apple_device-management/mdm/profiles/com.apple.MCX.FileVault2.yaml

title: FDE FileVault
description: The payload that configures FileVault.
payload:
  payloadtype: com.apple.MCX.FileVault2
  supportedOS:
    iOS:
      introduced: n/a
    macOS:
      introduced: '10.9'
      multiple: false
      devicechannel: true
      userchannel: false
      requiresdep: false
      userapprovedmdm: true
      allowmanualinstall: true
      userenrollment:
        mode: forbidden
    tvOS:
      introduced: n/a
    visionOS:
      introduced: n/a
    watchOS:
      introduced: n/a
  content: The FileVault payload only works on macOS to enable or disable FileVault.
    Starting with macOS 10.15, this payload requires UAMDM to enable FileVault.
payloadkeys:
- key: Enable
  type: <string>
  presence: required
  rangelist:
  - 'On'
  - 'Off'
  content: Set to `On` to enable FileVault and set to `Off` to disable FileVault.
    Payloads set to `On` sent through MDM need to either include full authentication
    information in the payload or have the `Defer` option set to `true`. When `Defer`
    is `true`, the system prompts for the authentication information when the user
    enables FileVault.
- key: Defer
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system defers enabling FileVault until the designated user
    logs out. For details, see `fdesetup(8)`. Only a local user or a mobile account
    user can enable FileVault.
- key: UserEntersMissingInfo
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system enables a prompt for missing user name or password
    fields.
- key: UseRecoveryKey
  type: <boolean>
  presence: optional
  default: true
  content: If `true`, the system creates a personal recovery key and displays it to
    the user.
- key: ShowRecoveryKey
  type: <boolean>
  presence: optional
  default: true
  content: If `false`, the system prevents display of the personal recovery key to
    the user after the system enables FileVault.
- key: OutputPath
  type: <string>
  presence: optional
  content: The path to the location of the recovery key and computer information property
    list.
- key: Certificate
  type: <data>
  presence: optional
  content: The DER-encoded certificate data if the system creates an institutional
    recovery key. This key isn't supported on a Mac with Apple silicon.
- key: PayloadCertificateUUID
  type: <string>
  presence: optional
  content: The UUID of the payload within the same profile containing the asymmetric
    recovery key certificate payload.
- key: Username
  type: <string>
  presence: optional
  content: The user name of the Open Directory user to add to FileVault.
- key: Password
  type: <string>
  presence: optional
  content: The password of the Open Directory user to add to FileVault. Use the `UserEntersMissingInfo`
    key to prompt for this information.
- key: UseKeychain
  type: <boolean>
  presence: optional
  default: false
  content: If `true` and you don't include certificate information in this payload,
    the system uses the keychain created at `/Library/Keychains/FileVaultMaster.keychain`
    when it adds the institutional recovery key.
- key: DeferForceAtUserLoginMaxBypassAttempts
  type: <integer>
  presence: optional
  range:
    min: -1
    max: 9999
  content: The maximum number of times users can bypass enabling FileVault before
    the system requires the user to enable it to log in. If the value is `0`, the
    system requires the user to enable FileVault the next time they attempt to log
    in. Set this key to `-1` to disable this feature.
- key: DeferDontAskAtUserLogout
  supportedOS:
    macOS:
      introduced: '10.10'
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system prevents requests to enable FileVault at user logout
    time.
- key: ForceEnableInSetupAssistant
  supportedOS:
    macOS:
      introduced: '14.0'
      requiresdep: true
      allowmanualinstall: false
  type: <boolean>
  presence: optional
  default: false
  content: |-
    If `true`, and installation of this payload occurs after enrolling with MDM in Setup Assistant, the system requests Setup Assistant to enable FileVault at setup time.

    To use this, enable the Await Device Configured ADE configuration option and send this profile with this key set, before sending the `DeviceConfiguredCommand`.

    An admin SecureToken user is required, otherwise the FileVault pane doesn't appear.
notes:
- title: ''
  content: |-
    FileVault 2 performs full XTS-AES 128 encryption on the contents of a volume. Removing the FileVault payload doesn't disable FileVault.

    As of macOS 10.15, FileVault settings require supervision or user approval when installed manually.
examples:
- title: Profile example
  files:
  - file: examples/mdm/profiles/com.apple.MCX.FileVault2/example1.plist