(macOS) Profile Setting Types and Descriptions

This page lists and describes the restriction items that can be configured in a macOS profile, and the settings on managed devices that can be distributed together with the profile.

Passcode

Item	Default	Description
Allow simple value	On	If turned off, adding character strings and arranging them in ascending or descending order is allowed.
Require alphanumeric value		If turned on, the passcode must contain at least one letter and at least one number.
Minimum length		Specifies the minimum password length. (1 to 16)
Minimum number of complex characters		Specifies the minimum number of non-alphanumeric characters that must be used. (1 to 4)
Maximum passcode age (1 to 730 days, or none)		The expiration period used to force periodic password changes. Specify the number of days as a number from 1 to 730.
Maximum auto-lock		Specifies the maximum time until auto-lock. 1 minute 2 minutes 3 minutes 4 minutes 5 minutes 10 minutes 15 minutes
Passcode history (1 to 50 passcodes, or none)		Specifies, as a value from 1 to 50, the number of passcode changes that must occur before a previously used passcode can be reused.
Maximum grace period for device lock		Specifies the time that can be used before the device locks. Immediately 1 minute 5 minutes 15 minutes 1 hour 4 hours

Restrictions (Functionality)

Restriction item	Default	Description	Target version	Supervised
Allow use of camera	On	If you turn this option off, the camera is disabled and the Camera icon is removed from the Home Screen. Users cannot take photos or videos or use FaceTime.	macOS 10.11 or later
Allow screenshots and screen recording	On	If you turn this option off, users cannot save screenshots or screen recordings.	macOS 10.14.4 or later
Allow AirPlay, viewing screens by Classroom, and screen sharing	On	If you turn this option off, teachers using Classroom cannot use AirPlay on or view the screens of students' iPad devices.	macOS 10.15 or later
Allow Classroom to perform AirPlay and View Screen without prompting		If you turn this option on, students do not receive a notification when a teacher uses AirPlay or View Screen on their iPad devices in a managed class.	macOS 10.14.4 or later
Allow AirDrop	On	If you turn this option off, users cannot use AirDrop.	macOS 10.13 or later	Required
Allow Siri	On	If you turn this option off, Siri cannot be used.	macOS 14.0 or later
Enable Siri profanity filter		If you turn this option off, the Siri profanity filter is disabled.	macOS 10.13 or later
Allow Siri Suggestions	On	Siri cannot provide suggestions for applications, people, places, and so on while searching.	macOS 10.11 or later
Allow iCloud Documents & Data	On	If you turn this option off, documents and data are no longer added to iCloud.	macOS 10.11 or later	Required
Allow iCloud Photos	On	If you turn this option off, users cannot use iCloud Photo Library.	macOS 10.12 or later
Allow Apple personalized advertising	On	If you turn this option off, Apple's advertising platform does not use user data to deliver personalized ads.	macOS 12.0.1 or later
Allow "Erase All Content and Settings"	On	If you turn this option off, the Erase All Content and Settings option is disabled.	macOS 12.0.1 or later
Allow installing configuration profiles	On	If you turn this option off, configuration profiles cannot be installed.	macOS 13.0 or later
Allow Classroom to lock apps and devices without prompting		If you turn this option on, teachers can lock an app open or lock a managed device without first prompting the user.	macOS 10.14.4 or later
Automatically join Classroom classes without prompting		If you turn this option on, students can join a class without prompting the teacher.	macOS 10.14.4 or later
Allow modifying account settings	On	If you turn this option off, users cannot create new accounts or change settings associated with an account, such as the user name and password.	macOS 14.0 or later	Required
Allow modifying device name	On	If you turn this option off, users cannot change the device name shown in Settings > General > About.	macOS 14.0 or later
Allow modifying passcode	On	If you turn this option off, users cannot change a passcode that has already been set.	macOS 10.13 or later	Required
Allow modifying Touch ID fingerprint/Face ID face data	On	If you turn this option off, users cannot add Touch ID/Face ID information or delete existing information.	macOS 14.0 or later
Allow modifying wallpaper	On	If you turn this option off, users cannot change the Lock Screen or Home Screen wallpaper.	macOS 10.13 or later
Allow "Find My Friends"	On	If you turn this option off, users cannot turn on the Find My Friends app feature.	macOS 10.15 or later	Required
Allow "Find My Device" in "Find My"	On	If you turn this option off, users cannot turn on the Find My Device app feature.	macOS 10.15 or later	Required
Allow USB accessories while the device is locked		If you turn this option on, users can allow USB accessories to always access the iOS device.	macOS 13.0 or later
Allow Handoff	On	If you turn this option off, users cannot use Handoff on their Apple devices.	macOS 10.15 or later
Allow sending diagnostic and usage data to Apple	On	If you turn this option off, users cannot choose to send diagnostic information to Apple.	macOS 10.13 or later
Allow modifying diagnostics settings	On	If you turn this option off, users cannot change the diagnostic data settings.	macOS 10.15 or later
Allow unlocking the device with Touch ID/Face ID	On	If you turn this option off, users cannot use Touch ID to unlock the managed device.	macOS 10.12.4 or later
Allow AutoFill for passwords	On	If you turn this option off, Password AutoFill cannot be used, and users are no longer asked whether to retrieve saved passwords from iCloud Keychain or a third-party password manager.	macOS 10.14 or later	Required
Allow unlocking with Apple Watch	On	If you turn this option off, users cannot use Apple Watch to unlock their devices.	macOS 10.12 or later
Allow proximity-based password sharing requests	On	If you turn this option off, users' devices cannot expose passwords to nearby devices by using AutoFill from nearby devices. On iOS and macOS, this feature restricts only Wi-Fi password requests.	macOS 10.14 or later
Allow password sharing	On	If you turn this option off, users cannot share passwords.	macOS 10.14 or later
Allow Define	On	If you turn this option off, users cannot double-tap to look up the definition of a word.	macOS 10.11 or later
Allow dictation	On	If you turn this option off, users cannot use dictation.	macOS 10.13 or later	Required
Defer software updates: XX days		If you turn this option on, you can prevent users from manually updating the device over a wireless connection for the specified period. When this restriction is applied, the deferral period is set to 30 days by default and can be changed to between 1 and 90 days. The deferral period starts counting down when the OS update is released. After the deferral period ends, users see a notification asking them to update the OS.	macOS 10.13.4 or later	Required
Allow installing Rapid Security Responses	On	If you turn this option off, you can prevent users from updating emergency security software from the device.	macOS 10.13 or later
Allow removing Rapid Security Responses	On	If you turn this option off, you can prevent the removal of installed Rapid Security Responses from the device.	macOS 10.13 or later

Restrictions (Apps)

Restriction item	Default	Description	Target version	Supervised
Allow use of Game Center	On	If you turn this option off, the Game Center app and its icon are removed.	macOS 10.13 or later
Allow multiplayer gaming	On	If you turn this option off, users cannot play multiplayer games in Game Center.	macOS 10.13 or later	Required
Allow adding Game Center friends	On	If you turn this option off, users cannot search for or add friends in Game Center.	macOS 10.13 or later

Global HTTP Proxy

Specify a proxy through which all HTTP traffic from managed devices is routed.

Item	Default	Description	Target version
Proxy type	Manual	Sets the type of proxy to configure as the global HTTP proxy. • Manual • Auto
Proxy server (only when the proxy type is Manual)		Enter the host name or IP address of the proxy server. This item is required.
Proxy port (only when the proxy type is Manual)		Enter the port number of the proxy server. This item is required.
User name (only when the proxy type is Manual)		Enter the user name used to connect to the proxy. This item is optional.
Password (only when the proxy type is Manual)		Enter the password used for authentication with the proxy. This item is optional.
Proxy PAC URL (only when the proxy type is Auto)		Enter the URL used to retrieve the proxy settings (the location where the proxy PAC is placed). This item is required.
Allow direct connection (only when the proxy type is Auto)		If this is not allowed and the PAC file cannot be reached, the managed device cannot connect directly to the destination. The default is not allowed.
Allow bypassing the proxy to access captive networks		If this is allowed, the managed device can display the login page of a dedicated network without going through the proxy server.

DNS Proxy

Specify a proxy through which all HTTP traffic from managed devices is routed.

Item	Default	Description	Target version
App bundle ID		Add the bundle ID of the app that contains the DNS proxy information. This item is required.
Provider bundle ID		You can add the bundle ID of the DNS proxy extension.
Provider configuration		If there is a configuration file specific to the DNS provider or network vendor, you can upload it. You can add multiple DNS proxy settings by clicking the Upload... button.

Content Filter

Item	Default	Description	Target version
Filter type		Plug-in (third-party app)
Filter name		Enter the string to display as the name of the filter settings.
Identifier		Enter the bundle ID of the plug-in that provides the filtering service.
Service address		Enter the server address (an IP address, host name, or URL).
Organization		Enter the Organization string to pass to the third-party plug-in.
User name		Enter the user name used for the service.
Password		Enter the password used for the service.
Certificate		Specify the certificate used for authentication when using the service. You can select a certificate that has been uploaded to the Certificates payload.
Filter WebKit traffic	On	If turned on, WebKit traffic is blocked.
Filter socket traffic	On	If turned on, socket traffic is blocked.
Custom data		Enter the custom data required by the filtering service plug-in.

Certificates

Setting item	Setting details
Certificate	Click Choose file to specify a certificate file.

Certificate Transparency

Setting item	Setting details
Excluded certificates	Disables enforcement of CT (Certificate Transparency) for specific certificates. For details, see the Apple website below. https://support.apple.com/en-us/guide/mdm/mdmbafaa79ff/1/web/1 Note: The URL is as of May 29, 2019. The URL and the content of the website may be changed by the website operator without notice.
Excluded domains	Specify the list of domains for which CT (Certificate Transparency) is disabled.

Wi-Fi

Setting item	Default	Setting details	Target version
SSID		Specifies the SSID of the Wi-Fi network to use. (Required)
Unofficial network		Turn this on if the Wi-Fi network to use is open or does not broadcast its SSID.
Enable auto-join	On	If turned on, the device connects to the network automatically. If not enabled, you must tap the network name to connect to the network.
Proxy settings	None	Configures the proxy settings used to connect to the network. Select from None Manual Auto
Security type	None	Specifies the type of encryption used when connecting to the Wi-Fi network. None WEP WPA/WPA2 Personal WPA2 Personal (iOS 8 or later, excluding Apple TV) WPA3 Personal (iOS 13 or later) Any (Personal) Dynamic WEP WPA/WPA2 Enterprise WPA2 Enterprise (iOS 8 or later, excluding Apple TV) WPA3 Enterprise (iOS 13 or later) Any (Enterprise)
Password		Only when the security type is WEP, WPA/WPA2 Personal, WPA2 Personal (iOS 8 or later, excluding Apple TV), or Any (Personal). Specifies the password of the Wi-Fi network to connect to.
Protocol		Only when the security type is Dynamic WEP, WPA/WPA2 Enterprise, WPA2 Enterprise (iOS 8 or later, excluding Apple TV), or Any (Enterprise). Specifies the authentication protocols supported by the Wi-Fi network. You can select more than one of the following. TLS LEAP EAP-SIM TTLS EAP-AKA PLEAP EAP-FAST EAP-FAST PAC configuration (only when EAP-FAST is selected): Use PAC: If turned on, the managed device uses an existing PAC if there is one. Provision PAC: If turned on, PAC provisioning is allowed. Provision PAC Anonymously: If turned on, the managed device is provisioned anonymously.
User name		Specifies the user name required for authentication.
Use password for each connection		If turned on, users are asked to enter the password every time they connect to the network.
Password		Enter the password for the specified user name.
Identity certificate		Specifies the credentials used to connect to the Wi-Fi network. You can select a certificate that has been uploaded to the Certificates payload.
Inner authentication	OS Default	Specifies the inner authentication used by the TTLS module. Select from the following. OS Default PAP CHAP MSCHAP MSCHAPv2 EAP(new in iOS 9 and OS X 10.11)
Outer identity		You can specify any ID to hide the user's identity from the outside. The user's real name appears only inside the encrypted tunnel, which helps improve security.
Minimum TLS version	1.0
Maximum TLS version	1.2
Allow two RANDs		If turned on, EAP-SIM authentication accepts servers that provide only two RAND values.
Trust		Specifies the certificates that are trusted and required for authentication. You can select a certificate that has been uploaded to the Certificates payload.
Trusted certificate names		Enter the name of the certificate required by the authentication server.
Network type	Standard	Specifies the network type, which determines whether the network is shown as a legacy or Passpoint hotspot. Select from the following. The default is Standard. Standard Legacy Hotspot Passpoint
Fast Lane QoS marking	Do not restrict QoS marking	Specifies whether QoS (Quality of Service) marking is restricted. Select from the following. Do not restrict QoS marking Restrict QoS marking
Enable QoS marking	On
Add Apple audio/video calling to the whitelist	On
Allow specific apps

AirPlay

Setting item	Setting details	Supervised
Password	Device name: The name of the device to connect to with AirPlay Password: The password used for the AirPlay connection
Allow	Specifies an allowlist of device IDs that can connect via AirPlay. Enter each ID in the format xx:xx:xx:xx:xx:xx.	Required

AirPrint

Setting item	Setting details
Use TLS	You can choose to encrypt data with TLS when sending it to the printer.
Host name or IP address	Enter the host name or IP address of the AirPrint printer to connect to.
Port	Enter the port of the AirPrint printer to connect to.
Resource path	Enter the resource path of the AirPrint printer to connect to.

SCEP

Setting item	Default	Setting details	Target version
URL		Enter the URL of the SCEP server. (Required)
Name		Enter any string that the SCEP server can recognize. If the certificate authority has multiple CA certificates, use this to distinguish between them.
Subject		Enter an X.500 name expressed as an array of OIDs and values. Example: /C=US/O=Apple Inc./CN=foo/1.2.5.3=bar You can use abbreviations such as country (C), locality (L), state (ST), organization (O), organizational unit (OU), and common name (CN).
Subject alternative name type	None	RFC 822 name DNS name URI (Uniform Resource Identifier)
Subject alternative name value
NT principal name
Retries	3	Specifies the number of times the managed device retries when the server returns a pending response.
Retry delay	10	Specifies the interval between retries, in seconds. The first retry is performed without this delay.
Challenge		Specifies a pre-distributed secret that is used as the shared secret for automatic enrollment.
Key size	1024	Select the key size from 1024, 2048, and 4096 (bits). Note: A 4096-bit key size is not supported on iOS 13 or earlier, or iPadOS 13 or earlier.
Use as digital signature		Turn this on to use the key for digital signatures.
Use for key encipherment		Turn this on to use the key for encryption.
Fingerprint		Enter the hexadecimal characters to use as the fingerprint, or upload a certificate file to create the fingerprint.

Fonts

Setting item	Setting details
Font	Specifies the font file to distribute.

Domains

Item	Description	Target version	Supervised
Unmarked email domains	Email addresses whose suffix does not match any of the strings specified here are treated as being outside the domain.

VPN

Configures how managed devices connect to the wireless network via VPN, including the required authentication information.

Item	Description
Connection name	The display name of the connection on the device.
Connection type	The method used to establish the VPN connection. After you select one of these VPN methods, the Server and Account options change to suit that specific method.
Server	The host name or IP address of the VPN gateway server.
Account	The user account required to authenticate the connection.
User authentication	The method of user authentication. When using certificate authentication, use the Credentials field that appears to link to the Certificates or SCEP settings in the same VPN configuration profile.
Send all traffic through VPN	Forces all network traffic to be sent through the VPN connection.
Machine authentication	The type of authentication required. For L2TP, select Shared Secret or Certificate and enter the appropriate settings. Other types of VPN connection methods use different machine authentication settings.
Shared secret	The shared secret used to connect.
Proxy settings	Configures the proxy used for this VPN connection.

Notifications

You can configure notification settings for each application.

Item	Default	Description
Notification settings		Click Add Per App Settings to display the notification settings for each app.
Package name		Enter the bundle ID of the application to which the notification settings apply. (Required)
Allow notifications	On	If not checked, notifications are not allowed for this application.
Show in Notification Center	On	If not checked, notifications for this application are not shown in Notification Center.
Sounds	On	If not checked, notifications for this application cannot play sounds.
Badge app icon	On	If not checked, badges are not allowed on this application's icon.
Show on Lock Screen	On	If not checked, notifications for this application are not shown on the Lock Screen.
Critical alerts		If checked, push notification sounds can play even when other notifications are muted.
Notification style when unlocked	Banners	Specifies the notification style used when the device is unlocked. Select from the following. • None • Banners • Alerts

Note: Due to macOS specifications, the BizMobile Go! admin console cannot identify macOS devices that violate the passcode policy.