(tvOS) Profile Setting Types and Details

tvOS

This page describes the restriction items that you can configure in a tvOS profile, and lists and describes the settings that can be distributed to managed devices together with the profile.
For the supported OS versions of each feature and whether the device must be in supervised mode, see the tables below.

Restrictions (Features)

Restriction item	Default	Description	Target version	Supervised
Force automatic date and time		If you turn this option on, users cannot turn off automatic date and time.	tvOS 12.2 or later	Required
Allow modifying device name	On	If you turn this option off, users can no longer change the device name.	tvOS 11.0 or later	Required
Allow proximity-based password sharing requests	On	If you turn this option off, users can no longer share passwords.	tvOS 12.0 or later	Required
Allow pairing with Remote App	On	If you turn this option off, users can no longer control the Apple TV with the Apple TV Remote App.	tvOS 10.2 or later	Required
Allow receiving AirPlay requests	On	If you turn this option off, the device can no longer receive AirPlay requests.	tvOS 10.2 or later	Required
Allow device sleep	On	If you turn this option off, neither users nor tvOS can put the device to sleep.	tvOS 13 or later	Required
Defer software updates		If you turn this option on, you can prevent users from manually updating the device over a wireless connection for the specified period. When this restriction is applied, the deferral period is set to 30 days by default, and you can change it to between 1 and 90 days. The deferral period counts down from the time the OS update is released. After the deferral period passes, users see a notification prompting them to update the OS.	tvOS 12.2 or later

Restrictions (Apps)

Restriction item	Default	Description	Target version	Supervised
Restrict app usage	Allow all apps	Allows apps other than Settings to be added to the allowlist. You can select from the following options. Allow all apps Do not allow some apps: a blocklist of applications that cannot be used Allow only some apps: an allowlist of applications that can be used	tvOS 11.0 or later	Required

Restrictions (Media Content)

Item	Default	Details	Target version	Supervised
Ratings region	United States	Select the ratings region from the following. - United States - Australia - Canada - Germany - France - Ireland - Japan - New Zealand - United Kingdom	tvOS 11.3 or later
Allowed content ratings		Set the maximum rating to allow
Movies	Allow all movies	Select an appropriate rating from the list of ratings for the country selected in Ratings region. If you select Do not allow movies, the corresponding movies no longer appear in Videos. - Do not allow movies - G - PG-12 - R-15 - R-18 - Allow all movies	tvOS 11.3 or later
TV shows	Allow all TV shows	Select an appropriate rating from the list of ratings for the country selected in Ratings region. - Do not allow TV shows - Explicit Allowed - Allow all TV shows"
Apps	Allow all apps	Select from the following. - Do not allow apps - 4+ - 9+ - 12+ - 17+ - Allow all apps
Allow music, podcasts, and iTunes U media with explicit content	On	If you turn this option off, explicit music and video content purchased from the iTunes Store or listed in iTunes U is hidden. Whether content is explicit is specified by the content provider (such as a record label) when the content is sold in the iTunes Store or distributed in iTunes U.	tvOS 11.3 or later
Allow books with explicit sexual content in the iBooks Store	On	If you turn this option off, explicit sexual content purchased from the iBooks Store is hidden. Whether content is explicit is specified by the content provider when the content is sold in the iBooks Store.	tvOS 11.3 or later

Global HTTP Proxy (Supervised only)

Specify a proxy through which all HTTP traffic from managed devices is routed.

Item	Default	Details
Proxy type	Manual	Sets the type of proxy to use for the global HTTP proxy. - Manual - Automatic
Proxy server (only when the proxy type is Manual)		Enter the host name or IP address of the proxy server. This item is required.
Proxy port (only when the proxy type is Manual)		Enter the port number of the proxy server. This item is required.
User name (only when the proxy type is Manual)		Enter the user name used to connect to the proxy. This item is optional.
Password (only when the proxy type is Manual)		Enter the password used to authenticate with the proxy. This item is optional.
Proxy PAC URL (only when the proxy type is Automatic)		Enter the URL used to retrieve the proxy settings (the location of the proxy PAC). This item is required.
Allow direct connection (only when the proxy type is Automatic)		If this is not allowed and the PAC file cannot be reached, the managed device cannot connect directly to the destination. The default is not allowed.
Allow bypassing the proxy to access captive networks		If this is allowed, the managed device can display the login page of a dedicated network without going through the proxy server.

Certificates

Setting	Details
Certificate	Click Choose file to specify a certificate file.

Wi-Fi

Setting	Default	Details
SSID		Specify the SSID of the Wi-Fi network to use. (Required)
Hidden Network		Turn this on if the Wi-Fi network to use is not open or not broadcast.
Enable auto-join	On	If this is on, the device connects to the network automatically. If this is not enabled, users must tap the network name to connect to the network.
Disable captive network detection		If this is on, captive network detection is disabled when the managed device connects to the network.
Disable MAC randomization to avoid association		If this is on, a non-private MAC address is used to connect to this Wi-Fi network.
Proxy setup	None	Configure the proxy settings used to connect to the network. None Manual Automatic Select from the above.
Server		Only when the proxy setup is Manual. Specify the host name or IP address of the proxy server. (Required)
Port		Only when the proxy setup is Manual. Specify the port number of the proxy server.
User name		Only when the proxy setup is Manual. Specify the user name used to authenticate with the proxy server.
Password		Only when the proxy setup is Manual. Specify the password used to authenticate with the proxy server.
Proxy server URL		Only when the proxy setup is Automatic. Specify the URL of the PAC file that defines the proxy settings.
Allow direct connection if PAC is unreachable	On	Only when the proxy setup is Automatic. If this item is off and the PAC file cannot be reached, the managed device cannot connect directly to the destination.
Security type	None	Specify the type of encryption used when connecting to the Wi-Fi network. None WEP WPA/WPA2 Personal WPA2 Personal (iOS 8 or later, except Apple TV) WPA3 Personal (iOS 13 or later) Any (Personal) Dynamic WEP WPA/WPA2 Enterprise WPA2 Enterprise (iOS 8 or later, except Apple TV) WPA3 Enterprise (iOS 13 or later) Any (Enterprise)
Password		Only when the security type is one of WEP, WPA/WPA2 Personal, WPA2 Personal (iOS 8 or later, except Apple TV), or Any (Personal). Specify the password of the Wi-Fi network to connect to.
Protocols		Only when the security type is one of Dynamic WEP, WPA/WPA2 Enterprise, WPA2 Enterprise (iOS 8 or later, except Apple TV), or Any (Enterprise). Specify the authentication protocols supported by the Wi-Fi network. You can select more than one of the following. TLS LEAP EAP-SIM TTLS EAP-AKA PLEAP EAP-FAST EAP-FAST PAC configuration (only when EAP-FAST is selected): Use PAC: If this is on, the managed device uses an existing PAC if there is one. Provision PAC: If this is on, PAC provisioning is allowed. Provision PAC Anonymously: If this is on, the managed device is provisioned anonymously.
User name		Specify the user name required for authentication.
Use password for every connection		If this is on, users are asked to enter the password every time they connect to the network.
Password		Enter the password for the specified user name.
Identity certificate		Specify the credentials used to connect to the Wi-Fi network. You can select a certificate uploaded to the Certificates payload.
Inner authentication	OS Default	Specify the inner authentication used by the TTLS module. Select from the following. OS Default PAP CHAP MSCHAP MSCHAPv2 EAP(new in iOS 9 and OS X 10.11)
Outer identity		You can specify any identity to show externally so that the user's identity stays hidden. The user's real name appears only inside the encrypted tunnel, which helps improve security.
Allow two RANDs		If this is on, EAP-SIM authentication accepts servers that provide only two RAND values.
Trusted certificates		Specify the certificates trusted and required for authentication. You can select a certificate uploaded to the Certificates payload.
Trusted certificates		Enter the name of the certificate required by the authentication server.
Network type	Standard	Specify the network type, which determines whether the network is displayed as a legacy or Passpoint hotspot. Select from the following. The default is Standard. Standard Legacy Hotspot Passpoint
Fast Lane QoS Marking	Do not restrict QoS marking	Specify whether to restrict QoS (Quality of Service) marking. Select from the following. Do not restrict QoS marking Restrict QoS marking
Enable QoS marking	On
Whitelist Apple audio/video calling	On
Whitelist specific apps

AirPlay Security (Supervised only)

tvOS 10.2-

Setting	Details
Access	You can select the network requirements for devices that connect to the Apple TV using AirPlay. Devices on any Wi-Fi network Devices on the same Wi-Fi network
Security	You can select the security requirements for devices that connect to the Apple TV using AirPlay. Passcode once Passcode Password

SCEP

Setting	Default	Details
URL		Enter the URL of the SCEP server. (Required)
Name		Enter any string that the SCEP server can recognize. If the certificate authority has multiple CA certificates, use this to distinguish between them.
Subject		Enter an X.500 name expressed as an array of OIDs and values. Example: /C=US/O=Apple Inc./CN=foo/1.2.5.3=bar You can use abbreviations such as country (C), locality (L), state (ST), organization (O), organizational unit (OU), and common name (CN).
Subject alternative name type	None	RFC 822 Name DNS Name URI (Uniform Resource Identifier)
Subject alternative name value
NT principal name
Retries	3	Specify the number of times the managed device retries when the server returns a pending response.
Retry delay	10	Specify the interval between retries, in seconds. The first retry is performed without this delay.
Challenge		Specify a pre-distributed secret key used as the shared secret for automatic enrollment.
Key size	1024	Select the key size from 1024, 2048, and 4096 (bits). Note: A key size of 4096 bits is not supported on tvOS 13 or earlier.
Use as digital signature		Turn this on to use the key for digital signatures.
Use for key encipherment		Turn this on to use the key for encryption.
Fingerprint		Enter the hexadecimal characters to use as the fingerprint, or upload a certificate file to create the fingerprint.

Conference Room Display (Supervised only)

Setting	Details
Custom message	You can set the message displayed on the screen in Conference Room Display mode.

TV Remote (Supervised only)

Setting	Details
Allowed remotes (tvOS only)	Add a device's MAC address to the list to allow remote control from that iOS device.

Home Screen Layout

You can configure the Home Screen layout of managed devices in bulk by using profile settings.
Note: tvOS does not support the Dock.

Single App Mode (Supervised only)

The single application specified here is forced to launch in the foreground on the managed device, and other applications cannot be used.

Item		Default	Details
Identifier			Enter the identifier of the app to set in Single App Mode. You can also search by application name or App Store ID.
Options	Disable auto-lock		If this is on, auto-lock is disabled.
	Enable invert colors		If this is on, invert colors is enabled.
	Disable touch input		If this is on, all touch input on the device is disabled.
	Enable VoiceOver		If this is on, VoiceOver reads aloud a description of what is displayed on the screen.
	Enable zoom		If this is on, content on the screen is magnified so that it is easier to see.

Device Name (Supervised only)

You can set the device name.
If Allow modifying device name in the Restrictions payload is Off, you cannot set the device name. Turn it On first.

Item	Details
Value to use for the device name	You can select the device name to use for the setting from the following. (The name displayed in Settings > General > About > Name on the managed device) Use the Identifier from the device information Use the Name from the device information