Files
apple_device-management/mdm/profiles/com.apple.security.FDERecoveryRedirect.yaml
T
2026-08-12 10:12:50 -04:00

53 lines
2.3 KiB
YAML

title: FDE Recovery Key Redirection
description: The payload that configures FileVault recovery key redirection.
payload:
payloadtype: com.apple.security.FDERecoveryRedirect
supportedOS:
iOS:
introduced: n/a
macOS:
introduced: '10.9'
deprecated: '10.13'
multiple: false
devicechannel: true
userchannel: false
requiresdep: false
userapprovedmdm: false
allowmanualinstall: true
userenrollment:
mode: forbidden
tvOS:
introduced: n/a
visionOS:
introduced: n/a
watchOS:
introduced: n/a
content: |-
This payload will be ignored on macOS 10.13 and later. See "com.apple.security.FDERecoveryKeyEscrow" payload.
Old notes:
Once installed, this payload will cause any FDE (Full Disk Encryption) recovery keys to be redirected to the specified URL instead of being sent to Apple. This will require sites to implement their own HTTPS server that will receive the recovery keys via a POST request. Details of the data sent to the server will be provided in a different document.
Notes:
* The payload must exist in a "system" scoped profile.
* It will be an error to install more than one payload of this type per machine.
payloadkeys:
- key: RedirectURL
type: <string>
presence: required
content: The URL to which the device sends FDE recovery keys instead of to Apple.
The URL must begin with https://.
- key: EncryptCertPayloadUUID
type: <string>
presence: required
content: The UUID of a payload within the same profile that contains a certificate
used to encrypt the recovery key when the device sends it to the redirected URL.
The referenced payload must be of type \`com.apple.security.pkcs1\`.
notes:
- title: ''
content: |-
Although the previous FDE Recovery payload is no longer supported in macOS 10.13 and later, it's still supported in macOS 10.9 through 10.12. When installed, this payload causes any FDE recovery keys to be redirected to the specified URL instead of being sent to Apple. This requires sites to implement their own HTTPS server to receive the recovery keys through a POST request.
Note these cautions:
- The payload must exist in a system-scoped profile.
- Installing more than one payload of this type per machine results in an error.