Create an iOS/iPadOS Restrictions Policy (Preview)
This policy allows administrators to manage and enforce specific device limitations on iOS and iPadOS devices to enhance organizational security and minimize distractions. By standardizing device capabilities you can ensure a more productive work environment and protect sensitive data from unauthorized access or accidental exposure.
Prerequisites
- iOS/iPadOS devices must be enrolled in Apple MDM with the following enrollment type:
- Device-Enrolled Devices - These devices are owned by the corporation and enrolled by the admin or by the user.
- User-Enrolled Devices - These are personal devices used for work where the user enrolls the device to securely access corporate data while maintaining personal privacy.
- Auto-Enrolled Devices - These devices are owned and enrolled by the corporation through Automated Device Enrollment.
For more information see MDM Enrollment Method.
- Target devices must be running iOS/iPadOS 4 or later.
Creating the Policy
To create the policy:
- Log in to the JumpCloud Admin Portal.
Important
If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.
- Go to Device Management > Policy Management and click (+).
- On the New Policy panel select the iOS tab.
- Search and select Restrictions from the list then click configure.
- (Optional) In the Policy Name field enter a new name for the policy or keep the default. Policy names must be unique.
- (Optional) In the Policy Notes field enter details such as creation date of the policy and information on testing and deployment of the policy.
Configuring the Policy
To create a Restrictionspolicy for iOS and iPadOS devices, configure the following:
System Settings
| Property Name | Minimum Supported OS Version | Supervision | Description |
|---|---|---|---|
| Allow Account Modification | 7 | No | Select this option to allow modification of accounts such as Apple Accounts Mail Contacts and Calendar. |
| Allow Device Name Modification | 9 | Yes | Toggle this on to allow users to change the name of the device. |
| Allow Notifications Modification | 9.3 | Yes | Select this option to allow users to change how notifications appear for their apps. |
| Allow Wallpaper Modification | 9 | Yes | Enable this on to permit users to change their background image. |
| Allow Erase All Content and Settings | 8 | Yes | Toggle this on to allow the “Erase All Content and Settings” option in the device reset menu. |
| Allow Host Pairing | 7 | Yes | Select this option to allow the device to pair with any computer except for the designated supervision host. |
| Allow Manual Profile Installation in System Settings | 6 | Yes | Enable this to allow users to manually install configuration profiles and certificates. |
| Allow On-Device Restrictions | 8 | Yes | Allowed by default. Select this option to permit users to set up local Content & Privacy Restrictions within their device settings. Deselect it to ensure only remote policies deployed via MDM can control device limits. |
| Allow Over-the-Air PKI Updates | 7 | No | Select this option to enable over-the-air PKI updates. This does not disable CRL and OCSP checks. |
| Allow Proximity Setup of Nearby Devices | 11 | Yes | Select this option to enable the prompt to set up new devices that are nearby. Requires a supervised device. |
| Allow Temporary Sessions on Shared iPad | 13.4 | Yes | Select this option to allow temporary sessions on a shared iPad. |
| Allow Auto Dim on iPad with OLED Displays | 17.4 | Yes | By default, this is enabled. You can select this option to enable auto dim on iPads with OLED displays. |
| Force Automatic Date & Time | 12 | Yes | Enable this to lock Date & Time to set automatically and prevent users from turning it off. Time zones will only update when the device can verify its location via cellular or Wi-Fi. |
| Allow Apple Watch Pairing | 9 | Yes | Select this option to allow users to pair an Apple Watch and unpair any existing ones. |
| Allow iPhone Widgets on Mac | 17 | Yes | Allowed by default. Select this option to permit users to add and interact with their iPhone widgets on a managed Mac. Deselect it to isolate the desktop environment and block cross-device widget streaming. |
| Allow Control Center Access when Device is Locked | 7 | No | Select this option to allow Control Center to appear on the Lock Screen. |
| View Allow Notification Center Access when Device is Locked | 7 | No | Select this option to enable the notification history view on the Lock Screen. Users can still see new notifications as they arrive. |
| Allow Today View Access when Device is Locked | 7 | No | Select this option to enable the Today view in Notification Center on the Lock Screen. |
| Allow Wallet Access when Device is Locked | 6 | No | Select this option to allow Wallet (formerly Passbook) notifications on the Lock Screen. |
| Allow Default Browser Modification | 18.2 | Yes | Select this option to allow users to change the default web browser on the device. |
| Allow Default Calling App Modification | 18.4 | Yes | Select this option to allow users to change the default app used for making phone calls. |
| Allow Default Messaging App Modification | 18.4 | Yes | Select this option to allow users to change the default app used for sending messages. |
| Allow Auto Correction | 8.1.3 | Yes | By default, this is enabled. This option allows keyboard auto-correction. |
| Allow Spell Check | 8.1.3 | Yes | By default, this is enabled. You can select this option to enable the keyboard spell checker. |
| Allow Definition Lookup | 8.1.3 | Yes | Enable this on to allow users to look up word definitions. |
| Allow Keyboard Shortcuts | 9 | Yes | By default, this is enabled. You can select this option to enable keyboard shortcuts. |
| Allow Predictive Keyboard | 8.1.3 | Yes | By default, this is enabled. You can select this option to enable predictive keyboards. |
| Allow QuickPath Keyboard | 13 | Yes | By default, this is enabled. This option allows QuickPath keyboard. |
Password & Biometrics
| Property Name | Minimum Supported OS Version | Supervison | Description |
|---|---|---|---|
| Allow Touch ID/Face ID Unlock | 7 | No | Enable this to allow the use of Touch ID, Face ID, or Optic ID to unlock the device. |
| Allow Touch ID/Face ID Modification | 8.3 | Yes | Toggle this on to let users set up or change Touch ID, Face ID, or Optic ID. |
| Allow Password Modification | 9 | Yes | Enable this to let users add, change, or remove their device passcode. Note: This is ignored on the Shared iPad a |
Privacy & Security
| Property Name | Minimum Supported OS Version | Supervision | Description |
|---|---|---|---|
| Allow Camera | 4 | Yes | Enable this to allow the use of the camera. If disabled, the camera is deactivated and its icon is removed from the Home Screen. |
| Allow Connecting to Network Drives in Files App | 13.1 | Yes | By default, this is enabled. This options allows the device to connect to and browse files on shared network servers within the Files app. |
| Allow Connecting to USB Drives in Files App | 3 | Yes | By default, this is enabled. This options allows the device to access and manage files on connected USB drives within the Files app. |
| Allow Unpaired Devices to Start Up in Recovery | 14.5 | Yes | If enabled allows an unpaired external host to boot the device into recovery mode. Available only on supervised devices. |
| Allow USB Restricted Mode | 11.4.1 | Yes | Select this option to enable enhanced USB security to block unauthorized data connections. |
| Allow Screenshot | 4 | No | Enable this on to let users capture or record their screens; if disabled, this also prevents the Classroom app from observing remote screens. |
| Allow Auto Unlock with Apple Watch | 14.5 | No | Toggle this on to let users unlock their Mac with an Apple Watch or one iPhone with another. |
| Allow Diagnostic Submission | 6 | No | Toggle this on to allow the device to automatically send diagnostic and usage reports to Apple to help improve services. |
| Allow Diagnostic Submission Modification | 9.3.2 | Yes | By default, this is enabled. This options allow users to freely modify diagnostic submission and app analytics settings in the Diagnostics & Usage menu. |
| Force Limit Ad Tracking | 7 | No | Select this option to limit Apple’s personalized advertising for the user. |
| Allow Personalized Ads | 14 | No | Enable this on to receive relevant ads based on your interests. Enabling it limits personalized ad tracking. |
| Allow Mail Privacy Protection | 15.2 | Yes | Select this option to allow the Mail app to hide the user’s IP address and load remote content privately to protect their email activity. |
| Allow Untrusted TLS Prompts | 5 | No | Select this option to allow users to manually trust and visit websites that have invalid or expired security certificates. |
| Force Encrypted Backup | 4 | No | Select this option to ensure that all backups made to a computer are encrypted with a password. |
| Allow Remote FaceTime Session to Request Control of the Device | 18.4 | Yes | Select this option to allow a remote FaceTime participant to request and take control of this device. |
| Allow Password AutoFill | 12 | Yes | Toggle this on to enable automatic password entry, strong password generation, and suggestions. Does not affect contact or credit card AutoFill. |
| Force User Authentication for AutoFill | 11 | Yes | Select this option to force the device to require Face ID Touch ID or a passcode before automatically filling in saved passwords or credit card info. |
| Force Wrist Detection on Apple Watch | 8.2 | No | Select this option to ensure that an Apple Watch automatically locks whenever it is removed from the user’s wrist. |
| Allow Requesting of Passwords from Devices in Proximity | 12 | Yes | Select this option to allow nearby devices to request securely shared passwords from this device. |
| Allow Sharing of Passwords with AirDrop or Passwords App | 12 | Yes | Enable this to allow users to share passwords with others via AirDrop or the Passwords app. |
Managed Open In
| Property Name | Minimum Supported OS Version | Supervision | Description |
|---|---|---|---|
| Allow Data from Managed Apps and Accounts to Open in Unmanaged Apps | 7 | No | Enabled by default. This option allow users to open, share, and view managed corporate documents or data within personal, unmanaged applications. |
| Allow Data from Unmanaged Apps and Accounts to Open in Managed Apps | 7 | No | Enabled by default. This option allow users to import, open, and view personal files and data inside their managed work applications. |
| Follow Configured Managed Open in Settings for Apps and Accounts | 15 | No | Select this option to enforce your data separation policies on the device clipboard. Users will be prevented from copying text from managed corporate apps and pasting it into personal, unmanaged apps. This is disabled by default. |
| Allow Managed Apps to Write Contacts to Unmanaged Accounts | 12 | No | Select this to enable the device to allow managed apps to write contacts to unmanaged accounts. If allowOpenFromManagedToUnmanaged is true, this restriction has no effect. |
| Allow Unmanaged Apps to Read Contacts from Managed Accounts | 12 | No | Enabled by default. This option allows users to access, read, and use contact information from managed corporate accounts within personal, unmanaged applications. |
| Treat AirDrop as na Unmanaged Destination | 9 | Yes | Disabled by default. Select this option to treat AirDrop as an unmanaged destination. When combined with data separation policies, this prevents users from sending managed corporate documents and files via AirDrop. |
iCloud
| Property Name | Minimum Supported OS Version | Supervision | Description |
|---|---|---|---|
| Allow iCloud Backup | 5 | No | Select this option to backup the device to iCloud is disabled. Note: Support for this restriction on unsupervised devices is deprecated. |
| Allow iCloud Drive | 5 | Yes | Enabled by default. This option allow users to sync apps and documents with iCloud Drive, enabling cloud storage and access across their devices. |
| Allow iCloud Keychain Sync | 7 | Yes | Enable this to securely synchronize your passwords and credit card info across devices. Note: Support for unsupervised devices and Managed Apple Accounts is deprecated. |
| Allow iCloud Photos | 9 | Yes | Toggle this on to sync your photos with iCloud. If disabled, any photos not fully downloaded will be removed from local storage. Note: Support for unsupervised devices and Managed Apple Accounts is deprecated. |
| Allow iCloud Private Relay | 15 | Yes | Enable this to hide your IP address and browsing activity in Safari. Note: Support for unsupervised devices and Managed Apple Accounts is deprecated. |
| Allow Managed Apps Cloud Sync | 8 | No | This option allow users to sync data and documents from managed work applications to their personal iCloud storage. |
| Allow iCloud Photo Stream | 5 | No | Enabled by default. This option allow the device to automatically upload, sync, and share photos via My Photo Stream and shared iCloud albums. Deprecated in iOS 17 and later versions. |
| Allow Shared Photo Streams | 6 | Yes | This option allow users to subscribe to and publish shared photo albums with other people using iCloud. |
Apple Intelligence & Siri
| Property Name | Minimum Supported OS Version | Supervision | Description |
|---|---|---|---|
| Allow Siri | 5 | No | Enable this to allow the use of Siri. Deprecated in iOS 26.4 and later versions. |
| Enable Profanity Filter for Siri and Dictation | 5 | Yes | Enable this on to force the use of a profanity filter for both Siri and dictation. Deprecated in iOS 26.4 and later versions. |
| Allow Siri while Device is Locked | 5.1 | Yes | Enabled by default. This option allows users to access and interact with Siri without needing to unlock the device with a password or biometrics. Deprecated in iOS 26.4 and later versions. |
| Allow Spotlight Internet Results in Siri Suggestions | 8 | No | Enabled by default. This option allows users to view web search results, suggestions, and live internet content directly within Spotlight and Siri search results. |
| Allow Siri to Query and Display User Generated Content | 7 | Yes | Enabled by default. This option allows Siri to query and display open web results from user-contributed websites, such as public forums or Wikipedia. Deprecated in iOS 26.4 and later versions. |
| Allow Apple Intelligence Report | 18.4 | Yes | Enable this to allow the system to generate reports on Apple Intelligence activity. Deprecated in iOS 26.4 and later versions. |
| Allow Dictation | 10.3 | Yes | Toggle this on to permit the use of dictation for voice-to-text input. |
| Force On-Device Only Dictation | 14.5 | No | Enable this to ensure all dictation is processed locally on the device. This prevents the system from connecting to Siri servers for dictation. Deprecated in iOS 26.4 and later versions. |
| Force On-Device Only Translation | 15 | No | Disabled by default. Select this option to require all system and app translations to process locally on the device. This forces the use of offline language packs and prevents text from being sent to external servers for translation. Deprecated in iOS 26.4 and later versions. |
| Allow Audio Transcription in Notes App | 18.4 | Yes | Toggle this on to transcribe audio recordings within the Notes app. |
| Allow Transcription Summary in Notes App | 18.3 | Yes | Enable this to generate summaries of audio transcriptions in the Notes app. |
| Allow Apple Intelligence Writing Tools | 18 | Yes | Enable this to use AI-powered writing assistance. Deprecated in iOS 26.4 and later versions. |
| Allow Mail Smart Replies | 18.4 | Yes | Enable this on to allow the Mail app to suggest quick, context-aware replies. |
| Allow Mail Summary | 18.1 | Yes | Enabled by default. This option allows Apple Intelligence to automatically generate concise summaries of individual emails and ongoing message threads in the Mail app. |
| Allow Safari Summary | 18.4 | Yes | Enable this on to allow Safari to summarize web content. |
| Allow Personalized Handwriting | 18 | Yes | Enabled by default. This option allows Apple Intelligence to learn, adapt to, and replicate the user’s personal handwriting style to generate natural-looking text blocks. |
| Allow Visual Intelligence Summary | 18.3 | Yes | Enabled by default. This option allows the device to use Apple Intelligence to scan and summarize real-world objects, text, or documents captured through the camera. Deprecated in iOS 26.4 and later versions. |
| Allow Genmoji Creation | 18 | Yes | Enable this to allow the creation of custom Genmoji. |
| Allow Image Playground | 18 | Yes | Toggle this on to allow the use of AI image generation features. |
| Allow Image Wand | 18 | Yes | Enabled by default. This option allows users to use the Apple Intelligence Image Wand feature to transform rough sketches or blank canvas spaces into generative AI illustrations. |
| Allow External AI Integrations | 18.2 | No | Enable this to allow Siri to connect with external, cloud-based AI services. |
| Allow External AI Integrations Sign-In | 18.2 | Yes | Toggle this on to allow users to sign in to external AI accounts. If disabled, all requests are handled anonymously and active users are signed out. |
| Allowed External Intelligence Workspace IDs | 18.3 | Yes | Enter specific Workspace IDs here to restrict AI access to approved corporate accounts and require a user sign-in. Deprecated in iOS 26.4 and later versions. |
Communication
| Property Name | Minimum Supported OS Version | Supervision | Description |
|---|---|---|---|
| Allow Call Recording | 18.1 | Yes | Enabled by default. This option allow users to utilize native call recording capabilities in the Phone and FaceTime apps to record live audio conversations. |
| Allow Live Voicemail | 17.2 | Yes | This option allows the device to display real-time transcriptions of incoming voicemail messages as they are being left. |
| Allow iMessage | 5 | Yes | Enabled by default. This option allow users to send and receive secure, end-to-end encrypted iMessage communications on the device. |
| Allow RCS Messaging | 18.1 | Yes | This option allows users to use Rich Communication Services (RCS) for enhanced texting, high-resolution media sharing, and read receipts with non-Apple devices. |
| Allow FaceTime | 4 | Yes | Enabled by default. This option allow users to access the FaceTime app and make or receive video and audio calls on the device. |
| Denied ICCID | 26 | Yes | Enter a specific Integrated Circuit Card Identifier to be restricted by the system. |
| Denied SIMs for RCS | 26 | Yes | Enter the specific SIM identifier that should be blocked from using RCS services. |
| Denied SIMs for iMessage & FaceTime | 26 | Yes | Select this option to specify a list of SIM cards (by ICCID) that are blocked from activating iMessage and FaceTime. |
Network & Connectivity
| Property Name | Minimum Supported OS Version | Supervision | Description |
|---|---|---|---|
| Allow App Cellular Data Modification | 7 | Yes | Enabled by default. This option allow users to change which individual applications are permitted to use cellular data by interacting with the per-app data toggles in Settings. |
| Allow Background App Refresh when Roaming | 7 | Yes | Enabled by default. This option allow users to let applications fetch data and update content in the background while the device is connected to a cellular roaming network. |
| Allow Cellular Plan Modification | 11 | Yes | This option allow users to freely change, add, or remove cellular data plans on the device. |
| Allow eSIM Modification | 14 | Yes | This option allow users to add, remove, and configure eSIM profiles on the device. |
| Allow eSIM Transfers to a Different Device | 18 | Yes | This option allow users to transfer an active eSIM from this device over to another device. |
| Preserve eSIM on Erase | 17.2 | Yes | Select this option to ensure the eSIM profile remains on the device even if the device is wiped or factory reset. |
| Allow Personal Hotspot Modification | 12.2 | Yes | This option allow users to configure Personal Hotspot settings and toggle the hotspot service on or off. |
| Allow Satellite Connection | 18.2 | Yes | This option allows the device to connect to satellite networks for emergency SOS requests and off-grid messaging. |
| Allow VPN Creation | 11 | Yes | Enabled by default. This option allow users to manually add custom VPN configurations and install personal VPN applications on the device. |
| Force AirPlay Pairing Password | 15 | Yes | Disabled by default. Select this option to require a password every time a user attempts to connect via AirPlay. This forces a random PIN code to display on the receiving Apple TV or screen, preventing unauthorized or accidental wireless screen mirroring. |
| Force Wi-Fi Connectivity to Allowed Networks Only | 14.5 | Yes | Select this option to restrict the device so it can only connect to Wi-Fi networks specifically defined in a configuration profile. |
| Disallow Wi-Fi from being Turned Off | 13 | Yes | Select this option to prevent users from disabling Wi-Fi in Settings or Control Center. |
| Force Wi-Fi Whitelisting | 10.3 | Yes | Disabled by default. Select this option to force the device to only connect to Wi-Fi networks explicitly deployed via MDM profiles. This completely blocks users from manually joining unmanaged home, public, or hotspot networks. Deprecated in iOS 14.5 and later versions. |
| Allow AirDrop | 7 | Yes | Toggle this on to allow wireless file sharing via AirPlay. |
| Allow Handoff | 8 | No | This option allow users to utilize Handoff to seamlessly continue tasks and activities between their nearby Apple devices. |
| Allow iPhone Mirroring to Mac | 18 | Yes | Disabled by default. This option allow users to utilize the iPhone Mirroring feature to project, interact with, and receive notifications from their iPhone on a Mac computer. |
| Allow Bluetooth Modification | 11 | Yes | Enable this on to let users change Bluetooth configurations. If disabled, these settings are locked. |
| Allow NFC | 14.2 | Yes | Disabled by default. This option allows the device to use Near Field Communication (NFC) for contactless actions, including Apple Pay, tag scanning, and short-range wireless communication. |
Apps & Media
| Property Name | Minimum Supported OS Version | Supervision | Description |
|---|---|---|---|
| Allow App Clips | 14 | Yes | This option allow users to add and open App Clips to quickly use mini-versions of applications without downloading the full app. |
| Allow App Installation | 4 | Yes | Disabled by default. This option allow users to install or update applications from the App Store, alternative marketplaces, or desktop developer tools. |
| Allow App Installation from App Store | 4 | Yes | Disabled by default. This option allow users to access the App Store icon and install or update applications globally across the device. |
| Allow App Installation from Alternative Marketplaces | 17.4 | Yes | Select this option to allow users to install apps from third-party marketplaces (in eligible regions). |
| Allow App Installation from Web | 17.5 | Yes | This option allow users to download and install applications directly from an authorized developer’s website. |
| Allow Automatic App Downloads | 9 | Yes | This option allows the device to automatically download and install applications that the user has purchased or downloaded on their other devices. |
| Allow App Removal | 4.2.1 | Yes | This option allow users to delete and remove installed applications from the device. |
| Allow System App Removal | 11 | Yes | This option allow users to delete and uninstall native Apple applications that came pre-installed on the device. |
| Allow Enterprise App Trust | 9 | Yes | This option allow users to manually trust unmanaged enterprise app developers within the device settings. |
| Allow Apps to be Locked | 18 | Yes | Select this option to allow users to use Face ID Touch ID or a password to lock specific apps. |
| Allow Apps to be Hidden | 18 | Yes | Select this option to allow users to hide apps from the Home Screen. |
| Allow In-App Purchases | 4 | No | Select this option to allow users to make purchases within apps. |
| Allow Listed App Bundle IDs | 15 | Yes | Disabled by default. Select this option to unhide all listed applications system-wide. The device will strictly permit users to view and launch only the specific application bundle IDs defined in this policy. |
| Autonomous Single App Mode App Bundle ID | 7 | Yes | Select this option to define which apps are allowed to put themselves into a locked single-app state. |
| Blocked App Bundle IDs | 15 | Yes | Disabled by default. Select this option to restrict specified applications on supervised devices. Enter the unique bundle IDs of the apps you wish to hide from the Home Screen and prevent from launching. |
| Allow Apple Books Store | 15 | Yes | Allowed by default. Select this option to permit users to access the Book Store tab within the native Books application. Deselect it to remove the storefront entirely on supervised devices. |
| Allow Books Categorized as Erotica | 15 | Yes | This option allow users to download and view Apple Books media tagged or categorized as erotica. |
| Allow Explicit Content | 4 | No | Select this option to allow users to access explicit music podcasts or video content. |
| Allow Apple Music | 9.3 | Yes | This option allow users to access the premium Apple Music subscription service and its streaming features within the Music app. |
| Allow Apple News | 9 | Yes | Allowed by default. Select this option to permit access to the native Apple News app. Deselect it to completely hide and disable the application on supervised devices. |
| Allow Apple Podcasts | 8 | Yes | This option allow users to open and use the native Apple Podcasts application to stream and download shows. |
| Allow iTunes Radio | 7 | Yes | Allowed by default. Select this option to permit users to stream Apple Music Radio stations. Deselect it to turn off radio streaming services within the native Music app on supervised devices. |
| Allow iTunes Store | 4 | No | Allowed by default. Select this option to permit access to the iTunes Store app. Deselect it to completely hide the storefront and block media purchases on supervised devices. |
| Allow Enterprise Book Backup | 8 | No | Select this option to allow backup of Enterprise books. |
| Force iTunes Password Entry | 5 | No | Disabled by default. Select this option to require users to manually enter their password for every App Store and media purchase. This prevents password caching and overrides any user-configured grace periods. Deprecated in iOS 17 and later versions. |
| Allow Enterprise Book Metadata Sync | 8 | No | Allowed by default. Select this option to permit users to sync notes, highlights, and reading progress from managed books to iCloud. Deselect it to isolate corporate book data from personal cloud accounts. |
| Rating Region | 4 | No | Select a value from the dropdown menu to choose the specific geographic region that determines content rating standards. |
| App Ratings Limit | 4 | No | Select a value from the dropdown menu to set the maximum age-based rating permitted for app downloads. |
| Movie Ratings Limit | 4 | No | Select this option to set the maximum rating level permitted for movie content. |
| TV Shows Ratings Limit | 4 | No | Select this option to set the maximum rating level permitted for TV show content. |
Safari
| Property Name | Minimum Supported OS Version | Supervision | Description |
|---|---|---|---|
| Allow Safari Browser | 4 | Yes | Select this option to allow the Safari browser and add its icon to the Home Screen. |
| Allow Safari History Cleaning | 26 | Yes | Select this option to permit users to delete their browsing history and website data in Safari. |
| Allow Safari Private Browsing | 26 | Yes | Select this option to allow the ability to use private tabs or windows in Safari. |
| Safari Cookies Policy | 4 | Yes | Select this option to define the specific conditions under which Safari is permitted to accept or block browser cookies. |
| Allow AutoFill in Safari | 4 | Yes | Select this option to allow Safari to automatically fill in forms with user information passwords or credit card details. |
| Allow Safari JavaScript | 4 | Yes | Select this option to allow the execution of JavaScript on websites visited within Safari. |
| Allow Safari Pop-ups | 4 | Yes | Select this option to allow Safari to open new windows or tabs via pop-ups. |
| Force Fraudulent Website Warning | 8 | Yes | Select this option to force Safari to warn users when they visit websites suspected of phishing or other fraudulent activity. |
Find My
| Property Name | Minimum Supported OS Version | Supervision | Description |
|---|---|---|---|
| Allow Find My Device | 13 | Yes | Allowed by default. Select this option to permit users to track and locate their hardware using the native Find My app. Deselect it to turn off and restrict personal location tracking on managed devices. |
| Allow Find My Friends | 13 | Yes | Allowed by default. Select this option to permit users to share their personal location with friends and family within the native Find My app. Deselect it to disable and lock location sharing settings on supervised devices. |
| Allow Modifying Find My Friends | 7 | Yes | Select this option to allow changes to Find My Friends. Requires a supervised device. |
AirPrint
| Property Name | Minimum Supported OS Version | Supervision | Description |
|---|---|---|---|
| Allow AirPrint | 11 | Yes | Allowed by default. Select this option to permit wireless printing via AirPrint. Deselect it to completely disable native printing capabilities across all applications on supervised devices. |
| Allow AirPrint iBeacon | 11 | Yes | Allowed by default. Select this option to permit the discovery of nearby AirPrint printers using Bluetooth iBeacons. Deselect it to restrict printer discovery strictly to the local network. |
| Allow AirPrint Credential Storage | 11 | Yes | Allowed by default. Select this option to permit the system to securely save AirPrint user names and passwords in the Keychain. Deselect it to force users to manually enter print credentials for every print job. |
| Disallow AirPrint to Destinations with Untrusted Certificates | 11 | Yes | Disabled by default. Select this option to enforce strict certificate validation for wireless printing. This blocks the device from sending print jobs to AirPrint destinations with untrusted, invalid, or self-signed certificates. |
Education & Classroom
| Property Name | Minimum Supported OS Version | Supervision | Description |
|---|---|---|---|
| Allow Screen Observation in the Classroom App | 9 | Yes | Select this option to allow the device screen to be viewed remotely by authorized administrators or teachers. |
| Force Unprompted Screen View | 11 | Yes | Select this option to allow a teacher to view a student’s screen in Apple Classroom without triggering a local notification or request. |
| Force Automatic Joining Classroom Classes in the Classroom App | 11 | Yes | Select this option to force the device to join Apple Classroom classes without requiring a prompt for the user. |
| Require Permission to Leave Classes in the Classroom App | 11.3 | Yes | Select this option to prevent students from leaving an Apple Classroom session without the teacher’s approval. |
| Force Classroom App Lock | 11 | Yes | Select this option to allow a teacher to lock a student’s device or specific app without requesting permission. |
Applying the Policy
- (Optional) Select the Policy Groups tab. Select one or more policy groups where you want to add this policy.
- Select the Device Groups tab. Select one or more device groups where you want to apply this policy to. For device groups with multiple OS member types, the policy only applies when a user logs into a supported Windows device that is enrolled in MDM.
- Or, select the Devices tab. Select one or more devices where you want to apply this policy.
- Click Create Policy. A success message is displayed indicating the completion of policy creation.
Viewing Policy Status
- Select the Statustab.
- To see the last Result Log for a device where this policy is applied, click view.
note
- If any errors occur, they're listed inExit Status. If you have an Exit Status of 0, no errors occurred when applying or enforcing this policy.
Was this information helpful?