The top-level payload properties for all profiles.
| Setting | Type | Required | Default | Manual Install | Supported OS |
|---|---|---|---|---|---|
PayloadIdentifier PayloadIdentifier The reverse-DNS style identifier (`com.example.myprofile`, for example) that identifies the profile. The system uses this string to determine whether to replace an existing profile or add it as a new profile. | string | required | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) |
PayloadUUID PayloadUUID The globally unique identifier for the profile. The actual content is unimportant. In macOS, you can use `uuidgen` to generate reasonable UUIDs. | string | required | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) |
PayloadType PayloadType The type of payload. The only supported value is `Configuration`. | string | required | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) |
PayloadVersion PayloadVersion The version number of the profile format, which needs to be `1`. This number represents the version of the configuration profile as a whole, not of the individual profiles within it. | integer | required | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) |
PayloadContent PayloadContent The array of payload dictionaries. If `IsEncrypted` is `true`, this array isn't needed. 1 subkey | array | required | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) |
└─ PayloadContentItem PayloadContentItem The payload-specific content for this profile. 1 subkey | dictionary | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) | |
└─ └─ ANY ANY A payload item as defined by each payload type. | any | required | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) |
EncryptedPayloadContent EncryptedPayloadContent Enabled if `IsEncrypted` is `true`. | data | optional | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) |
PayloadDescription PayloadDescription The description of the profile, shown on the Detail screen for the profile. Make this description detailed enough to help the user decide whether to install the profile. | string | optional | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) |
PayloadDisplayName PayloadDisplayName The human-readable name for the profile, which doesn't need to be unique. The system displays this value on the Detail screen. | string | optional | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) |
PayloadOrganization PayloadOrganization The human-readable string that contains the name of the organization that provided the profile. | string | optional | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) |
PayloadRemovalDisallowed PayloadRemovalDisallowed If present and set to `true`, the user can't delete the profile unless the profile has a removal password and the user provides it.
On macOS 10.15 and later, this key only affects removal of _manually_ installed profiles. If set to `true` and no profile removal payload is present, removing the profile requires admin auth.
On macOS versions prior to 10.15, this key prevents admins from removing MDM installed profiles. However, as of macOS 10.15, users can never remove MDM profiles, not even the admin.
On iOS users can't remove a MDM profile.
Requires a supervised device. | boolean | optional | false | ✗No | |
PayloadScope PayloadScope A string that defines whether to install the profile for the system or the user. In many cases, it determines the location of certificate items, such as keychains. Though it's not possible to declare different payload scopes, payloads like VPN can automatically install their items in both scopes, if needed. | string | optional | — | ✓Yes | macOS (10.8+) |
RemovalDate RemovalDate The date when the system automatically removes the profile. | date | optional | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) |
DurationUntilRemoval DurationUntilRemoval The number of seconds until the profile is automatically removed. If the `RemovalDate` key is present, the system uses whichever field yields the earliest date. | real | optional | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) |
PayloadExpirationDate PayloadExpirationDate The date when a profile is no longer valid and the system presents an update button to the user. | date | optional | — | ✗No | |
TargetDeviceType TargetDeviceType The type of platform of the target device. Specifying the platform type helps prevent unintended installations.
For interactive installations on iOS devices, specifying a target platform avoids interstitial alerts that prompt the user to choose a profile target when multiple targets are eligible.
Allowed values:
- `0`: Any/unspecified
- `1`: iPhone/iPad/iPod Touch
- `2`: Apple Watch
- `3`: HomePod
- `4`: Apple TV
- `5`: Mac
- `6`: Vision Pro | integer | optional | 0 | ✓Yes | iOS (12.2+)macOS (10.15+)tvOS (12.2+)visionOS (1.1+)watchOS (5.2+) |
ConsentText ConsentText A dictionary that includes:
- A key that contains the IETF BCP 47 identifier for a language, such as _en_ or _jp_
- A value that contains the agreement localized to language specified by the key
The dictionary can also contain an optional key, `default`, with its value consisting of the unlocalized (usually in _en_) agreement.
The system always displays the agreement in a dialog, and the user needs to agree before the system can install the profile.
The system chooses a localized version in the order of preference that the user specifies in macOS, or based on the user's current language setting in iOS. If there's no exact match, the system uses the default localization. If there's no default localization, the system uses the _en_ localization. If there's no _en_ localization, the system uses the first available localization.
> Tip:
> Provide a default value, if possible. The system won't display a warning if the user's locale doesn't match any localization in the `ConsentText` dictionary. 1 subkey | dictionary | optional | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) |
└─ ConsentTextItem ConsentTextItem The dictionary containing a key that consists of the IETF BCP 47 identifier for a language (for example, en or jp) and a value that consists of the agreement localized to that language. 1 subkey | dictionary | required | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) |
└─ └─ ANY ANY The key consisting of the IETF BCP 47 identifier for a language (for example, en or jp) and the value consisting of the agreement localized to that language. | string | required | — | ✓Yes | iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.0+)watchOS (1.0+) |
