AllowQueryDeviceInformation
supervised: true
requiresdep: true
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the maximum number of users that can use this Shared
iPad device. In iOS 13.4 and later, this value is always `32`. Requires the
Device Information access right.
- key: EstimatedResidentUsers
supportedOS:
iOS:
introduced: '14.0'
accessrights: AllowQueryDeviceInformation
supervised: true
requiresdep: true
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the estimated number of users that can use this Shared
iPad device, according to the available space of the device and each user's
quota. Requires the Device Information access right.
- key: QuotaSize
supportedOS:
iOS:
introduced: '13.4'
accessrights: AllowQueryDeviceInformation
supervised: true
requiresdep: true
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the quota size for each user on this Shared iPad device.
Requires the Device Information access right.
- key: ResidentUsers
supportedOS:
iOS:
introduced: '13.4'
accessrights: AllowQueryDeviceInformation
supervised: true
requiresdep: true
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the number of users currently on this Shared iPad device.
Requires the Device Information access right.
- key: UserSessionTimeout
supportedOS:
iOS:
introduced: '14.5'
accessrights: AllowQueryDeviceInformation
supervised: true
requiresdep: true
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the timeout interval for the user session.
- key: TemporarySessionTimeout
supportedOS:
iOS:
introduced: '14.5'
accessrights: AllowQueryDeviceInformation
supervised: true
requiresdep: true
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the timeout interval for the temporary session.
- key: TemporarySessionOnly
supportedOS:
iOS:
introduced: '14.5'
accessrights: AllowQueryDeviceInformation
supervised: true
requiresdep: true
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the device allows only temporary sessions.
- key: ManagedAppleIDDefaultDomains
supportedOS:
iOS:
introduced: '16.0'
accessrights: AllowQueryDeviceInformation
supervised: true
requiresdep: true
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the list of domains that the device suggests on the
Shared iPad login screen.
- key: OnlineAuthenticationGracePeriod
supportedOS:
iOS:
introduced: '16.0'
accessrights: AllowQueryDeviceInformation
supervised: true
requiresdep: true
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the grace period for Shared iPad online authentication
(in days).
- key: SkipLanguageAndLocaleSetupForNewUsers
supportedOS:
iOS:
introduced: '16.2'
accessrights: AllowQueryDeviceInformation
supervised: true
requiresdep: true
sharedipad:
mode: required
devicechannel: true
userchannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the system skips the language and country/region
panes for new users on Shared iPad.
- key: PushToken
supportedOS:
iOS:
introduced: '9.3'
accessrights: AllowQueryDeviceInformation
sharedipad:
devicechannel: false
userenrollment:
mode: forbidden
macOS:
introduced: '10.12'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the push token for the current user-channel connection.
The MDM server ignores this query for the device channel. Requires the Device
Information access right.
- key: DiagnosticSubmissionEnabled
supportedOS:
iOS:
introduced: '9.3'
accessrights: AllowQueryDeviceInformation
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to determine whether the system enabled the diagnostic submission
setting on the device. Requires the Device Information access right.
- key: AppAnalyticsEnabled
supportedOS:
iOS:
introduced: '9.3'
accessrights: AllowQueryDeviceInformation
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to determine whether the device is sharing app analytics. Requires
the Device Information access right.
- key: TimeZone
supportedOS:
iOS:
introduced: '14.0'
accessrights: AllowQueryDeviceInformation
macOS:
introduced: '26.0'
accessrights: AllowQueryDeviceInformation
tvOS:
introduced: '14.0'
accessrights: AllowQueryDeviceInformation
visionOS:
introduced: '2.0'
accessrights: AllowQueryDeviceInformation
watchOS:
accessrights: AllowQueryDeviceInformation
type: <string>
presence: optional
content: The key to get the current Internet Assigned Numbers Authority (IANA)
time zone database name. Requires the Device Information access right.
- key: ICCID
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the integrated circuit card (ICC) identifier for the
installed SIM card. Requires the Network Information access right. Available
as of iOS 4 and deprecated in iOS 16.
- key: BluetoothMAC
supportedOS:
iOS:
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
tvOS:
accessrights: AllowQueryNetworkInformation
visionOS:
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the Bluetooth media access control (MAC) address. Requires
the Network Information access right.
- key: WiFiMAC
supportedOS:
iOS:
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
tvOS:
accessrights: AllowQueryNetworkInformation
visionOS:
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
watchOS:
accessrights: AllowQueryNetworkInformation
type: <string>
presence: optional
content: The key to get the Wi-Fi MAC address. Requires the Network Information
access right.
- key: EthernetMAC
supportedOS:
iOS:
introduced: n/a
macOS:
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the primary Ethernet MAC address. Requires the Network
Information access right.
- key: CurrentCarrierNetwork
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the name of the current carrier network. Requires the
Network Information access right. Available as of iOS 4 and deprecated in
iOS 16.
- key: SIMCarrierNetwork
supportedOS:
iOS:
removed: '5.0'
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: Apple no longer supports this query. Use `SubscriberCarrierNetwork`
instead.
- key: SubscriberCarrierNetwork
supportedOS:
iOS:
introduced: '5.0'
deprecated: '16.0'
removed: '26.0'
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the home carrier network. Requires the Network Information
access right. Available as of iOS 5 and deprecated in iOS 16.
- key: CarrierSettingsVersion
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the version of the carrier settings. Requires the Network
Information access right. Available as of iOS 4 and deprecated in iOS 16.
- key: PhoneNumber
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the raw phone number, without punctuation, and including
the country code. Requires the Network Information access right. Available
as of iOS 4 and deprecated in iOS 16.
- key: DataRoamingEnabled
supportedOS:
iOS:
introduced: '5.0'
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the system enabled data roaming on the
device. Requires the Network Information access right.
- key: VoiceRoamingEnabled
supportedOS:
iOS:
introduced: '5.0'
deprecated: '16.0'
removed: '26.0'
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the system enabled voice roaming on the
device, which isn't available for all carriers. Requires the Network Information
access right. Available as of iOS 5 and deprecated in iOS 16.
- key: PersonalHotspotEnabled
supportedOS:
iOS:
introduced: '7.0'
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the system enabled Personal Hotspot on
the device, which isn't available for all carriers. Requires the Network Information
access right.
- key: IsNetworkTethered
supportedOS:
iOS:
introduced: '10.3'
accessrights: AllowQueryNetworkInformation
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the device is network-tethered. Requires
the Network Information access right.
- key: IsRoaming
supportedOS:
iOS:
introduced: '4.2'
deprecated: '16.0'
removed: '26.0'
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the device is roaming. Requires the Network
Information access right.
- key: SubscriberMCC
supportedOS:
iOS:
introduced: 4.2.6
deprecated: '16.0'
removed: '26.0'
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the home mobile country code. Requires the Network Information
access right. Available as of iOS 4.2.6 and deprecated in iOS 16.
- key: SubscriberMNC
supportedOS:
iOS:
introduced: 4.2.6
deprecated: '16.0'
removed: '26.0'
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the home mobile network code. Requires the Network Information
access right. Available as of iOS 4.2.6 and deprecated in iOS 16.
- key: CurrentMCC
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the current mobile country code (MCC). Requires the
Network Information access right. It's available as of iOS 4 and deprecated
in iOS 16.
- key: CurrentMNC
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the current mobile network code (MNC). Requires the
Network Information access right. Available as of iOS 4 and deprecated in
iOS 16.
- key: ServiceSubscriptions
supportedOS:
iOS:
introduced: '12.0'
accessrights: AllowQueryNetworkInformation
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to get the contents of `ServiceSubscriptionProperty`. Requires
the Network Information access right.
- key: PINRequiredForEraseDevice
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the `EraseDeviceCommand` requires a PIN.
- key: PINRequiredForDeviceLock
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
accessrights: AllowQueryDeviceInformation
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the `DeviceLockCommand` requires a PIN.
- key: SupportsiOSAppInstalls
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
accessrights: AllowQueryDeviceInformation
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the macOS device supports iOS or iPadOS
app installs.
- key: SoftwareUpdateDeviceID
supportedOS:
iOS:
introduced: '15.0'
deprecated: '26.0'
removed: '27.0'
userenrollment:
mode: forbidden
macOS:
introduced: '12.0'
deprecated: '26.0'
removed: '27.0'
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
deprecated: '26.0'
removed: '27.0'
userenrollment:
mode: forbidden
watchOS:
introduced: n/a
type: <string>
presence: optional
content: |-
The key to get the device identifier to look up available OS updates through [https://gdmf.apple.com/v2/pmv](https://gdmf.apple.com/v2/pmv).
Removed: subscribe to the declarative management `softwareupdate.device-id` status item.
- key: SoftwareUpdateSettings
supportedOS:
iOS:
introduced: '14.5'
deprecated: '26.0'
removed: '27.0'
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: |-
The key to get the device settings that control which updates appear in the Software Update pane in Settings.
Removed: use the declarative management `com.apple.configuration.softwareupdate.settings` configuration to set values.
- key: AccessibilitySettings
supportedOS:
iOS:
introduced: '16.0'
supervised: true
sharedipad:
mode: allowed
devicechannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
supervised: true
type: <string>
presence: optional
content: The key to get the current state of settable accessibility settings.
- key: DevicePropertiesAttestation
supportedOS:
iOS:
introduced: '16.0'
userenrollment:
mode: allowed
macOS:
introduced: '14.0'
tvOS:
introduced: '16.0'
visionOS:
userenrollment:
mode: allowed
type: <string>
presence: optional
content: The key to get an attestation of the device's properties. See the hardware
requirements for attestation below.
- key: EACSPreflight
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '13.3'
accessrights: AllowQueryDeviceInformation
userchannel: false
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
presence: optional
content: The key to determine whether the device can perform an `EraseDeviceCommand`
using Erase All Content and Settings (EACS).
- key: DeviceAttestationNonce
supportedOS:
iOS:
introduced: '16.0'
userenrollment:
mode: allowed
macOS:
introduced: '14.0'
tvOS:
introduced: '16.0'
visionOS:
userenrollment:
mode: allowed
type: <data>
presence: optional
content: |-
A freshness code that appears in the resulting attestation. This value can contain up to 32 bytes of data. If specified, queries need to contain `DevicePropertiesAttestation`.
The MDM server uses this value to prove that an attestation was recently generated. The system caches the most recently generated attestation on the device. If omitted or if the value matches the cached attestation, the system returns the cached attestation. To request a new attestation, provide a new freshness code. Requests for new attestations are rate limited. If it's fewer than 7 days since the system generated an attestation, the device returns the cached attestation rather than generating a new one.
See the hardware requirements for attestation below.
responsekeys:
- key: QueryResponses
type: <dictionary>
presence: required
content: A dictionary that contains information about the device.
subkeys:
- key: UDID
type: <string>
content: The unique identifier of the device.
- key: ProvisioningUDID
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.3'
accessrights: n/a
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The device identifier to use in provisioning profiles. This value differs
from the UDID on a Mac with Apple silicon.
- key: OrganizationInfo
supportedOS:
iOS:
introduced: '7.0'
macOS:
introduced: '10.11'
tvOS:
introduced: '9.0'
type: <dictionary>
content: The contents of `OrganizationInfo`.
subkeys:
- key: OrganizationName
type: <string>
presence: required
content: A string that describes the organization operating the MDM server.
- key: OrganizationAddress
type: <string>
presence: optional
content: The organization's address. Use the LF character (`&#10`) to insert
line breaks.
- key: OrganizationPhone
type: <string>
presence: optional
content: The organization's phone number.
- key: OrganizationEmail
type: <string>
presence: optional
content: The organization's support email address.
- key: OrganizationMagic
type: <string>
presence: optional
content: A unique identifier for the various services a single organization
manages.
- key: MDMOptions
supportedOS:
iOS:
introduced: '7.0'
macOS:
introduced: '11.0'
tvOS:
introduced: '9.0'
type: <dictionary>
content: The contents of `MDMOptions`.
subkeys:
- key: ActivationLockAllowedWhileSupervised
supportedOS:
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If `true`, a supervised device registers itself with Activation Lock
when the user enables Find My. Unsupervised devices ignore this value.
- key: BootstrapTokenAllowed
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If `true`, the server supports Bootstrap Token commands.
- key: PromptUserToAllowBootstrapTokenForAuthentication
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
presence: optional
default: false
content: If `true`, the device can accept a Bootstrap Token from the MDM server
instead of prompting for user authentication prior to installation. This only
applies when `BootstrapTokenAllowedForAuthentication` is `true` in the `SecurityInfo`
response. This value is available for a Mac with Apple silicon in macOS 11
and later.
- key: LastCloudBackupDate
supportedOS:
iOS:
introduced: '8.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <date>
content: The date of the last iCloud backup.
- key: AwaitingConfiguration
supportedOS:
iOS:
introduced: '9.0'
macOS:
introduced: '10.11'
tvOS:
introduced: '10.2'
visionOS:
introduced: '2.0'
type: <boolean>
content: |-
If `true` on the device channel, the device is still waiting for a `Device-Configured-Command` command to continue through Setup Assistant.
If `true` on the user channel (Shared iPad only), the device is still waiting for a `User-Configured-Command` command to continue through Setup Assistant and finish login.
- key: iTunesStoreAccountIsActive
supportedOS:
iOS:
introduced: '7.0'
macOS:
introduced: '10.9'
tvOS:
introduced: '9.0'
visionOS:
introduced: n/a
type: <boolean>
content: If `true`, the device has an active iTunes Store account. Requires the
App Installation access right.
- key: iTunesStoreAccountHash
supportedOS:
iOS:
introduced: '8.0'
macOS:
introduced: '10.10'
tvOS:
introduced: '9.0'
visionOS:
introduced: n/a
type: <string>
content: A hash of the logged-in iTunes Store account. Also see `GetVppUserRequest`.
Requires the App Installation access right.
- key: DeviceName
type: <string>
content: The device name. Requires the Device Information access right.
- key: OSVersion
type: <string>
content: The operating system version. Requires the Device Information access
right.
- key: SupplementalOSVersionExtra
supportedOS:
iOS:
introduced: '16.1'
macOS:
introduced: '13.0'
tvOS:
introduced: '16.1'
type: <string>
content: The OS update Background Security Improvement version letter.
- key: BuildVersion
type: <string>
content: The operating system version. Requires the Device Information access
right.
- key: SupplementalBuildVersion
supportedOS:
iOS:
introduced: '16.1'
macOS:
introduced: '13.0'
tvOS:
introduced: '16.1'
type: <string>
content: The supplemental OS build version.
- key: ModelName
type: <string>
content: The model name, such as _iPhone_. Requires the Device Information access
right.
- key: Model
supportedOS:
visionOS:
introduced: n/a
type: <string>
content: The model. Requires the Device Information access right.
- key: ModelNumber
type: <string>
content: The device's hardware model number including region info, for example,
`MK1A3LL/A`. Requires the Device Information access right. Requires a Mac with
Apple silicon on macOS.
- key: IsAppleSilicon
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '12.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the macOS device uses an Apple silicon chip.
- key: ProductName
type: <string>
content: The product name, such as _iPad8,12_. Requires the Device Information
access right.
- key: SerialNumber
type: <string>
content: The serial number. Requires the Device Information access right.
- key: DeviceCapacity
supportedOS:
tvOS:
introduced: n/a
type: <real>
content: The total capacity in floating-point base-10 gigabytes (GB) on iOS and
macOS 12 or later. The capacity is in base-2 gibibytes (GiB) on macOS 11 and
earlier. Requires the Device Information access right.
- key: AvailableDeviceCapacity
supportedOS:
tvOS:
introduced: n/a
type: <real>
content: The available capacity in floating-point base-10 gigabytes (GB) in iOS
and macOS 12 or later. The capacity is in base-2 gibibytes (GiB) in macOS 11
and earlier. Requires the Device Information access right.
- key: IMEI
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The International Mobile Equipment Identity (IMEI) number. Requires the
Device Information access right. Available as of iOS 4 and deprecated in iOS
16.
- key: MEID
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The mobile equipment identifier (MEID) number. Requires the Device Information
access right. Available as of iOS 4 and deprecated in iOS 16.
- key: ModemFirmwareVersion
supportedOS:
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The modem firmware version. Requires the Device Information access right.
- key: CellularTechnology
supportedOS:
iOS:
introduced: 4.2.6
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <integer>
rangelist:
- 0
- 1
- 2
- 3
content: |-
The cellular technology type, which is one of the following values:
- `0`: None
- `1`: GSM
- `2`: CDMA
- `3`: GSM and CDMA
Requires the Device Information access right.
- key: BatteryLevel
supportedOS:
iOS:
introduced: '5.0'
macOS:
introduced: '13.3'
tvOS:
introduced: n/a
type: <real>
content: The battery level, between `0.0` and `1.0`, or `-1.0` if MDM can't determine
the battery level. Requires the Device Information access right.
- key: HasBattery
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '13.3'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the device has an internal battery.
- key: IsSupervised
supportedOS:
iOS:
introduced: '6.0'
macOS:
introduced: '10.15'
tvOS:
introduced: '9.0'
type: <boolean>
content: If `true`, it's a supervised device. Requires the Device Information
access right.
- key: IsMultiUser
supportedOS:
iOS:
introduced: '9.3'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the device is a Shared iPad. Requires the Device Information
access right.
- key: IsDeviceLocatorServiceEnabled
supportedOS:
iOS:
introduced: '7.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <boolean>
content: If `true`, the device has enabled a device locator service, such as Find
My. Requires the Device Information access right.
- key: IsActivationLockEnabled
supportedOS:
iOS:
introduced: '7.0'
deprecated: '16.0'
macOS:
introduced: '10.9'
deprecated: '13.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
deprecated: '10.0'
type: <boolean>
content: If `true`, the device has enabled Activation Lock. Requires the Device
Information access right. Available as of iOS 7 and macOS 10.9, and deprecated
in iOS 16 and macOS 13.
- key: IsActivationLockSupported
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the device supports Activation Lock. Also see `IsActivationLockManageable`
in `ManagementStatus`.
- key: IsDoNotDisturbInEffect
supportedOS:
iOS:
introduced: '7.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <boolean>
content: If `true`, the device is in Do Not Disturb (DND) mode. This value is
`true` even if DND is only in effect for a locked device. Requires the Device
Information access right.
- key: SupportsLOMDevice
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the device can receive `PowerON`, `PowerOFF`, and `Reset`
commands from a lights-out management (LOM) controller.
- key: DeviceID
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: n/a
tvOS:
introduced: '9.0'
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The device identifier. Requires the Device Information access right.
- key: EASDeviceIdentifier
supportedOS:
iOS:
introduced: '7.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The device identifier for Exchange Active Sync (EAS). Requires the Device
Information access right.
- key: IsCloudBackupEnabled
supportedOS:
iOS:
introduced: '7.1'
macOS:
introduced: n/a
tvOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the device has enabled iCloud backup. Requires the Device
Information access right.
- key: ActiveManagedUsers
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <array>
content: An array of the directory GUIDs of the logged-in managed users. If one
of these users is currently logged in to the console, the `CurrentConsoleManagedUser`
key returns the GUID of that user. Requires the Device Information access right.
subkeys:
- key: ActiveManagedUsersItems
type: <string>
- key: OSUpdateSettings
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
deprecated: '26.0'
removed: '27.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
content: |-
The contents of ``OSUpdateSettings-dictionary``. Requires the Device Information access right.
Removed: use the declarative management `com.apple.configuration.softwareupdate.settings` configuration to set values.
subkeys:
- key: CatalogURL
type: <string>
presence: optional
content: The URL to the software update catalog the client is using.
- key: IsDefaultCatalog
type: <boolean>
content: If `true`, `CatalogURL` is the default catalog.
- key: PreviousScanDate
type: <date>
content: The date of the last software update scan.
- key: PreviousScanResult
supportedOS:
macOS:
deprecated: '11.0'
removed: '15.0'
type: <string>
presence: optional
content: The result code of last software update scan; `0` = success.
- key: PerformPeriodicCheck
type: <boolean>
content: If `true`, start a new scan.
- key: AutoCheckEnabled
type: <boolean>
content: The preference to automatically check for app updates.
- key: BackgroundDownloadEnabled
type: <boolean>
content: The preference to download app updates in the background.
- key: AutomaticAppInstallationEnabled
type: <boolean>
content: The preference to automatically install app updates.
- key: AutomaticOSInstallationEnabled
type: <boolean>
content: The preference to automatically install operating system updates.
- key: AutomaticSecurityUpdatesEnabled
type: <boolean>
content: The preference to automatically install system data files and security
updates.
- key: LocalHostName
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The local host name from Bonjour.
- key: HostName
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The host name.
- key: AutoSetupAdminAccounts
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.11'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <array>
content: The contents of ``AutoSetupAdminAccountsItem``, which Setup Assistant
automatically creates during ADE enrollment. Requires the Device Information
access right.
subkeys:
- key: AutoSetupAdminAccountsItem
type: <dictionary>
content: The response dictionary that contains the administrator setup information.
subkeys:
- key: GUID
type: <string>
content: The `GeneratedUID` of the administrator account.
- key: shortName
type: <string>
content: The short name of the administrator account.
- key: SystemIntegrityProtectionEnabled
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.12'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the device has enabled System Integrity Protection. Requires
the Device Information access right.
- key: IsMDMLostModeEnabled
supportedOS:
iOS:
introduced: '9.3'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
type: <boolean>
content: If `true`, the device has enabled Managed Lost Mode. Requires the Device
Information access right.
- key: MaximumResidentUsers
supportedOS:
iOS:
introduced: '9.3'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <integer>
content: The maximum number of users that can use this Shared iPad device. Starting
with iOS 13.4, the value that returns is always `32`. Requires the Device Information
access right.
- key: EstimatedResidentUsers
supportedOS:
iOS:
introduced: '14.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <integer>
content: The estimated number of users that can use this Shared iPad device, according
to the space available on the device and each user's quota. Requires the Device
Information access right.
- key: QuotaSize
supportedOS:
iOS:
introduced: '13.4'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <integer>
content: The quota size in megabytes for each user on this Shared iPad device.
Requires the Device Information access right.
- key: ResidentUsers
supportedOS:
iOS:
introduced: '13.4'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <integer>
content: The number of users currently on this Shared iPad device. Requires the
Device Information access right.
- key: UserSessionTimeout
supportedOS:
iOS:
introduced: '14.5'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <integer>
content: The timeout interval for the user session. A value of `0` indicates that
there's no timeout.
- key: TemporarySessionTimeout
supportedOS:
iOS:
introduced: '14.5'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <integer>
content: The timeout interval for the temporary session. A value of `0` indicates
that there's no timeout.
- key: TemporarySessionOnly
supportedOS:
iOS:
introduced: '14.5'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the device allows only temporary sessions.
- key: ManagedAppleIDDefaultDomains
supportedOS:
iOS:
introduced: '16.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <array>
content: The list of domains that the device suggests on the Shared iPad login
screen.
subkeys:
- key: AppleID domain
type: <string>
- key: OnlineAuthenticationGracePeriod
supportedOS:
iOS:
introduced: '16.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <integer>
content: The grace period for Shared iPad online authentication (in days). A value
of `0` indicates that the device requires online authentication for every login.
- key: SkipLanguageAndLocaleSetupForNewUsers
supportedOS:
iOS:
introduced: '16.2'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, skip the language and country/region panes for new users on
Shared iPad.
- key: PushToken
supportedOS:
iOS:
introduced: '9.3'
macOS:
introduced: '10.12'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <data>
content: The push token for the user-channel connection, in the same format as
in `TokenUpdateRequest`. MDM ignores this query for the device channel. Requires
the Device Information access right.
- key: DiagnosticSubmissionEnabled
supportedOS:
iOS:
introduced: '9.3'
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <boolean>
content: If `true`, the device has enabled diagnostic submission. Requires the
Device Information access right.
- key: AppAnalyticsEnabled
supportedOS:
iOS:
introduced: '9.3'
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <boolean>
content: If `true`, the device is sharing app analytics. Requires the Device Information
access right.
- key: TimeZone
supportedOS:
iOS:
introduced: '14.0'
macOS:
introduced: n/a
tvOS:
introduced: '14.0'
type: <string>
content: The current Internet Assigned Numbers Authority (IANA) time zone database
name. Requires the Device Information access right.
- key: ICCID
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The integrated circuit card (ICC) identifier for the installed SIM card.
Requires the Network Information access right. Available as of iOS 4 and deprecated
in iOS 16.
- key: BluetoothMAC
supportedOS:
watchOS:
introduced: n/a
type: <string>
content: The Bluetooth media access control (MAC) address. Requires the Network
Information access right.
- key: WiFiMAC
type: <string>
content: The Wi-Fi MAC address. Requires the Network Information access right.
- key: EthernetMAC
supportedOS:
iOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The primary Ethernet MAC address. Requires the Network Information access
right.
- key: CurrentCarrierNetwork
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The name of the current carrier network. Requires the Network Information
access right. Available as of iOS 4 and deprecated in iOS 16.
- key: SIMCarrierNetwork
supportedOS:
iOS:
removed: '5.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: Apple no longer supports this query. Use `SubscriberCarrierNetwork` instead.
- key: SubscriberCarrierNetwork
supportedOS:
iOS:
introduced: '5.0'
deprecated: '16.0'
removed: '26.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The name of the home carrier network. Requires the Network Information
access right. Available as of iOS 5 and deprecated in iOS 16.
- key: CarrierSettingsVersion
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The version of the carrier settings. Requires the Network Information
access right. Available as of iOS 4 and deprecated in iOS 16.
- key: PhoneNumber
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The raw phone number without punctuation and including the country code.
Requires the Network Information access right. Available as of iOS 4 and deprecated
in iOS 16.
- key: DataRoamingEnabled
supportedOS:
iOS:
introduced: '5.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the device has enabled data roaming. Requires the Network
Information access right.
- key: VoiceRoamingEnabled
supportedOS:
iOS:
introduced: '5.0'
deprecated: '16.0'
removed: '26.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the device has enabled voice roaming, which isn't available
for all carriers. Requires the Network Information access right. Requires the
Device Information access right. Available as of iOS 5 and deprecated in iOS
16.
- key: PersonalHotspotEnabled
supportedOS:
iOS:
introduced: '7.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true,` the device has enabled Personal Hotspot, which isn't available
for all carriers. Requires the Network Information access right.
- key: IsNetworkTethered
supportedOS:
iOS:
introduced: '10.3'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the device is network-tethered. Requires the Network Information
access right.
- key: IsRoaming
supportedOS:
iOS:
introduced: '4.2'
deprecated: '16.0'
removed: '26.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the device is roaming. Requires the Network Information access
right. IAvailable as of iOS 4.2 and deprecated in iOS 16.
- key: SIMMCC
supportedOS:
iOS:
removed: 4.2.6
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: Apple no longer supports this query. Use `SubscriberMCC` instead.
- key: SIMMNC
supportedOS:
iOS:
removed: 4.2.6
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: Apple no longer supports this query. Use `SubscriberMNC` instead.
- key: SubscriberMCC
supportedOS:
iOS:
introduced: 4.2.6
deprecated: '16.0'
removed: '26.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The home Mobile Country Code (MCC). Requires the Network Information
access right. Available as of iOS 4.2.6 and deprecated in iOS 16.
- key: SubscriberMNC
supportedOS:
iOS:
introduced: 4.2.6
deprecated: '16.0'
removed: '26.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The key to get the home Mobile Network Code (MNC). Requires the Network
Information access right. Available as of iOS 4.2.6 and deprecated in iOS 16.
- key: CurrentMCC
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The current mobile country code (MCC). Requires the Network Information
access right. Available as of iOS 4 and deprecated in iOS 16.
- key: CurrentMNC
supportedOS:
iOS:
deprecated: '16.0'
removed: '26.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: The current mobile network code (MNC). Requires the Network Information
access right. Available as of iOS 4 and deprecated in iOS 16.
- key: ServiceSubscriptions
supportedOS:
iOS:
introduced: '12.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <array>
content: The contents of ``ServiceSubscriptionProperty``. Requires the Network
Information access right.
subkeys:
- key: ServiceSubscriptionProperty
type: <dictionary>
content: Properties of this Service Subscription. See below.
subkeys:
- key: CarrierSettingsVersion
type: <string>
content: The version of the carrier settings.
- key: CurrentCarrierNetwork
type: <string>
content: The name of the current carrier network.
- key: CurrentMCC
type: <string>
content: The current mobile country code (MCC).
- key: CurrentMNC
type: <string>
content: The current mobile network code (MNC).
- key: ICCID
type: <string>
content: The integrated circuit card identifier (ICCID) value.
- key: EID
supportedOS:
iOS:
introduced: '14.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <string>
content: The eSIM identifier.
- key: IMEI
type: <string>
content: The device International Mobile Equipment Identity (IMEI) number.
- key: IsDataPreferred
type: <boolean>
content: If `true`, this subscription is the preference for data.
- key: IsRoaming
type: <boolean>
content: If `true`, the phone is roaming.
- key: IsVoicePreferred
type: <boolean>
content: If `true`, this subscription is the preference for voice.
- key: Label
type: <string>
content: The label of this subscription.
- key: LabelID
type: <string>
content: The unique identifier for this subscription.
- key: MEID
type: <string>
content: The device Mobile Equipment Identifier (MEID) number.
- key: PhoneNumber
type: <string>
content: The raw phone number without punctuation and including country code.
- key: Slot
type: <string>
content: The description of the slot that contains the SIM representing this
subscription.
- key: SubscriberCarrierNetwork
supportedOS:
iOS:
introduced: '16.0'
macOS:
introduced: n/a
tvOS:
introduced: n/a
type: <string>
content: The name of the home carrier network.
- key: PINRequiredForEraseDevice
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the `EraseDeviceCommand` requires a PIN.
- key: PINRequiredForDeviceLock
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the `DeviceLockCommand` requires a PIN.
- key: SupportsiOSAppInstalls
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '11.0'
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the device supports iOS or iPadOS app installs through MDM.
- key: SoftwareUpdateDeviceID
supportedOS:
iOS:
introduced: '15.0'
deprecated: '26.0'
removed: '27.0'
userenrollment:
mode: forbidden
macOS:
introduced: '12.0'
deprecated: '26.0'
removed: '27.0'
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
deprecated: '26.0'
removed: '27.0'
userenrollment:
mode: forbidden
watchOS:
introduced: n/a
type: <string>
content: |-
The device identifier to look up available OS updates through [https://gdmf.apple.com/v2/pmv](https://gdmf.apple.com/v2/pmv).
Removed: subscribe to the declarative management `softwareupdate.device-id` status item.
- key: SoftwareUpdateSettings
supportedOS:
iOS:
introduced: '14.5'
deprecated: '26.0'
removed: '27.0'
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <dictionary>
content: |-
The device settings that control which updates appear in the Software Update pane in Settings.
Removed: use the declarative management `com.apple.configuration.softwareupdate.settings` configuration to set values.
subkeys:
- key: RecommendationCadence
type: <integer>
content: |-
Which software updates to present to the user.
- `0`: Allows all updates (the default value).
- `1`: Allows only older updates.
- `2`: Allows only newer updates.
No effect if the device qualifies for only a single update.
- key: AccessibilitySettings
supportedOS:
iOS:
introduced: '16.0'
supervised: true
sharedipad:
mode: allowed
devicechannel: false
userenrollment:
mode: forbidden
macOS:
introduced: n/a
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
supervised: true
type: <dictionary>
content: The current state of settable accessibility settings.
subkeys:
- key: BoldTextEnabled
type: <boolean>
content: If `true`, the device has enabled bold text.
- key: IncreaseContrastEnabled
supportedOS:
watchOS:
introduced: n/a
type: <boolean>
content: If `true`, the device has enabled increase contrast.
- key: ReduceMotionEnabled
type: <boolean>
content: If `true`, the device has enabled reduced motion.
- key: ReduceTransparencyEnabled
type: <boolean>
content: If `true`, the device has enabled reduced transparency.
- key: TextSize
type: <integer>
rangelist:
- -1
- 0
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
content: |-
The accessibility text size apps that support dynamic text use. 0 is the smallest value, and 11 is the largest available.
`-1` indicates that the current size is unknown or hasn't been explicitly set.
- key: TouchAccommodationsEnabled
type: <boolean>
content: If `true`, the device has enabled touch accommodations.
- key: VoiceOverEnabled
type: <boolean>
content: If `true`, the device has enabled voiceover.
- key: ZoomEnabled
type: <boolean>
content: If `true`, the device has enabled zoom.
- key: GrayscaleEnabled
supportedOS:
iOS:
introduced: n/a
type: <boolean>
content: If `true`, the device has enabled grayscale display.
- key: DevicePropertiesAttestation
supportedOS:
iOS:
introduced: '16.0'
userenrollment:
mode: allowed
macOS:
introduced: '14.0'
tvOS:
introduced: '16.0'
visionOS:
userenrollment:
mode: allowed
type: <array>
content: |-
The key to get an attestation of the device's properties. See the hardware requirements for attestation below.
The value is an array of certificates in DER form that forms a certificate chain. The chain is rooted with the Apple CA `Apple Enterprise Attestation Root CA`. The first array item is the leaf certificate. The leaf certificate contains custom OIDs describing a device. The OS version of the device, and the type of enrollment, determine which OIDs are present in the certificate. If Apple's attestation servers are unable to verify a device property they generate a blank value, omit the OID entirely, or refuse to issue an attestation certificate.
The following OIDs were introduced in iOS 16, iPadOS 16, tvOS 16, watchOS 10, visionOS 1 and macOS 14:
- `1.2.840.113635.100.8.9.1` serial number: This is the serial number of the device. It's omitted if the enrollment is a user enrollment.
- `1.2.840.113635.100.8.9.2` UDID: For a Mac this has the same value as the `ProvisioningUDID` key, and doesn't match the UDID used elsewhere in the MDM protocol. It's omitted if the enrollment is a user enrollment.
- `1.2.840.113635.100.8.10.2` sepOS version: This is the version of the operating system running on the Secure Enclave when the attestation is generated. Typically this matches the version of the main operating system.
- `1.2.840.113635.100.8.11.1` Freshness code: This is the freshness code. See the `DeviceAttestationNonce`. This may not match the requested freshness code if the device returned a cached attestation.
The following OIDs were introduced in iOS 17.2, iPadOS 17.2, tvOS 17.2, watchOS 10.2, visionOS 1.l0, and macOS 14.2:
- `1.2.840.113635.100.8.9.4` Software Update Device ID: This is an identifier of the device model. It's expected to match the `SoftwareUpdateDeviceID` in the `DeviceInformation`` response. This is the device identifier to use when looking up available OS updates through <https://gdmf.apple.com/v2/pmv>.
- `1.2.840.113635.100.8.10.1` OS Version: This is the version of iOS, iPadOS or tvOS running on the device when the attestation is generated.
- `1.2.840.113635.100.8.10.3` LLB Version: This is the version of the Low Level Bootloader firmware running on the device when the attestation is generated. For more information about the boot process, see the documentation of the boot process in the Apple Platform Security guide.
The following OIDs were introduced in macOS 14.2:
- `1.2.840.113635.100.8.13.1` System Integrity Protection (SIP) status: This indicates whether SIP is enabled or disabled when the attestation is generated. `0` indicates enabled, `1` indicates disabled.
- `1.2.840.113635.100.8.13.2` Secure boot status: This describes part of the configuration of the LocalPolicy when the attestation is generated. The values are `Full Security`, `Reduced Security`, or `Permissive Security`. For a description of these values see the Apple Platform Security guide.
- `1.2.840.113635.100.8.13.3` Third party kernel extensions allowed: This indicates whether third party kernel extensions are allowed. A value of `0` indicates third party kernel extensions aren't allowed. Any other value means that some kinds of third party kernel extensions are allowed.
subkeys:
- key: AttestationCertificate
type: <data>
- key: EACSPreflight
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '13.3'
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
type: <string>
content: |-
Specifies whether the device can perform an `EraseDeviceCommand` using Erase All Content and Settings (EACS), which is one of the following values:
* `success`: The device supports EACS.
* `not supported`: The device is too old to support EACS.
* `unknown failure`: A problem occurred for which there isn't a more specific error message.
* `(other string)`: A reason why the device can't perform EACS, such as "System is not sealed"
notes:
- title: ''
content: Refer to the following sections to determine supported channels and requirements,
and to see an example request and response.
- title: DeviceInformation attestation hardware support
content: |-
The following table indicates which System on Chips (SoCs) support DeviceInformation attestation.
Unsupported devices ignore the DevicePropertiesAttestation and DeviceAttestationNonce keys.
| Support status | iPhone, iPad | Mac | Apple TV | Apple Watch | Vision Pro |
|----------------|--------------------------------------|---------------|-------------------------|----------------|------------|
| Unsupported | A10x Fusion and earlier | Intel | A10x Fusion and earlier | S3 and earlier | none |
| Supported | A11 Bionic and later<br>All M series | Apple silicon | A12 Bionic and later | S4 and later | All |
examples:
- title: Example request and response
files:
- request-file: examples/mdm/commands/information.device/example1.plist
response-file: examples/mdm/commands/information.device/example2.plist
Reference in New Issue View Git Blame Copy Permalink