CalvinBackup/apple_device-management
1
0
Fork 0
mirror of https://github.com/apple/device-management.git synced 2026-08-13 12:00:21 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
61449b07e22d7d659aaa9ae65a29688cff3902a2
apple_device-management/mdm/profiles/com.apple.education.yaml
T
Cyrus Daboo 97a11a861f Seed2
2026-06-22 15:55:19 -04:00

327 lines
13 KiB
YAML
Raw Blame History

title: Education Configuration
description: The payload that configures the users, groups, and departments within
an educational organization.
payload:
payloadtype: com.apple.education
supportedOS:
iOS:
introduced: '9.3'
multiple: false
supervised: false
allowmanualinstall: true
sharedipad:
mode: allowed
devicechannel: true
userchannel: false
userenrollment:
mode: allowed
macOS:
introduced: '10.14'
multiple: false
devicechannel: false
userchannel: true
supervised: false
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: allowed
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: This payload is used to configure Classroom students, Classroom instructors,
and the Shared iPad login screen. These do not necessarily require the same set
of keys to be present in their payloads, so make sure to include all keys that
are required for the education product you are configuring.
payloadkeys:
- key: OrganizationUUID
type: <string>
presence: required
content: The organization's UUID identifier. This identifier can be any valid UUID.
All teacher and student devices that need to communicate with one another must
have the same organization UUID, particularly if they originated from different
Device Enrollment Programs.
- key: OrganizationName
type: <string>
presence: required
content: The organization's display name. The system displays this name in the iOS
login screen.
- key: PayloadCertificateUUID
type: <string>
presence: optional
content: |-
The UUID of an identity certificate payload within the same profile to use for performing client authentication with other devices. This property supports PKCS12 certificates.
Required to configure Classroom. Has no effect on the configuration of the Shared iPad login screen.
- key: LeaderPayloadCertificateAnchorUUID
type: <array>
presence: optional
content: |-
The array of UUIDs referring to certificate payloads within the same profile that the system uses to authorize leader peer certificate identities. This array needs to contain all necessary certificates to validate the entire chain of trust. Leader certificates needs to have the common name prefix leader, which is case insensitive.
This property doesn't support identity payloads or PKCS12 certificates.
Required when configuring a student device for Classroom, and ignored when configuring an instructor device. Has no effect on the configuration of the Shared iPad login screen.
subkeys:
- key: LeaderPayloadCertificateAnchorUUIDItem
type: <string>
presence: required
content: A certificate payload UUID.
- key: MemberPayloadCertificateAnchorUUID
type: <array>
presence: optional
content: |-
The array of UUIDs referring to certificate payloads within the same profile that the system uses to authorize group member peer certificate identities. This array must contain all certificates needed to validate the entire chain of trust. Member certificates must have the common name prefix member (case insensitive).
This property doesn't support identity payloads or PKCS12 certificates.
Required when configuring a student device for Classroom, and ignored when configuring an instructor device. Has no effect on the configuration of the Shared iPad login screen.
subkeys:
- key: MemberPayloadCertificateAnchorUUIDItem
type: <string>
presence: required
content: A certificate payload UUID.
- key: ResourcePayloadCertificateUUID
type: <string>
presence: optional
content: |-
The UUID of an identity certificate payload within the same profile that the system uses to perform client authentication when fetching additional resources, such as student images.
If set, the system uses this key to configure both Classroom and the Shared iPad login screen. If not set, the system uses MDM client identity.
- key: UserIdentifier
type: <string>
presence: required
content: |-
The unique string that identifies the user of this device within the organization.
Don't set this value in payloads intended to configure the Shared iPad login screen.
- key: Departments
type: <array>
presence: optional
content: _For Shared iPad profiles:_ The array of dictionaries that defines which
departments the system displays in the Shared iPad login screen. If set, the system
uses this key to configure both Classroom and the Shared iPad login screen.
subkeys:
- key: DepartmentsItem
type: <dictionary>
content: A department in the organization.
subkeys:
- key: Name
type: <string>
presence: required
content: The display name of the department.
- key: GroupBeaconIDs
type: <array>
presence: required
content: The group beacon identifiers that are members of this department.
subkeys:
- key: GroupBeaconIDsItem
type: <integer>
presence: required
content: A group beacon identifier.
- key: Groups
type: <array>
presence: required
content: |-
_For Shared iPad profiles:_ The array of dictionaries that defines which groups the user can select in the Login Window.
_For leader/teacher profiles:_ The array of dictionaries that defines the groups that the user can control.
_For member/student profiles:_ The array of dictionaries that defines the groups where the user is a member.
subkeys:
- key: GroupsItem
type: <dictionary>
content: An array of dictionaries defining groups.
subkeys:
- key: BeaconID
type: <integer>
presence: required
content: An unsigned 16 bit integer specifying this group's unique beacon ID.
- key: Name
type: <string>
presence: required
content: The display name of the group.
- key: Description
type: <string>
presence: optional
content: The description of the group.
- key: ImageURL
supportedOS:
iOS:
deprecated: 9.3.1
macOS:
introduced: n/a
type: <string>
presence: optional
content: Deprecated in iOS 9.3.1 and later. The URL of an image for the group.
- key: ConfigurationSource
type: <string>
presence: optional
content: The source that provided this group, such as SIS, or MDM.
- key: LeaderIdentifiers
type: <array>
presence: optional
content: The user identifiers that are leaders of this group.
subkeys:
- key: LeaderIdentifiersItem
type: <string>
presence: required
content: A user identifier.
- key: MemberIdentifiers
type: <array>
presence: required
content: The entries in the Users array that are members of the group.
subkeys:
- key: MemberIdentifiersItem
type: <string>
presence: required
content: A member identifier.
- key: DeviceGroupIdentifiers
type: <array>
presence: optional
content: |-
The identifiers that refer to entries in the `DeviceGroups` array to which the instructor can assign users from this class.
Has no effect on the configuration of the Shared iPad login screen.
subkeys:
- key: DeviceGroupIdentifiersItem
type: <string>
presence: required
content: A device group identifier.
- key: Users
type: <array>
presence: required
content: |-
For Shared iPad profiles: The array of dictionaries that define the users that the system displays in the iOS Login Window.
_For leader/teacher profiles:_ The array of dictionaries that define users that are members of the teacher's groups.
_For member/student profiles:_ The array of dictionaries that needs to contain the definition of the user specified in the `UserIdentifier` key. With one-to-one member devices, this key should include only the device user and the teacher but not other class members.
subkeys:
- key: UsersItem
type: <dictionary>
content: A user in the organization.
subkeys:
- key: Identifier
type: <string>
presence: required
content: The unique identifier for a user in the organization.
- key: Name
type: <string>
presence: required
content: The name of the user.
- key: GivenName
type: <string>
presence: optional
content: The given name of the user.
- key: FamilyName
type: <string>
presence: optional
content: The family name of the user.
- key: PhoneticGivenName
type: <string>
presence: optional
content: The user's phonetic given name. The system uses this name to sort users
in the Classroom app and the Shared iPad Login Screen.
- key: PhoneticFamilyName
type: <string>
presence: optional
content: The user's phonetic family name. The system uses this name to sort
users in the Classroom app and the Shared iPad login screen.
- key: ImageURL
type: <string>
presence: optional
content: A string that contains a URL pointing to an image of the user. The
system displays this image in the iOS login screen and in the Classroom app.
The recommended resolution is 256 x 256 pixels (512 x 512 pixels on a 2x device).
The recommended formats are JPEG, PNG, and TIFF. The system uses the `ResourcePayloadCertificateUUID`
identity certificate or the MDM client identity to perform authentication
when fetching the image.
- key: FullScreenImageURL
supportedOS:
iOS:
deprecated: 9.3.1
macOS:
introduced: n/a
type: <string>
presence: optional
content: Deprecated in iOS 9.3.1 and later. The URL pointing to an image of
the user. The system uses the `ResourcePayloadCertificateUUID` identity certificate
or the MDM client identity to perform authentication when fetching the specified
resource.
- key: AppleID
type: <string>
presence: optional
content: |-
The Managed Apple Account for this user.
Not required to configure Classroom, but if set the system uses it.
Required to configure the Shared iPad login screen.
- key: PasscodeType
type: <string>
presence: optional
rangelist:
- complex
- four
- six
content: The type of passcode UI to show when the user is at the Login Window.
- key: DeviceGroups
type: <array>
presence: optional
content: _For leader/teacher profiles:_ The array of dictionaries that defines which
device groups the leader can assign devices to. Not included in member payloads.
subkeys:
- key: DeviceGroupsItem
type: <dictionary>
content: A device group in the organization.
subkeys:
- key: Identifier
type: <string>
presence: required
content: The unique identifier for the device group in the organization.
- key: Name
type: <string>
presence: required
content: The name of the device group, which must be unique in the organization.
- key: SerialNumbers
type: <array>
presence: required
content: The serial numbers of the devices in the group.
subkeys:
- key: SerialNumbersItem
type: <string>
presence: required
content: A serial number.
- key: ScreenObservationPermissionModificationAllowed
supportedOS:
iOS:
introduced: '10.3'
type: <boolean>
presence: optional
default: false
content: If `true`, the system allows students enrolled in managed classes to modify
their teacher's permissions for screen observation on their device.
notes:
- title: ''
content: |-
In iOS, send this payload over the device channel. Additionally, the system requires supervision unless the payload only specifies a teacher configuration.
In macOS, send this payload over the user channel. The system supports student payloads in macOS 10.14.4 and later.
Additionally, ensure:
- You configure all identities as both TLS clients and servers
- You configure all certificates with a key size of at least 2048 bits
- You configure all certificates to use a hashing algorithm of SHA256 or stronger
- You configure leader certificates to have the common name prefix "leader", which is case-insensitive
- You configure member certificates to have the common name prefix "member", which is case-insensitive
- You configure TLS server certificates issued on or after September 1, 2020 00:00 GMT/UTC to have a validity period greater than 398 days; see [About Upcoming Limits on Trusted Certificates](https://support.apple.com/en-us/HT211025) for more information.
examples:
- title: Profile example
files:
- file: examples/mdm/profiles/com.apple.education/example1.plist
Reference in New Issue View Git Blame Copy Permalink