(Shared iPad - Device) Types and Details of Profile Settings
This page lists the restriction items you can configure in an iOS profile and the settings on managed devices that can be distributed together with the profile, and explains what each item does.
For the supported OS version of each feature and whether Supervised status is required, see the tables below.
(Functionality)
| Restriction | Default | Description | Target version | Supervised |
|---|---|---|---|---|
| Allow use of camera | On | If you turn this option off, the camera is disabled and the Camera icon is removed from the Home Screen. Users cannot take photos or videos or use FaceTime. | ||
| Allow FaceTime | On | If you turn this option off, users cannot make or receive FaceTime audio or video calls. | Required | |
| Allow screenshots and screen recording | On | If you turn this option off, users cannot save screenshots or screen recordings. | iOS 9.0 or later | |
| Allow AirPlay, viewing screen by Classroom, and screen sharing | On | If you turn this option off, teachers using Classroom cannot use AirPlay on or view the screens of students' iPad devices. | iOS 11/iPadOS 13.1/macOS 10.14.4 or later | Required |
| Allow Classroom to perform AirPlay and View Screen without prompting | If you turn this option on, students are not notified when a teacher uses AirPlay or views the screen on a student's iPad in a managed class. | iOS 11.0 or later | Required | |
| Allow AirDrop | On | If you turn this option off, users cannot use AirDrop. | iOS 7/iPadOS 13.1 or later | Required |
| Allow iMessage | On | If you turn this option off on a device that has only Wi-Fi, the Messages app is hidden. If you turn this option off on a device that has both Wi-Fi and cellular, the Messages app can still be used, but only the SMS/MMS service is available. | iOS 6/iPadOS 13.1 or later | Required |
| Allow Apple Music | On | If you turn this option off, users cannot use Apple Music. The Music app runs in classic mode. | iOS 9.3/iPadOS 13.1 or later | Required |
| Allow Radio | On | If you turn this option off, users cannot listen to radio in Apple Music. | iOS 9.3/iPadOS 13.1 or later | Required |
| Allow voice dialing while device is locked | On | If you turn this option off, users cannot use voice control to make phone calls while the managed device is locked. | ||
| Allow Siri | On | If you turn this option off, users cannot use Siri. | ||
| Allow Siri while device is locked | On | If you turn this option off, Siri responds only while the managed device is unlocked. If no passcode is set on the managed device, this restriction is ignored. | iOS 5.1 or later | |
| Enable Siri profanity filter | If you turn this option off, the Siri profanity filter is disabled. | iOS 5/iPadOS 13.1 or later | Required | |
| Show user-generated content in Siri | On | If you turn this option off, Siri cannot access content from sources that allow user-generated content (such as Wikipedia). | iOS 7/iPadOS 13.1 or later | Required |
| Allow Siri Suggestions | On | If you turn this option off, Siri cannot offer suggestions for apps, people, places, and so on while the user searches. | ||
| Allow Apple Books | On | If you turn this option off, Apple Books is disabled and users cannot use Apple Books from the Books app. | iOS 6/iPadOS 13.1 or later | Required |
| Allow installing apps | On | If you turn this option off, the App Store is disabled and its icon is removed from the Home Screen. Users cannot install or update apps from the App Store using Finder (macOS 10.15 or later) or iTunes (macOS 10.14 or earlier). On iOS 10 or later, MDM can override this restriction. In-house apps can still be installed and updated. | No (iOS 12.4 or earlier) Yes (iOS 13 or later) Yes (iPadOS 13.1 or later) | Required |
| Allow installing apps from the Store | On | If you turn this option off, the App Store icon is hidden and cannot be used. Host applications (iTunes, Configurator) can still be used to install or update apps. | iOS 9.0 or later | Required |
| Allow automatic app downloads | On | If you turn this option off, applications purchased on other devices are no longer downloaded automatically. | iOS 9.0/iPadOS 13.1 or later | Required |
| Allow app removal | On | If you turn this option off, users cannot delete installed applications. | iOS 4.2.1/iPadOS 13.1 or later | Required |
| Allow system app removal | On | If you turn this option off, users cannot delete the built-in applications made by Apple. Note: To apply this restriction, you must restart the managed device once after the profile is installed. | iOS 11.0/iPadOS 13.1 or later | Required |
| Allow App Clips | On | If you turn this option off, users cannot add App Clips. When this restriction is applied, existing App Clips are removed. | iOS/iPadOS 14.0 or later | Required |
| Allow in-app purchases | On | If you turn this option off, users cannot make in-app purchases. | ||
| Require iTunes Store password for all purchases | If you turn this option on, users are no longer asked to enter the account password for in-app purchases and iTunes purchases. | iOS 5.0 or later | ||
| Allow iCloud backup | On | If you turn this option off, backups of the managed device are performed only with iTunes. | iOS 5.0 or later | |
| Allow iCloud documents and data | On | If you turn this option off, documents and data are no longer added to iCloud. | Yes (iOS 13 or later) Yes (iPadOS 13.1 or later) | Required |
| Allow iCloud Keychain | On | If you turn this option off, iCloud Keychain cannot be used. | iOS 7.0 or later | |
| Allow managed apps to store data in iCloud | On | If you turn this option off, users cannot store managed app data in iCloud. | ||
| Allow backup of enterprise books | On | If you turn this option off, users cannot back up books distributed by the organization to iCloud or iTunes. | ||
| Allow sync of enterprise books notes and highlights | On | If you turn this option off, users cannot use iCloud to sync notes and highlights to other devices. | ||
| Allow Shared Albums | On | If you turn this option off, users cannot subscribe to or publish shared photo albums. | iOS 6.0 or later | |
| Allow iCloud Photos | On | If you turn this option off, users cannot use iCloud Photo Library. | iOS 9.0 or later | |
| Allow My Photo Stream (data may be lost if not allowed) | On | If you turn this option off, photos in My Photo Stream are erased from the managed device, photos saved to the Camera Roll are no longer sent to My Photo Stream, and photos and videos in shared streams can no longer be viewed on the managed device. Important: These photos and videos may be lost if no other copy exists. | iOS 5.0 or later | |
| Allow automatic sync while roaming | On | If you turn this option off, a managed device that is roaming syncs only when the user accesses an account. | ||
| Allow USB drive access in the Files app | On | If you turn this option off, access from the Files app to USB devices connected to the device is disabled. | iOS 13/iPadOS 13.1 or later | Required |
| Allow network drive access in the Files app | On | If you turn this option off, access to network drives in the Files app is disabled. | iOS 13/iPadOS 13.1 or later | Required |
| Force encrypted backups | If you turn this option on, users can no longer choose whether to save device backups made with iTunes to their Mac in encrypted form. If the profile is encrypted and this option is off, backup encryption is required and is enforced by iTunes. Profiles installed on the device with Profile Manager are never encrypted. | |||
| Allow tracking requests from apps | On | If you turn this option off, tracking requests from apps in the privacy settings are disabled. | iOS 14.0 or later | |
| Allow Apple personalized advertising | On | If you turn this option off, Apple's advertising platform does not use the user's data to deliver personalized ads. | iOS 14.0 or later | |
| Allow Erase All Content and Settings | On | If you turn this option off, the Erase All Content and Settings option is disabled. | iOS 8/iPadOS 13.1 or later | Required |
| Allow users to accept untrusted TLS certificates | On | If you turn this option off, users are not asked whether to trust certificates that cannot be verified. This setting applies to Safari, Mail, Contacts, and Calendar accounts. If you turn this option on, only certificates that chain to a trusted root certificate are accepted, and no message is displayed. | iOS 5.0 or later | |
| Allow automatic updates to certificate trust settings | On | If you turn this option off, certificate trust settings are no longer updated automatically. | iOS 7.0 or later | |
| Allow trusting new enterprise app authors | On | If you turn this option off, users cannot trust new enterprise app authors, and apps from those authors are prevented from launching. | iOS 9.0 or later | |
| Allow installing configuration profiles | On | If you turn this option off, users cannot install configuration profiles manually. | iOS 6/iPadOS 13.1 or later | Required |
| Allow adding VPN configurations | On | If you turn this option off, users cannot create or add VPN configurations. | iOS 11/iPadOS 13.1 or later | Required |
| Force automatic date and time | If you turn this option on, Set Automatically for date and time is turned on, and users cannot turn it off. | iOS 12.0/iPadOS 13.1/tvOS 12.2 or later | Required | |
| Allow Classroom to lock apps and devices without prompting | If you turn this option on, teachers can lock an app open or lock a managed device without first prompting the user. | iOS 11/iPadOS 13.1/macOS 10.14.4 or later | Required | |
| Allow joining Classroom classes automatically without prompting | If you turn this option on, students can join a class without prompting the teacher. | iOS 11/iPadOS 13.1/macOS 10.14.4 or later | Required | |
| Require teacher permission to leave unmanaged Classroom classes | If you turn this option on, students must request permission before leaving an unmanaged (teacher-created) class. | iOS 11.3/iPadOS 13.1/macOS 10.14.4 or later | Required | |
| Force Wi-Fi power on | If you turn this option on, Wi-Fi is forced to stay on. | iOS 13/iPadOS 13.1 or later | Required | |
| Allow NFC | On | If you turn this option off, users cannot use near field communication. | iOS 14.2/iPadOS 14.2 or later | |
| Allow modifying account settings | On | If you turn this option off, users cannot create new accounts or change settings associated with accounts, such as the user name and password. | iOS 7.0/iPadOS 13.1 or later | Required |
| Allow modifying Bluetooth settings | On | If you turn this option off, users cannot change Bluetooth settings. | iOS 11/iPadOS 13.1 or later | Required |
| Allow modifying cellular data app settings | On | If you turn this option off, users cannot change the cellular data settings of apps. | iOS 7/iPadOS 13.1 or later | Required |
| Allow modifying cellular plan settings | On | If you turn this option off, users cannot change cellular plan settings. | iOS 11/iPadOS 13.1 or later | Required |
| Allow modifying eSIM settings | On | If you turn this option off, users cannot add or remove eSIM plans on iPhone devices that support eSIM. | iOS 12.1/iPadOS 13.1 or later | Required |
| Allow modifying device name | On | If you turn this option off, users cannot change the device name shown in Settings > General > About. | iOS 9.0/iPadOS 13.1/tvOS 11 or later | Required |
| Allow modifying notification settings | On | If you turn this option off, users cannot change notification settings. | iOS 9.3/iPadOS 13.1 or later | Required |
| Allow modifying passcode | On | If you turn this option off, users cannot change a passcode that has already been set. | iOS 9.0/iPadOS 13.1 or later | Required |
| Allow modifying Touch ID fingerprint/Face ID face data | On | If you turn this option off, users cannot add Touch ID/Face ID information or delete existing information. | iOS 8.3 (Touch ID) iOS 11.0 (Face ID) iPad 13.1 (Touch ID or Face ID) | Required |
| Allow Screen Time | On | If you turn this option off, users cannot set their own restrictions or Screen Time on the managed device. | iOS 8.0 (restrictions) iOS 12.0 (Screen Time) iOS 8.0 or later (restrictions) iPadOS 13.1 (Screen Time) | Required |
| Allow modifying wallpaper | On | If you turn this option off, users cannot change the Lock Screen or Home Screen wallpaper. | iOS 9.0/iPadOS 13.1 or later | Required |
| Allow modifying Personal Hotspot settings | On | If you turn this option off, users cannot change Personal Hotspot settings. | iOS 12.2/iPadOS 13.1 or later | Required |
| Allow Find My Friends | On | If you turn this option off, users cannot turn on the features of the Find My Friends app. | iOS 13/iPadOS 13.1 or later | Required |
| Allow Find My Device in Find My | On | If you turn this option off, users cannot turn on the features of the Find My Device app. | iOS 13.0/iPadOS 13.1 or later | Required |
| Allow modifying Find My Friends settings | On | If you turn this option off, users cannot change or update the settings of the Find My Friends app. | iOS 13.0 or later | Required |
| Allow USB accessories while device is locked | If you turn this option on, users can allow USB accessories to always access the iOS device. | iOS 11.4.1/iPadOS 13.1 or later | Required | |
| Allow pairing with non-Configurator hosts | On | If you turn this option off, users cannot pair the iOS device with any device other than the Mac with Apple Configurator installed that originally supervised the device. If no supervision host certificate is set, all pairing is disabled. | iOS 5/iPadOS 13.1 or later | Required |
| Allow unpaired devices to enter Recovery Mode | If you turn this option on, users can put a device into Recovery Mode even if it is not paired. | iOS/iPadOS 14.5 or later | Required | |
| Allow documents from managed sources in unmanaged destinations | On | If you turn this option off, apps other than those distributed by MDM cannot access the data of apps distributed by MDM. | iOS 7.0 or later | |
| Allow documents from unmanaged sources in managed destinations | On | If you turn this option off, apps distributed by MDM cannot access the data of other apps. | iOS 7.0 or later | |
| Include copy and paste in restrictions | Allow documents from managed sources in unmanaged destinations (iOS 7.0+) Allow documents from unmanaged sources in managed destinations (iOS 7.0+) If you turn this option on, copy and paste from managed apps to unmanaged apps and from unmanaged apps to managed apps is prohibited. | iOS 15.0 or later | ||
| Treat AirDrop as an unmanaged destination | If you turn this option on, AirDrop from managed apps is no longer shown to users as an option. To turn this restriction on and enable it, you must also turn off Allow documents from managed sources in unmanaged destinations. | iOS 9.0 or later | ||
| Allow Handoff | On | If you turn this option off, users cannot use Handoff on their Apple devices. | ||
| Allow sending diagnostic and usage data to Apple | On | If you turn this option off, users cannot choose to send diagnostic information to Apple. | iOS 6.0 or later | |
| Allow modifying diagnostics settings | On | If you turn this option off, users cannot change the diagnostic data settings. | iOS 9.3.2/iPadOS 13.1 or later | Required |
| Allow unlocking device with Touch ID/Face ID | On | If you turn this option off, users cannot use Touch ID to unlock the managed device. | iOS 7.0 or later | |
| Allow password AutoFill | On | If you turn this option off, password AutoFill cannot be used, and users are no longer asked whether to retrieve saved passwords from iCloud Keychain or a third-party password manager. | iOS 12.0/iPadOS 13.1 or later | Required |
| Require Touch ID/Face ID authentication before AutoFill | If you turn this option on, users are asked to authenticate when they try to AutoFill password or credit card information in Safari or an application. If this restriction is not set, users can toggle this feature in Settings. Supported only on devices that support Face ID. | iOS 11/iPadOS 13.1 or later | Required | |
| Allow unlocking with Apple Watch | On | If you turn this option off, users cannot use Apple Watch to unlock the device. | iOS 14.5 or later watchOS 11.0 or later | |
| Force Apple Watch wrist detection | If you turn this option on, Apple Watch locks automatically when it is removed from the user's wrist. It can be unlocked with the passcode or the paired iPhone. | iOS 8.2 or later | ||
| Allow pairing with Apple Watch | On | If you turn this option off, users cannot pair an Apple Watch with a supervised iPhone. | iOS 9.0/iPadOS 13.1 or later | Required |
| Require passcode on first AirPlay pairing | If you turn this option on, a passcode is required the first time an iOS device or Apple TV is paired to use AirPlay. | iOS 7.1 or later | ||
| Join only Wi-Fi networks installed by a Wi-Fi payload | If you turn this option on, the managed device can connect only to Wi-Fi networks whose settings are distributed using the Wi-Fi payload of the profile. | iOS 10.3/iPadOS 13.1 or later | Required | |
| Allow setting up new nearby devices | On | If you turn this option off, users cannot use an Apple device to set up or configure other Apple devices. | iOS 11.0/iPadOS 13.1 or later | Required |
| Allow proximity-based password sharing requests | On | If you turn this option off, the user's device cannot expose passwords to nearby devices using AutoFill to Nearby Devices. On iOS and macOS, this feature restricts only Wi-Fi password requests. | iOS 12.0/iPadOS 13.1/tvOS 12.2 or later | Required |
| Allow password sharing | On | If you turn this option off, users cannot share passwords. | iOS 12.0 or later | Required |
| Allow AirPrint | On | If you turn this option off, users cannot use AirPrint. | iOS 11/iPadOS 13.1 or later | Required |
| Allow iBeacon discovery of AirPrint printers | On | If you turn this option off, users cannot discover AirPrint printers using nearby iBeacons. | iOS 11/iPadOS 13.1 or later | Required |
| Allow storage of AirPrint credentials in Keychain | On | If you turn this option off, users cannot store AirPrint credentials in Keychain. | iOS 11/iPadOS 13.1 or later | Required |
| Disallow AirPrint to destinations with untrusted certificates | If you turn this option on, users cannot use AirPrint to print to printers with untrusted certificates. | iOS 11/iPadOS 13.1 or later | Required | |
| Allow predictive keyboard | On | If you turn this option off, the predictive keyboard is no longer shown to users. | iOS 8.1.3/iPadOS 13.1 or later | Required |
| Allow keyboard shortcuts | On | If you turn this option off, users cannot use keyboard shortcuts. | iOS 9.0/iPadOS 13.1 or later | Required |
| Allow continuous path keyboard | On | If you turn this option off, users cannot use the continuous path (swipe) keyboard. | iOS 13.0 or later | Required |
| Allow auto-correction | On | If you turn this option off, users no longer see word correction suggestions. | iOS 8.1.3/iPadOS 13.1 or later | Required |
| Allow spell check | On | If you turn this option off, words that may be misspelled are no longer underlined in red. | iOS 8.1.3/iPadOS 13.1 or later | Required |
| Allow Define | On | If you turn this option off, users cannot double-tap a word to look up its definition. | iOS 8.1.3/iPadOS 13.1 or later | Required |
| Allow dictation | On | If you turn this option off, users cannot use dictation. | iOS 10.3/iPadOS 13.1 or later | Required |
| Allow Wallet notifications on Lock Screen | On | If you turn this option off, users must unlock the managed device to use Wallet. | iOS 6.0 or later | |
| Show Control Center on Lock Screen | On | If you turn this option off, users cannot display Control Center by swiping up. | iOS 7.0 or later | |
| Show Notification Center on Lock Screen | On | If you turn this option off, users no longer receive notifications while the screen is locked. | iOS 7.0 or later | |
| Show Today view on Lock Screen | On | If you turn this option off, users cannot display Notification Center with the Today view on the Lock Screen by swiping down. | iOS 7.0 or later | |
| Defer software updates: XX days | If you turn this option on, you can prohibit users from manually updating the device over a wireless connection for a specified period. When this restriction is applied, the deferral period is set to 30 days by default and can be changed to a value between 1 and 90 days. The deferral period starts counting down when the OS update is released. After the deferral period ends, users see a notification prompting them to update the OS. | iOS 11.3/iPadOS 13.1/tvOS 12.2 or later | Required |
(Apps)
| Restriction | Default | Description | Target version | Supervised |
|---|---|---|---|---|
| Allow use of iTunes Store | On | If you turn this option off, the iTunes Store is disabled and its icon is removed from the Home Screen. Users cannot preview, purchase, or download content. | No (iOS 12.4 or earlier) Yes (iOS 13 or later) Yes (iPadOS 13.1 or later) | Required |
| Allow use of News | On | If you turn this option off, users cannot use the News app. | iOS 9.0/iPadOS 13.1 or later | Required |
| Allow use of Podcasts | On | If you turn this option off, users cannot download podcasts. | iOS 8/iPadOS 13.1 or later | Required |
| Allow use of Game Center | On | If you turn this option off, the Game Center app and its icon are removed. | iOS 6/iPadOS 13.1 or later | Required |
| Allow multiplayer gaming | On | If you turn this option off, users cannot play multiplayer games in Game Center. | No (iOS 12.4 or earlier) Yes (iOS 13 or later) Yes (iPadOS 13.1 or later) | Required |
| Allow adding Game Center friends | On | If you turn this option off, users cannot search for or add friends in Game Center. | No (iOS 12.4 or earlier) Yes (iOS 13 or later) Yes (iPadOS 13.1 or later) | Required |
| Allow use of Safari | On | If you turn this option off, the Safari web browser app is disabled and its icon is removed from the Home Screen. Users also cannot open web clips. | No (iOS 12.4 or earlier) Yes (iOS 13 or later) Yes (iPadOS 13.1 or later) | Required |
| Enable AutoFill | On | If you turn this option off, Safari no longer remembers what users enter in web forms. | No (iOS 12.4 or earlier) Yes (iOS 13 or later) Yes (iPadOS 13.1 or later) | Required |
| Force fraud warning | On | If you turn this option on, Safari prevents users from visiting websites identified as fraudulent or unsafe. The default is off. | ||
| Enable JavaScript | On | If you turn this option off, all JavaScript on websites is ignored. | ||
| Block pop-ups | If you turn this option on, Safari blocks pop-ups. The default is off. | |||
| Accept cookies | Always | Sets the cookie policy for Safari. You can choose to always block all cookies, always accept all cookies, accept cookies only from the current website, or accept cookies from websites the user has visited. The default is Always. | Only From websites I visit: iOS 8.0 or later | |
| Restrict app usage (managed devices only) | Allow all apps | Allows the use of applications other than Settings or Phone that you add to the allowlist or blocklist. Do not allow some apps: a blocklist of applications that cannot be used. Allow only some apps: an allowlist of applications that can be used. | iOS 9.3/iPadOS 13.1/tvOS 11 or later | Required |
(Media Content)
| Item | Default | Details | Target version | Supervised |
|---|---|---|---|---|
| Ratings region | United States | "Select the ratings region from the following: United States; Australia; Canada; Germany; France; Ireland; Japan; New Zealand; United Kingdom" | ||
| Allowed content ratings | Set the maximum rating to allow | Set the maximum rating to allow | Set the maximum rating to allow | Set the maximum rating to allow |
| Movies | Allow all movies | Select an appropriate rating from the list of ratings for the country selected in Ratings region. If you select Do not allow movies, the corresponding movies no longer appear in Videos. Options: Do not allow movies; G; PG-12; R-15; R-18; Allow all movies | ||
| TV shows | Allow all TV shows | Select an appropriate rating from the list of ratings for the country selected in Ratings region. Options: Do not allow TV shows; Explicit Allowed; Allow all TV shows" | ||
| Apps | Allow all apps | "Select from the following: Do not allow apps; 4+; 9+; 12+; 17+; Allow all apps" | ||
| Allow explicit music, podcasts, and iTunes U media | On | If you turn this option off, explicit music and video content purchased from the iTunes Store or listed in iTunes U is hidden. Whether content is explicit is specified by the content provider (such as a record label) when the content is sold in the iTunes Store or distributed in iTunes U. | iOS 13/iPadOS 13.1 or later | Required |
| Allow explicit sexual content in iBooks Store books | On | If you turn this option off, content with explicit sexual material purchased from the iBooks Store is hidden. Whether content is explicit is specified by the content provider when the content is sold in the iBooks Store. | iOS 6.0 or later |
Global HTTP Proxy (Supervised only)
Specify a proxy through which all HTTP traffic from the managed device is routed.
| Item | Default | Details | Target version |
|---|---|---|---|
| Proxy type | Manual | Sets the type of proxy to use for the global HTTP proxy. Options: Manual; Automatic | |
Proxy server (only when the proxy type is Manual) | Enter the host name or IP address of the proxy server. This item is required. | ||
Proxy port (only when the proxy type is Manual) | Enter the port number of the proxy server. This item is required. | ||
User name (only when the proxy type is Manual) | Enter the user name used to connect to the proxy. This item is optional. | ||
Password (only when the proxy type is Manual) | Enter the password used to authenticate with the proxy. This item is optional. | ||
Proxy PAC URL (only when the proxy type is Automatic) | Enter the URL used to retrieve the proxy settings (the location of the proxy PAC). This item is required. | ||
Allow direct connection (only when the proxy type is Automatic) | If this is not allowed and the PAC file cannot be reached, the managed device cannot connect directly to the destination. The default is not allowed. | iOS 7.0 or later | |
| Allow bypassing proxy to access captive networks | If this is allowed, the managed device can display the login page of a dedicated network without going through the proxy server. | iOS 7.0 or later |
DNS Proxy (iOS 11.0 or later, Supervised only)
Specify a proxy through which all HTTP traffic from the managed device is routed.
| Item | Default | Details | Target version |
|---|---|---|---|
| App bundle ID | Add the bundle ID of the app that contains the DNS proxy information. This item is required. | ||
| Provider bundle ID | You can add the bundle ID of the DNS proxy extension. | ||
| Provider configuration | If you have a configuration file specific to your DNS provider or network vendor, you can upload it. You can add multiple DNS proxy settings by clicking the Upload... button. |
Certificates
| Setting | Details | Details | Details | Details |
|---|---|---|---|---|
| Certificate | Click Choose file and specify the certificate file. | Click Choose file and specify the certificate file. | Click Choose file and specify the certificate file. | Click Choose file and specify the certificate file. |
Content Filter (Supervised only)
| Item | Default | Description | Target version |
|---|---|---|---|
| Filter type | Select from the following: Built-in: Limit adult content; Built-in: Specific websites only; Plug-in (third-party app) | iOS 8 or later: Plug-in (third-party app) | |
| Built-in: Limit adult content | |||
| Allowed URLs | To allow access to specific websites, add their URLs to this list. Access is allowed even if the automatic filter determines that a site is an adult site. | ||
| Not permitted URLs | To prohibit access to specific websites, add their URLs to this list. Access is prohibited even if the automatic filter determines that a site is not an adult site. | ||
| Built-in: Specific websites only | |||
| Website URLs | The specified websites are registered as Safari bookmarks, and only the registered websites can be accessed. | ||
| URL | Enter the URL of the website to register as a bookmark. | ||
| Name | Enter the display name on the bookmark. | ||
| Bookmarks | |||
| Plug-in (third-party app) | iOS 8 or later | ||
| Filter name | Only when Plug-in (third-party app) is selected. Enter the string to display as the name of the filter setting. | ||
| Identifier | Enter the bundle ID of the plug-in that provides the filtering service. | ||
| Service address | Enter the server address (an IP address, host name, or URL). | ||
| Organization | Enter the Organization string to pass to the third-party plug-in. | ||
| User name | Enter the user name used by the service. | ||
| Password | Enter the password used by the service. | ||
| Certificate | Specify the certificate used for authentication when using the service. You can select a certificate uploaded to the Certificates payload. | ||
| Filter WebKit traffic | On | If this is on, WebKit traffic is blocked. | |
| Filter socket traffic | On | If this is on, socket traffic is blocked. | |
| Custom data | Enter the custom data required by the plug-in of the filtering service. |
Certificate Transparency
| Setting | Details |
|---|---|
| Excluded certificates | Disables enforcement of CT (Certificate Transparency) for specific certificates. For details, see the Apple website below. https://support.apple.com/en-us/guide/mdm/mdmbafaa79ff/1/web/1 Note: The URL is as of May 29, 2019. The URL and the content of the website may be changed by the website operator without notice. |
| Excluded domains | Specify a list of domains for which CT (Certificate Transparency) is disabled. |
Wi-Fi
| Setting | Default | Details | Target version |
|---|---|---|---|
| SSID | Specify the SSID of the Wi-Fi network to use. (Required) | ||
| Hidden Network | Turn this on if the Wi-Fi network to use is not open or not broadcast. | ||
| Enable auto-join | On | If this is on, the device connects to the network automatically. If this is not enabled, users must tap the network name to connect to the network. | iOS 5.0 or later |
| Disable captive network detection | If this is on, captive network detection is disabled when the managed device connects to the network. | iOS 10.0 or later | |
| Disable MAC randomization to avoid association | If this is on, a non-private MAC address is used to connect to this Wi-Fi network. | iOS 14.0 or later | |
| Proxy setup | None | Configure the proxy settings used to connect to the network. Select from
| iOS 5.0 or later |
| Server | Only when the proxy setup is Manual. Specify the host name or IP address of the proxy server. (Required) | ||
| Port | Only when the proxy setup is Manual. Specify the port number of the proxy server. | ||
| User name | Only when the proxy setup is Manual. Specify the user name used to authenticate with the proxy server. | ||
| Password | Only when the proxy setup is Manual. Specify the password used to authenticate with the proxy server. | ||
| Proxy server URL | Only when the proxy setup is Automatic. Specify the URL of the PAC file that defines the proxy settings. | ||
| Allow direct connection if PAC is unreachable | On | Only when the proxy setup is Automatic. If this item is off and the PAC file cannot be reached, the managed device cannot connect directly to the destination. | iOS 7.0 or later |
| Security type | None | Specify the type of encryption used when connecting to the Wi-Fi network.
| iOS 4 or later |
| Password | Only when the security type is one of WEP, WPA/WPA2 Personal, WPA2 Personal (iOS 8 or later, except Apple TV), or Any (Personal). Specify the password of the Wi-Fi network to connect to. | ||
| Protocols | Only when the security type is one of Dynamic WEP, WPA/WPA2 Enterprise, WPA2 Enterprise (iOS 8 or later, except Apple TV), or Any (Enterprise). Specify the authentication protocols supported by the Wi-Fi network. You can select more than one of the following.
EAP-FAST is selected): Use PAC: If you turn this on, the managed device uses an existing PAC, if there is one. Provision PAC: If this is on, PAC provisioning is allowed. Provision PAC Anonymously: If this is on, the managed device is provisioned anonymously. | ||
| User name | Specify the user name required for authentication. | ||
| Use password for every connection | If this is on, users are asked to enter the password every time they connect to the network. | ||
| Password | Enter the password for the specified user name. | ||
| Identity certificate | Specify the credentials used to connect to the Wi-Fi network. You can select a certificate uploaded to the Certificates payload. | ||
| Inner authentication | OS Default | Specify the inner authentication used by the TTLS module. Select from the following.
| |
| Outer identity | You can specify any identity to show externally so that the user's identity stays hidden. The user's real name appears only inside the encrypted tunnel, which helps improve security. | ||
| Allow two RANDs | If this is on, EAP-SIM authentication accepts servers that provide only two RAND values. | ||
| Trusted certificates | Specify the certificates trusted and required for authentication. You can select a certificate uploaded to the Certificates payload. | ||
| Trusted certificates | Enter the name of the certificate required by the authentication server. | ||
| Network type | Standard | Specify the network type, which determines whether the network is displayed as a legacy or Passpoint hotspot. Select from the following. The default is Standard.
| |
| Fast Lane QoS Marking | Do not restrict QoS marking | Specify whether to restrict QoS (Quality of Service) marking. Select from the following.
| |
| Enable QoS marking | On | ||
| Whitelist Apple audio/video calling | On | ||
| Whitelist specific apps |
AirPlay (iOS 7.0 or later)
| Setting | Details | Supervised |
|---|---|---|
| Password | Device name: The name of the AirPlay destination device Password: The password used for the AirPlay connection | |
| Whitelist | Specify an allowlist of device IDs that can connect via AirPlay. Enter each ID in the format xx:xx:xx:xx:xx:xx. | Required |
SCEP
| Setting | Default | Details | Target version |
|---|---|---|---|
| URL | Enter the URL of the SCEP server. (Required) | ||
| Name | Enter any string that the SCEP server can recognize. If the certificate authority has multiple CA certificates, use this to distinguish between them. | ||
| Subject | Enter an X.500 name expressed as an array of OIDs and values. Example: /C=US/O=Apple Inc./CN=foo/1.2.5.3=bar You can use abbreviations such as country (C), locality (L), state (ST), organization (O), organizational unit (OU), and common name (CN). | ||
| Subject alternative name type | None |
| |
| Subject alternative name value | |||
| NT principal name | |||
| Retries | 3 | Specify the number of times the managed device retries when the server returns a pending response. | |
| Retry delay | 10 | Specify the interval between retries, in seconds. The first retry is performed without this delay. | |
| Challenge | Specify a pre-distributed secret key used as the shared secret for automatic enrollment. | ||
| Key size | 1024 | Select the key size from 1024, 2048, and 4096 (bits). Note: A key size of 4096 bits is not supported on iOS 13 or earlier, or iPadOS 13 or earlier. | |
| Use as digital signature | Turn this on to use the key for digital signatures. | iOS 4.0 or later | |
| Use for key encipherment | Turn this on to use the key for encryption. | iOS 4.0 or later | |
| Fingerprint | Enter the hexadecimal characters to use as the fingerprint, or upload a certificate file to create the fingerprint. | ||
| Fonts | Specify the font files to distribute. |
Fonts
Specify the font files to distribute.
| Item | Default | Details | Target version |
|---|---|---|---|
| Type of APN to configure | Default APN | Select the type of APN to configure from the following. (Required)
| Data APN and Default APN and Data APN: iOS 8.0 or later |
| Default/Data APN name | Enter the access point name for the APN configuration. (Required) | ||
| Default/Data APN authentication type | PAP | Select the authentication used by the default APN from the following. (Required)
| |
| Default/Data APN user name | Enter the user name used to authenticate the connection. | ||
| Default/Data APN password | Enter the password used to authenticate the connection. | ||
| Data APN proxy server | Enter the host name of the proxy server. | iOS 8.0 or later | |
| Port number | Enter the port number of the proxy server. | ||
| Default/Data APN supported IP version | Select the Internet Protocol version supported by the connection from the following.
| ||
| Data APN supported roaming IP version | Select the Internet Protocol version supported by roaming connections from the following.
|
VPN
Configure how the managed device connects to the wireless network over VPN, including the required authentication information.
| Item | Details |
|---|---|
| Connection name | The display name of the connection on the device. |
| Connection type | The method used to establish the VPN connection. After you select one of these VPN methods, the Server and Account options change to match that method. |
| Server | The host name or IP address of the VPN gateway server. |
| Account | The user account required to authenticate the connection. |
| User authentication | The user authentication method. If you use certificate authentication, use the Credentials field that appears to link to the Certificates or SCEP settings in the same VPN configuration profile. |
| Send all traffic through VPN | Forces all network traffic to be sent through the VPN connection. |
| Machine authentication | The type of authentication required. For L2TP, select Shared secret or Certificate and enter the appropriate settings. Other types of VPN connection methods use different machine authentication settings. |
| Shared secret | The shared secret used to connect. |
| Proxy setup | Configures the proxy used for this VPN connection. |
| Per-App VPN setup | If this is on, fields for using the above VPN settings for Per-App VPN are displayed. Note: These fields are displayed only if you select one of the following for Connection type. Cisco AnyConnect/Cisco Legacy AnyConnect/Juniper SSL/Pulse Secure/F5 SSL/SonicWALL Mobile Connect/Aruba VIA/Check Point Mobile VPN/Custom SSL For details about Per-App VPN, see Per-App VPN. |
Lock Screen Message (iOS 9.3 or later, Supervised only)
Configure the text that the managed device displays on the Lock Screen.
| "If Lost, Return to..." message | Enter the message displayed in the login window and on the Lock Screen. Character limit: 255 characters or fewer | | Asset tag information | Enter the message displayed at the bottom of the login window and the Lock Screen. Character limit: 255 characters or fewer. Only single-byte alphanumeric characters and the symbols : _ . can be used |
Notifications (Supervised only)
You can configure notification settings for each application.
| Item | Default | Details |
|---|---|---|
| Notification settings | Click Add Per App Settings to display the notification settings for each app. | |
| Package name | Enter the bundle ID of the application to which the notification settings apply. (Required) | |
| Allow notifications | On | If unchecked, notifications are not allowed for this application. |
| Show in Notification Center | On | If unchecked, notifications for this application are not shown in Notification Center. |
| Sounds | On | If unchecked, notifications for this application cannot play sounds. |
| Badge app icon | On | If unchecked, badges are not allowed on this application's icon. |
| Show on Lock Screen | On | If unchecked, notifications for this application are not shown on the Lock Screen. |
| Show in CarPlay | On | If unchecked, notifications for this application are not shown in CarPlay. |
| Critical alerts | If checked, push notification sounds can play even when other notifications are muted. | |
| Unlocked notification style | Banner | Specify the notification style used when the device is unlocked. Select from the following. - None - Banner - Alert |
| Notification grouping | Automatic | Select the notification grouping from the following. - Automatic - By App - Off |
| Show previews | Always | Select when previews are shown. Options: - Always - Only when unlocked - Never |
TV Remote (iOS and tvOS, Supervised only)
Configure settings that restrict connections to Apple TV and display on Apple TV.
| Item | Details |
|---|---|
| Allowed TVs | Enter the device's MAC address. |
Other Extended Features
Home Screen Layout (Supervised only)
iOS 8.0+
The single application specified here is forced to launch in the foreground on the managed device, and other applications cannot be used. The Home Screen cannot be opened either.
The specified application reopens as soon as the device restarts. This is also called kiosk mode.
You can also select the features to allow while the single application is running from Options.
Note: An app in Single App Mode cannot be updated. To update the app, you must first turn off Single App Mode. To keep other apps hidden from users at that time, apply the Allow only some apps restriction in Restrict app usage (supervised devices only), which hides all apps other than the
- Settings
- Phone
Single App Mode (Supervised only)
| Item | Item | Default | Details |
|---|---|---|---|
| Identifier | Identifier | Enter the identifier of the app to set in Single App Mode. You can also search by application name or App Store ID. | |
| Options iOS 8.0+ | Disable screen rotation | If this is on, the screen does not rotate automatically when the device is rotated. | |
| Options iOS 8.0+ | Disable volume button operation | If this is on, the volume buttons are disabled. | |
| Options iOS 8.0+ | Disable ring/silent switch operation | If this is on, the ring/silent switch is disabled. | |
| Options iOS 8.0+ | Disable side (sleep) button operation | If this is on, the sleep/wake button is disabled, so the device cannot be put to sleep or woken. | |
| Options iOS 8.0+ | Enable AssistiveTouch | If this is on, AssistiveTouch is enabled. | |
| Options iOS 8.0+ | Enable AssistiveTouch adjustment | If this is on, AssistiveTouch adjustment is enabled. | |
| Options iOS 8.0+ | Enable Speak Selection | If this is on, Speak Selection is enabled. | |
| Options iOS 8.0+ | Enable mono audio | If this is on, the left and right audio channels are combined and played through a single channel. | |
| Options iOS 8.0+ | Disable auto-lock | If this is on, auto-lock is disabled. | |
| Options iOS 8.0+ | Enable invert colors | If this is on, invert colors is enabled. | |
| Options iOS 8.0+ | Disable touch input | If this is on, all touch input on the device is disabled. | |
| Options iOS 8.0+ | Enable VoiceOver | If this is on, VoiceOver reads aloud a description of what is displayed on the screen. | |
| Options iOS 8.0+ | Enable Voice Control | If this is on, Voice Control is enabled. | |
| Options iOS 8.0+ | Enable Zoom | If this is on, Zoom is enabled so that screen content can be enlarged for easier viewing. |
Mobile Connection (Excluded from export)
iOS 5.0+
You can configure roaming and Personal Hotspot settings.
The device user can change the configured mobile connection settings.
(Even if the device user changes them, the specified mobile connection settings are automatically restored by the sync process.)
Due to iOS specifications, these settings cannot be locked. Note: It may take some time for the settings to be applied to the device.
| Item | Details |
|---|---|
| Roaming | - Maintain device setting - Enabled for voice and data - Enabled for data only - Disabled |
| Personal Hotspot | - Maintain device setting - Enabled - Disabled |
eSIM Mobile Plan (Excluded from export)
iOS 13.0+
You can set the download server (SM-DP+ server) used when downloading the eSIM of a device.
When you distribute the profile, BizMobile Go! sends an eSIM retrieval command to the target device, and the device retrieves the eSIM from the specified download server and activates it.
Before using this setting, you must register the EID of the target device with your carrier and obtain the URL of the eSIM download server.
Note: Once this setting has been applied to a device, it is not reapplied at every sync. It is reapplied to the target device only when you change the setting value.
Note: To retrieve the eSIM again or switch eSIMs on a device to which the setting has already been applied, use the command Refresh eSIM Mobile Plan on the Device Detail screen.
| Item | Details | Target version |
|---|---|---|
| eSIM Download Server | Enter the URL of the download server used to retrieve the eSIM. This item is required. (Up to 255 characters) Use the URL provided by your carrier. | iOS 13.0 or later |
Shared iPad Settings (Shared iPad only, excluded from export)
Configure the login settings for Shared iPad.
| Item | Details | Target version |
|---|---|---|
| Use guest login only | If this is on, only the guest login option is displayed on the login screen, and users can log in only in guest mode. | iOS 14.5 or later |
| Guest login timeout | Specify a value between 1 and 60 minutes. If the device remains in an "idle state" for the specified time during a guest login, the guest is automatically logged out. When the guest logs out, all of that guest's data is deleted. | iOS 14.5 or later |
| User login timeout | Specify a value between 1 and 60 minutes. If the device remains in an "idle state" for the specified time during a user login, the user is automatically logged out. | iOS 14.5 or later |
| Time until auto-lock | Specify a value between 2 and 60 minutes. If not specified, it is set to 2 minutes. If the device remains in an "idle state" for the specified time during a user login, the device goes to sleep through auto-lock. To prevent the device from going to sleep within the time specified in Guest login timeout or User login timeout, set the time until auto-lock longer than those settings. | iOS 17 or later |