Restrictions (com.apple.applicationaccess)

com.apple.applicationaccess

The payload that configures restrictions on a device.

iOS(4.0)macOS(10.7)tvOS(9.0)visionOS(1.1)watchOS(10.0)

Branch: release

Settings (218)

Setting	Type	Required	Default	Manual Install	Supported OS
allowAccountModification allowAccountModification If `false`, the system disables modification of accounts, such as Apple Accounts, and internet-based accounts, such as Mail, Contacts, and Calendar.	boolean	optional	`true`	✓Yes	iOS (7.0+)macOS (14.0+)visionOS (2.0+)
Allow Handoff allowActivityContinuation If `false`, the system disables activity continuation. Support for this restriction on unsupervised devices and with Managed Apple Accounts is deprecated. In a future release, this restriction will begin requiring supervision and will apply to personal Apple Accounts only.	boolean	optional	`true`	✓Yes	iOS (8.0+)macOS (10.15+)visionOS (2.0+)
Allow Adding Game Center Friends allowAddingGameCenterFriends If `false`, the system prohibits adding friends to Game Center. Requires a supervised device in iOS 13 and later.	boolean	optional	`true`	✓Yes	iOS (4.2.1+)macOS (10.13+)
allowAirDrop allowAirDrop If `false`, the system disables AirDrop.	boolean	optional	`true`	✓Yes	iOS (7.0+)macOS (10.13+)visionOS (2.0+)
Allow incoming AirPlay requests allowAirPlayIncomingRequests If `false`, the system disables incoming AirPlay requests.	boolean	optional	`true`	✓Yes	macOS (12.3+)tvOS (10.2+)
Allow AirPrint allowAirPrint If `false`, the system disables AirPrint.	boolean	optional	`true`	✓Yes	iOS (11.0+)
Allow storage of AirPrint credentials in Keychain allowAirPrintCredentialsStorage If `false`, the system disables Keychain storage of user name and password for AirPrint.	boolean	optional	`true`	✓Yes	iOS (11.0+)
Allow discovery of AirPrint printers using iBeacons allowAirPrintiBeaconDiscovery If `false`, the system disables iBeacon discovery of AirPrint printers, which prevents spurious AirPrint Bluetooth beacons from phishing for network traffic.	boolean	optional	`true`	✓Yes	iOS (11.0+)
Allow Modifying Cellular Data Usage for Apps Settings allowAppCellularDataModification If `false`, the system disables changing settings for cellular data usage for apps.	boolean	optional	`true`	✓Yes	iOS (7.0+)
Allow App Clips allowAppClips If `false`, the system prevents a user from adding any App Clips, and removes any existing App Clips on the device.	boolean	optional	`true`	✓Yes	iOS (14.0+)
Allow App Installation allowAppInstallation If `false`, the system disables the App Store and removes its icon from the Home Screen. Users are unable to install or update their apps. This applies to App Store apps, marketplace apps, and locally installed apps (using Configurator, Xcode, and so forth). In iOS 10 and later, MDM commands can override this restriction. Requires a supervised device in iOS 13 and later.	boolean	optional	`true`	✓Yes	visionOS (2.0+)
Allow Apple Intelligence Report allowAppleIntelligenceReport If `false`, the system disables Apple Intelligence reports.	boolean	optional	`true`	✓Yes	iOS (18.4+)macOS (15.4+)
allowApplePersonalizedAdvertising allowApplePersonalizedAdvertising If `false`, the system limits Apple personalized advertising.	boolean	optional	`true`	✓Yes	iOS (14.0+)macOS (12.0+)visionOS (2.0+)
Allow App Removal allowAppRemoval If `false`, the system disables removal of apps from an iOS device. This applies to App Store apps, marketplace apps, and locally installed apps (using Configurator, Xcode, and so forth).	boolean	optional	`true`	✓Yes	iOS (4.2.1+)
Allow Hiding Apps allowAppsToBeHidden If `false`, disables the ability for the user to hide apps. It doesn't affect the user's ability to leave it in the App Library, while removing it from the Home Screen.	boolean	optional	`true`	✓Yes	iOS (18.0+)
Allow Locking Apps allowAppsToBeLocked If `false`, disables the ability for the user to lock apps. Because hiding apps also requires locking them, disallowing locking also disallows hiding.	boolean	optional	`true`	✓Yes	iOS (18.0+)
Allow modifying Remote Management Sharing setting allowARDRemoteManagementModification If `false`, the system prevents modifying the Remote Management Sharing setting in System Settings.	boolean	optional	`true`	✓Yes	macOS (14.0+)
Allow Siri allowAssistant If `false`, the system disables Siri.	boolean	optional	`true`	✓Yes	iOS (5.0+)macOS (14.0+)visionOS (2.0+)
allowAssistantUserGeneratedContent allowAssistantUserGeneratedContent If `false`, the system prevents Siri from querying user-generated content from the web.	boolean	optional	`true`	✓Yes	iOS (7.0+)
Allow Siri While Locked allowAssistantWhileLocked If `false`, the system disables Siri when the device is locked. The system ignores this restriction if the device doesn't have a passcode set.	boolean	optional	`true`	✓Yes	iOS (5.1+)
Allow Auto Correction allowAutoCorrection If `false`, the system disables keyboard autocorrection.	boolean	optional	`true`	✓Yes	iOS (8.1.3+)
Allow Auto Dim allowAutoDim If `false`, disables auto dim on iPads with OLED displays.	boolean	optional	`true`	✓Yes	iOS (17.4+)
Allow Automatic App Downloads allowAutomaticAppDownloads If `false`, the system prevents automatic downloading of apps purchased on other devices. This setting doesn't affect updates to existing apps.	boolean	optional	`true`	✓Yes	iOS (9.0+)
allowAutomaticScreenSaver allowAutomaticScreenSaver If `false`, the system disables Apple TV's automatic screen saver.	boolean	optional	`true`	✓Yes	tvOS (15.4+)
allowAutoUnlock allowAutoUnlock If `false`, the system disallows auto unlock. Support for this restriction on unsupervised devices is deprecated.	boolean	optional	`true`	✓Yes	iOS (14.5+)macOS (10.12+)
Allow modifying Bluetooth settings allowBluetoothModification If `false`, the system prevents modification of Bluetooth settings.	boolean	optional	`true`	✓Yes	iOS (11.0+)macOS (13.0+)
Allow modifying Bluetooth Sharing setting allowBluetoothSharingModification If `false`, the system prevents modifying Bluetooth settings in System Settings.	boolean	optional	`true`	✓Yes	macOS (14.0+)
Allow Bookstore allowBookstore If `false`, the system removes the Book Store tab from the Books app.	boolean	optional	`true`	✓Yes	iOS (6.0+)macOS (15.0+)
Allow Bookstore Erotica allowBookstoreErotica Deprecated (tvOS 17.0) If `false`, the system prevents the user from downloading Apple Books media that's tagged as erotica. Support for this restriction on unsupervised devices is deprecated.	boolean	optional	`true`	✓Yes	iOS (6.0+)macOS (15.0+)tvOS (11.3 - 17.0)
Allow Call Recording allowCallRecording If `false`, disables call recording.	boolean	optional	`true`	✓Yes	iOS (18.1+)macOS (26.0+)
Allow Camera Use allowCamera If `false`, the system disables the camera and removes its icon from the Home Screen, and users are unable to take photographs. Support for this restriction on unsupervised devices is deprecated.	boolean	optional	`true`	✓Yes	macOS (10.11+)tvOS (17.0+)visionOS (2.0+)
allowCellularPlanModification allowCellularPlanModification If `false`, the system prevents users from changing settings related to their cellular plan (available only on select carriers).	boolean	optional	`true`	✓Yes	iOS (11.0+)
Allow use of iMessage allowChat If `false`, the system disables the use of iMessage with supervised devices. If the device supports text messaging, the user can still send and receive text messages.	boolean	optional	`true`	✓Yes	iOS (5.0+)
allowCloudAddressBook allowCloudAddressBook If `false`, the system disables iCloud Contacts services.	boolean	optional	`true`	✓Yes	macOS (10.12+)
Allow iCloud Backup allowCloudBackup If `false`, the system disables backing up the device to iCloud. Support for this restriction on unsupervised devices is deprecated.	boolean	optional	`true`	✓Yes	iOS (5.0+)visionOS (2.0+)
allowCloudBookmarks allowCloudBookmarks If `false`, the system disables iCloud Bookmark sync.	boolean	optional	`true`	✓Yes	macOS (10.12+)
allowCloudCalendar allowCloudCalendar If `false`, the system disables iCloud Calendar services.	boolean	optional	`true`	✓Yes	macOS (10.12+)
allowCloudDesktopAndDocuments allowCloudDesktopAndDocuments If `false`, the system disables iCloud Desktop and Document services.	boolean	optional	`true`	✓Yes	macOS (10.12.4+)
Allow iCloud Document Sync allowCloudDocumentSync If `false`, the system disables document and key-value syncing to iCloud. Requires a supervised device in iOS 13 and later, and Shared iPad doesn't support it. Support for this restriction on unsupervised devices and with Managed Apple Accounts is deprecated.	boolean	optional	`true`	✓Yes	iOS (5.0+)macOS (10.11+)visionOS (2.0+)
allowCloudFreeform allowCloudFreeform If `false`, the system disallows iCloud Freeform services.	boolean	optional	`true`	✓Yes	macOS (14.0+)
allowCloudKeychainSync allowCloudKeychainSync If `false`, the system disables iCloud Keychain synchronization. Support for this restriction on unsupervised devices and with Managed Apple Accounts is deprecated.	boolean	optional	`true`	✓Yes	iOS (7.0+)macOS (10.12+)visionOS (2.0+)
allowCloudMail allowCloudMail If `false`, the system disables iCloud Mail services.	boolean	optional	`true`	✓Yes	macOS (10.12+)
allowCloudNotes allowCloudNotes If `false`, the system disables iCloud Notes services.	boolean	optional	`true`	✓Yes	macOS (10.12+)
Allow iCloud Photo Library allowCloudPhotoLibrary If `false`, the system disables iCloud Photo Library. The system removes any photos from local storage that aren't fully downloaded from iCloud Photo Library to the device. Support for this restriction on unsupervised devices and with Managed Apple Accounts is deprecated.	boolean	optional	`true`	✓Yes	iOS (9.0+)macOS (10.12+)visionOS (2.0+)
allowCloudPrivateRelay allowCloudPrivateRelay If `false`, the system disables iCloud Private Relay. Support for this restriction on unsupervised devices and with Managed Apple Accounts is deprecated.	boolean	optional	`true`	✓Yes	iOS (15.0+)macOS (12.0+)visionOS (2.0+)
allowCloudReminders allowCloudReminders If `false`, the system disables iCloud Reminder services.	boolean	optional	`true`	✓Yes	macOS (10.12+)
allowContentCaching allowContentCaching If `false`, the system disables content caching. This restriction is not supported on the user channel.	boolean	optional	`true`	✓Yes	macOS (10.13+)
Allow Continuous Path Keyboard allowContinuousPathKeyboard If `false`, the system disables QuickPath keyboard.	boolean	optional	`true`	✓Yes	iOS (13.0+)
Allow default browser modification allowDefaultBrowserModification If `false`, disables default browser preference modification. The MDM Settings command to set the default browser preference still works when applying this.	boolean	optional	`true`	✓Yes	iOS (18.2+)
Allow default calling app modification allowDefaultCallingAppModification If `false`, disables default calling app preference modification. The MDM Settings command to set the default calling app preference still works when applying this.	boolean	optional	`true`	✓Yes	iOS (18.4+)
Allow default messaging app modification allowDefaultMessagingAppModification If `false`, disables default messaging app preference modification. The MDM Settings command to set the default messaging app preference still works when applying this.	boolean	optional	`true`	✓Yes	iOS (18.4+)
Allow Define allowDefinitionLookup If `false`, the system disables definition lookup.	boolean	optional	`true`	✓Yes	iOS (8.1.3+)macOS (10.11+)
Allow Modifying Device Name allowDeviceNameModification If `false`, the system prevents the user from changing the device name.	boolean	optional	`true`	✓Yes	iOS (9.0+)macOS (14.0+)tvOS (11.0+)visionOS (2.0+)
Allow Device Sleep allowDeviceSleep If `false`, the system prevents the device from automatically sleeping.	boolean	optional	`true`	✓Yes	tvOS (13.0+)
Allow diagnostic submission allowDiagnosticSubmission If `false`, the system prevents the device from automatically submitting diagnostic reports to Apple.	boolean	optional	`true`	✓Yes	iOS (6.0+)macOS (10.13+)visionOS (2.0+)
Allow modifying diagnostics settings allowDiagnosticSubmissionModification If `false`, the system disables changing the diagnostic submission and app analytics settings in the Diagnostics & Usage UI in Settings.	boolean	optional	`true`	✓Yes	iOS (9.3.2+)visionOS (2.0+)
Allow dictation allowDictation If `false`, the system disallows dictation input.	boolean	optional	`true`	✓Yes	iOS (10.3+)macOS (10.13+)
Allowed Exceptions to Camera Restriction allowedCameraRestrictionBundleIDs If present, the system exempts apps with bundle IDs in the array from the `allowCamera` restriction. The system doesn't grant these apps access to the camera automatically; they're only exempted from the `allowCamera` restriction. This key has no effect when the camera isn't restricted. Multiple payloads combine using an intersect operation. Requires a supervised device. 1 subkey	array	optional	—	✗No	iOS (26.0+)
└─ Bundle ID to be excepted bundleIDException	string		—	✓Yes	iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.1+)watchOS (10.0+)
Allowed External Intelligence Workspace IDs allowedExternalIntelligenceWorkspaceIDs An array of strings, but currently restricted to a single element. If present, Apple Intelligence allows use of only the given external integration workspace ID, and requires a sign-in to make requests. The user is required to sign in to integrations that support signing in. Multiple payloads combine using an intersect operation. This means the allowed set of workspace IDs can become the empty set if multiple payloads specify conflicting values. 1 subkey	array	optional	—	✗No	iOS (18.3+)macOS (15.3+)visionOS (2.4+)
└─ Allowed Workspace ID allowedWorkspaceID	string		—	✓Yes	iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.1+)watchOS (10.0+)
Allow Configuring Restrictions or ScreenTime allowEnablingRestrictions If `false`, the system disables the Enable Restrictions option in the Restrictions UI in Settings. If `false` in iOS 12 and later, the system disables the Enable ScreenTime option in the ScreenTime UI in Settings and disables ScreenTime if already enabled.	boolean	optional	`true`	✓Yes	iOS (8.0+)visionOS (2.0+)
Allow Trusting Enterprise Apps allowEnterpriseAppTrust If `false`, the system removes the Trust Enterprise Developer button in Settings > General > VPN & Device Management, which prevents provisioning apps by universal provisioning profiles. This restriction applies to free developer accounts and enterprise app developers that aren't implicitly trusted by apps that install through MDM. This restriction doesn't revoke previously granted trust.	boolean	optional	`true`	✓Yes	iOS (9.0+)visionOS (2.0+)
Allow Enterprise Books Backup allowEnterpriseBookBackup If `false`, the system disables backup of Enterprise books.	boolean	optional	`true`	✓Yes	iOS (8.0+)
Allow Enterprise Books Notes and Highlights Sync allowEnterpriseBookMetadataSync If `false`, the system disables sync of Enterprise books, notes, and highlights.	boolean	optional	`true`	✓Yes	iOS (8.0+)
Allow Erase All Content and Settings allowEraseContentAndSettings If `false`, the system disables the Erase All Content and Settings option in the Reset UI.	boolean	optional	`true`	✓Yes	iOS (8.0+)macOS (12.0+)visionOS (2.0+)
Allow eSIM Modification allowESIMModification If `false`, the system disables modifications of eSIMs.	boolean	optional	`true`	✓Yes	iOS (12.1+)
Allow eSIM Outgoing Transfers allowESIMOutgoingTransfers If `false`, prevents the transfer of an eSIM from the device on which the restriction is installed to a different device.	boolean	optional	`true`	✓Yes	iOS (18.0+)
Allow Explicit Content allowExplicitContent If `false`, the system hides explicit music or video content purchased from the iTunes Store. The system marks explicit content as such by content providers, such as record labels, when sold through the iTunes Store. Explicit content in the News and Podcast apps is also hidden. Requires a supervised device in iOS 13 and later. Support for this restriction on unsupervised devices is deprecated.	boolean	optional	`true`	✓Yes	macOS (15.0+)tvOS (11.3+)
Allow external intelligence integrations allowExternalIntelligenceIntegrations If `false`, disables the use of external, cloud-based intelligence services with Siri. In iOS, this restriction is temporarily allowed on unsupervised and user enrollments. In a future release, this restriction will require supervision, and will be ignored on unsupervised devices.	boolean	optional	`true`	✓Yes	iOS (18.2+)macOS (15.2+)visionOS (2.4+)
Allow external intelligence integrations sign-in allowExternalIntelligenceIntegrationsSignIn If `false`, forces external intelligence providers into anonymous mode. If a user is already signed in to an external intelligence provider, applying this restriction signs them out when attempting the next request.	boolean	optional	`true`	✓Yes	iOS (18.2+)macOS (15.2+)visionOS (2.4+)
Allow modifying File Sharing setting allowFileSharingModification If `false`, the system prevents modifying File Sharing setting in System Settings.	boolean	optional	`true`	✓Yes	macOS (14.0+)
allowFilesNetworkDriveAccess allowFilesNetworkDriveAccess If `false`, the system prevents connecting to network drives in the Files app.	boolean	optional	`true`	✓Yes	iOS (13.1+)visionOS (2.0+)
allowFilesUSBDriveAccess allowFilesUSBDriveAccess If `false`, the system prevents connecting to any connected USB devices in the Files app.	boolean	optional	`true`	✓Yes	iOS (13.0+)
allowFindMyDevice allowFindMyDevice If `false`, the system disables Find My Device in the Find My app.	boolean	optional	`true`	✓Yes	iOS (13.0+)macOS (10.15+)
allowFindMyFriends allowFindMyFriends If `false`, the system disables Find My Friends in the Find My app.	boolean	optional	`true`	✓Yes	iOS (13.0+)macOS (10.15+)
allowFindMyFriendsModification allowFindMyFriendsModification If `false`, the system disables changes to Find My Friends.	boolean	optional	`true`	✓Yes	iOS (7.0+)
Allow Touch ID to Unlock Device allowFingerprintForUnlock If `false`, the system prevents Touch ID, Face ID, or Optic ID from unlocking a device. Support for this restriction on unsupervised devices is deprecated.	boolean	optional	`true`	✓Yes	iOS (7.0+)macOS (10.12.4+)visionOS (2.0+)
Allow Modifying Touch ID Fingerprints allowFingerprintModification If `false`, the system prevents the user from modifying Touch ID or Face ID.	boolean	optional	`true`	✓Yes	iOS (8.3+)macOS (14.0+)visionOS (2.0+)
Allow Game Center allowGameCenter If `false`, the system disables Game Center, and the system removes its icon from the Home Screen.	boolean	optional	`true`	✓Yes	iOS (6.0+)macOS (10.13+)
Allow Genmoji allowGenmoji If `false`, prohibits creating new Genmoji.	boolean	optional	`true`	✓Yes	iOS (18.0+)macOS (15.0+)visionOS (2.4+)
Allow Automatic Sync While Roaming allowGlobalBackgroundFetchWhenRoaming If `false`, the system disables global background fetch activity when an iOS phone is roaming. Support for this restriction on unsupervised devices is deprecated.	boolean	optional	`true`	✗No
allowHostPairing allowHostPairing If `false`, the system disables host pairing with the exception of the supervision host. If there's no configured supervision host certificate, the system disables all pairing. Host pairing lets the administrator control whether an iOS device can pair with a host Mac or PC.	boolean	optional	`true`	✓Yes	iOS (7.0+)
Allow Image Playground allowImagePlayground If `false`, prohibits the use of image generation.	boolean	optional	`true`	✓Yes	iOS (18.0+)macOS (15.0+)visionOS (2.4+)
Allow Image Wand allowImageWand If `false`, prohibits the use of Image Wand.	boolean	optional	`true`	✓Yes	iOS (18.0+)visionOS (2.4+)
Allow In App Purchases allowInAppPurchases If `false`, the system prohibits in-app purchasing. Support for this restriction on unsupervised devices is deprecated.	boolean	optional	`true`	✗No
Allow modifying Internet Sharing setting allowInternetSharingModification If `false`, the system prevents modifying the Internet Sharing setting in System Settings.	boolean	optional	`true`	✓Yes	macOS (14.0+)
Allow iPhone mirroring allowiPhoneMirroring If `false`, prohibits the use of iPhone Mirroring. In macOS, this prevents the Mac from mirroring any iPhone. In iOS, this prevents the iPhone from mirroring to any Mac.	boolean	optional	`true`	✓Yes	iOS (18.0+)macOS (15.0+)
Allow iPhone widget on Mac allowiPhoneWidgetsOnMac If `false`, the system disallows iPhone widgets on a Mac that signs in with the same Apple Account for iCloud.	boolean	optional	`true`	✓Yes	iOS (17.0+)
Allow use of iTunes allowiTunes If `false`, the system disables the iTunes Music Store and removes its icon from the Home Screen. Users can't preview, purchase, or download content. Requires a supervised device in iOS 13 and later.	boolean	optional	`true`	✗No
allowiTunesFileSharing allowiTunesFileSharing If `false`, the system disables iTunes file sharing services.	boolean	optional	`true`	✓Yes	macOS (10.13+)
Allow Keyboard Shortcuts allowKeyboardShortcuts If `false`, the system disables keyboard shortcuts.	boolean	optional	`true`	✓Yes	iOS (9.0+)
Allow Listed Apps allowListedAppBundleIDs If present, the system only shows or can launch apps with bundle IDs in the array. Include the value `com.apple.webapp` to allow all webclips. This applies to App Store apps, marketplace apps, and locally installed apps (using Configurator, Xcode, and so forth). 1 subkey	array	optional	—	✓Yes	iOS (15.0+)tvOS (15.0+)
└─ Allow Listed App appAllowlistedBundleID	string		—	✓Yes	iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.1+)watchOS (10.0+)
Allow Live Voicemail allowLiveVoicemail If `false`, the system disables live voicemail on the device.	boolean	optional	`true`	✓Yes	iOS (17.2+)macOS (26.0+)
Allow creating users in System Settings allowLocalUserCreation If `false`, the system prevents creating users in System Settings.	boolean	optional	`true`	✓Yes	macOS (14.0+)
allowLockScreenControlCenter allowLockScreenControlCenter If `false`, the system prevents Control Center from appearing on the Lock Screen.	boolean	optional	`true`	✓Yes	iOS (7.0+)
allowLockScreenNotificationsView allowLockScreenNotificationsView If `false`, the system disables the Notifications history view on the Lock Screen, so users can't view past notifications. However, they can still see notifications when they arrive.	boolean	optional	`true`	✓Yes	iOS (7.0+)
allowLockScreenTodayView allowLockScreenTodayView If `false`, the system disables the Today view in Notification Center on the Lock Screen.	boolean	optional	`true`	✓Yes	iOS (7.0+)
allowMailPrivacyProtection allowMailPrivacyProtection If `false`, the system disables Mail Privacy Protection on the device.	boolean	optional	`true`	✓Yes	iOS (15.2+)
allowMailSmartReplies allowMailSmartReplies If `false`, disables smart replies in Mail.	boolean	optional	`true`	✓Yes	iOS (18.4+)macOS (15.4+)visionOS (2.4+)
allowMailSummary allowMailSummary If `false`, disables the ability to create summaries of email messages manually. This doesn't affect automatic summary generation.	boolean	optional	`true`	✓Yes	iOS (18.1+)macOS (15.1+)visionOS (2.4+)
Allow iCloud Sync for Managed Apps allowManagedAppsCloudSync If `false`, the system prevents managed apps from using iCloud sync.	boolean	optional	`true`	✓Yes	iOS (8.0+)visionOS (2.0+)
Allow managed apps to write to managed contacts accounts allowManagedToWriteUnmanagedContacts If `true`, the system allows managed apps to write contacts to unmanaged accounts. If `allowOpenFromManagedToUnmanaged` is `true`, this restriction has no effect. > Important: > Use MDM to install profiles that contain this restriction.	boolean	optional	`false`	✗No	iOS (12.0+)visionOS (2.0+)
Allow App Installation from alternative marketplaces allowMarketplaceAppInstallation If `false`, the system prevents installation of alternative marketplace apps from the web and prevents any installed alternative marketplace apps from installing apps.	boolean	optional	`true`	✓Yes	iOS (17.4+)
Allow modifying Media Sharing setting allowMediaSharingModification If `false`, prevents modification of Media Sharing settings.	boolean	optional	`true`	✓Yes	macOS (15.1+)
Allow Multiplayer Gaming allowMultiplayerGaming If `false`, the system prohibits multiplayer gaming.	boolean	optional	`true`	✓Yes	iOS (4.1+)macOS (10.13+)
Allow Apple Music allowMusicService If `false`, the system disables the Music service, and the Music app reverts to classic mode.	boolean	optional	`true`	✓Yes	iOS (9.3+)macOS (10.12+)
Allow use of News allowNews If `false`, the system disables News.	boolean	optional	`true`	✓Yes	iOS (9.0+)
allowNFC allowNFC If `false`, the system disables NFC.	boolean	optional	`true`	✓Yes	iOS (14.2+)
allowNotesTranscription allowNotesTranscription If `false`, disables transcription in Notes.	boolean	optional	`true`	✓Yes	iOS (18.4+)macOS (15.4+)
allowNotesTranscriptionSummary allowNotesTranscriptionSummary If `false`, disables transcription summarization in Notes.	boolean	optional	`true`	✓Yes	iOS (18.3+)macOS (15.3+)
Allow Modifying Notifications Settings allowNotificationsModification If `false`, the system disables modification of notification settings.	boolean	optional	`true`	✓Yes	iOS (9.3+)visionOS (2.0+)
Enable allow open from managed to unmanaged allowOpenFromManagedToUnmanaged If `false`, documents in managed apps and accounts open only in other managed apps and accounts.	boolean	optional	`true`	✓Yes	iOS (7.0+)visionOS (2.0+)
Enable allow open from unmanaged to managed allowOpenFromUnmanagedToManaged If `false`, documents in unmanaged apps and accounts open only in other unmanaged apps and accounts.	boolean	optional	`true`	✓Yes	iOS (7.0+)visionOS (2.0+)
allowOTAPKIUpdates allowOTAPKIUpdates If `false`, the system disables over-the-air PKI updates. Setting this restriction to `false` doesn't disable CRL and OCSP checks.	boolean	optional	`true`	✓Yes	iOS (7.0+)
Allow Pairing With Apple Watch allowPairedWatch If `false`, the system disables pairing with an Apple Watch, and the system unpairs any currently paired Apple Watch and erases its content.	boolean	optional	`true`	✓Yes	iOS (9.0+)
Allow Wallet While Locked allowPassbookWhileLocked If `false`, the system hides Passbook notifications from the Lock Screen.	boolean	optional	`true`	✓Yes	iOS (6.0+)
Allow Modifying Passcode allowPasscodeModification If `false`, the system prevents adding, changing, or removing the passcode. The system ignores this restriction on Shared iPad.	boolean	optional	`true`	✓Yes	iOS (9.0+)macOS (10.13+)visionOS (2.0+)
allowPasswordAutoFill allowPasswordAutoFill If `false`, the system disables: - The AutoFill Passwords feature in iOS, with Keychain and third-party password managers - Prompting the user to use a saved password in Safari or in apps - Automatic strong passwords - Suggesting strong passwords to users However, if `false`, the system doesn't prevent AutoFill for contact info and credit cards in Safari.	boolean	optional	`true`	✓Yes	iOS (12.0+)macOS (10.14+)visionOS (2.0+)
allowPasswordProximityRequests allowPasswordProximityRequests Deprecated (tvOS 17.4) If `false`, the system disables requesting passwords from nearby devices.	boolean	optional	`true`	✓Yes	iOS (12.0+)macOS (10.14+)tvOS (12.0 - 17.4)
allowPasswordSharing allowPasswordSharing If `false`, the system disables sharing passwords with the AirDrop passwords feature, or with the Passwords app.	boolean	optional	`true`	✓Yes	iOS (12.0+)macOS (10.14+)visionOS (2.0+)
Allow modifying Personal Hotspot settings allowPersonalHotspotModification If `false`, the system disables modifications of the personal hotspot setting.	boolean	optional	`true`	✓Yes	iOS (12.2+)
Allow personalized handwriting results allowPersonalizedHandwritingResults If false, prevents the system from generating text in the user's handwriting.	boolean	optional	`true`	✓Yes	iOS (18.0+)
Allow Photo Stream allowPhotoStream Deprecated (iOS 17.0) If `false`, the system disables Photo Stream.	boolean	optional	`true`	✓Yes	iOS (5.0 - 17.0)
allowPodcasts allowPodcasts If `false`, the system disables podcasts.	boolean	optional	`true`	✓Yes	iOS (8.0+)
Allow Predictive Keyboard allowPredictiveKeyboard If `false`, the system disables predictive keyboards.	boolean	optional	`true`	✓Yes	iOS (8.1.3+)
Allow modifying Printer Sharing setting allowPrinterSharingModification If `false`, the system prevents modifying Printer Sharing settings in System Settings.	boolean	optional	`true`	✓Yes	macOS (14.0+)
allowProximitySetupToNewDevice allowProximitySetupToNewDevice If `false`, disables the prompt to set up new devices that are nearby.	boolean	optional	`true`	✓Yes	iOS (11.0+)
Allow iTunes Radio allowRadioService If `false`, the system disables Apple Music Radio.	boolean	optional	`true`	✓Yes	iOS (9.3+)
Allow Background Security Improvement Installation allowRapidSecurityResponseInstallation Deprecated (iOS 26.0, macOS 26.0) If `false`, the system prohibits installation of Background Security Improvements.	boolean	optional	`true`	✓Yes	iOS (16.0 - 26.0)macOS (13.0 - 26.0)
Allow Background Security Improvement Removal allowRapidSecurityResponseRemoval Deprecated (iOS 26.0, macOS 26.0) If `false`, the system prohibits removal of Background Security Improvements.	boolean	optional	`true`	✓Yes	iOS (16.0 - 26.0)macOS (13.0 - 26.0)
allowRCSMessaging allowRCSMessaging If `false`, prevents the use of RCS messaging.	boolean	optional	`true`	✓Yes	iOS (18.1+)
Allow modifying Remote Apple Events Sharing setting allowRemoteAppleEventsModification If `false`, the system prevents modifying Remote Apple Events Sharing settings in System Settings.	boolean	optional	`true`	✓Yes	macOS (14.0+)
Allow pairing with Remote app allowRemoteAppPairing If `false`, the system disables pairing Apple TV for use with the Control Center widget.	boolean	optional	`true`	✓Yes	tvOS (10.2+)
Allow Remote Screen Observation allowRemoteScreenObservation If `false`, the system disables remote screen observation by the Classroom app. Nest this key beneath `allowScreenShot` as a subrestriction. If `allowScreenShot` is `false`, the Classroom app doesn't observe remote screens. Requires a supervised device until iOS 13 and macOS 10.15. Allowed for user enrollments in macOS 12 and later.	boolean	optional	`true`	✓Yes	iOS (9.3+)macOS (10.14.4+)
Allow use of Safari allowSafari If `false`, the system disables the Safari web browser app, and the system removes its icon from the Home Screen. This setting also prevents users from opening web clips. Requires a supervised device in iOS 13 and later.	boolean	optional	`true`	✗No
allowSafariHistoryClearing allowSafariHistoryClearing If `false`, the system disables the ability to clear browsing history in Safari.	boolean	optional	`true`	✓Yes	iOS (26.0+)macOS (26.0+)visionOS (26.0+)
allowSafariPrivateBrowsing allowSafariPrivateBrowsing If `false`, the system disables the ability to use private browsing in Safari.	boolean	optional	`true`	✓Yes	iOS (26.0+)macOS (26.0+)visionOS (26.0+)
allowSafariSummary allowSafariSummary If `false`, the system disables the ability to summarize content in Safari.	boolean	optional	`true`	✓Yes	iOS (18.4+)macOS (15.4+)visionOS (2.4+)
Allow use of satellite connectivity allowSatelliteConnection If `false`, the system prohibits the connection to and use of satellite services.	boolean	optional	`true`	✓Yes	iOS (18.2+)
Allow Screenshots and Screen Recording allowScreenShot If `false`, the system disables saving a screenshot of the display and capturing a screen recording. It also disables the Classroom app from observing remote screens.	boolean	optional	`true`	✓Yes	iOS (3.1+)macOS (10.14.4+)visionOS (2.0+)
allowSharedDeviceTemporarySession allowSharedDeviceTemporarySession If `false`, the system makes temporary sessions unavailable on Shared iPad.	boolean	optional	`true`	✓Yes	iOS (13.4+)
Allow Shared Stream allowSharedStream If `false`, the system disables Shared Photo Stream. Support for this restriction on unsupervised devices is deprecated.	boolean	optional	`true`	✓Yes	iOS (6.0+)
Allow Spell Check allowSpellCheck If `false`, the system disables the keyboard spell checker.	boolean	optional	`true`	✓Yes	iOS (8.1.3+)
Allow Siri Suggestions allowSpotlightInternetResults If `false`, the system disables Spotlight Internet search results in Siri Suggestions. Support for this restriction on unsupervised devices is deprecated.	boolean	optional	`true`	✓Yes	iOS (8.0+)macOS (10.11+)
Allow modifying Startup Disk settings allowStartupDiskModification If `false`, the system prevents modification of Startup Disk settings in System Settings.	boolean	optional	`true`	✓Yes	macOS (14.0+)
allowSystemAppRemoval allowSystemAppRemoval If `false`, the system disables the removal of system apps from the device.	boolean	optional	`true`	✓Yes	iOS (11.0+)visionOS (2.0+)
Allow modifying Time Machine settings allowTimeMachineBackup If `false`, the system prevents modification of Time Machine settings in System Settings. This restriction is not supported on the user channel.	boolean	optional	`true`	✓Yes	macOS (14.0+)
Allow App Installation from App Store allowUIAppInstallation If `false`, the system disables the App Store and removes its icon from the Home Screen. However, users can continue to install or update their apps either locally (via Configurator, Xcode, and so forth), or using alternative marketplace apps. In iOS 10 and later, MDM commands can override this restriction.	boolean	optional	`true`	✓Yes	iOS (9.0+)visionOS (2.0+)
Allow UI Configuration Profile Installation allowUIConfigurationProfileInstallation If `false`, the system prohibits the user from installing configuration profiles and certificates interactively.	boolean	optional	`true`	✓Yes	iOS (6.0+)macOS (13.0+)visionOS (2.0+)
Allow Universal Control allowUniversalControl If `false`, the system disables Universal Control.	boolean	optional	`true`	✓Yes	macOS (13.0+)
Allow unmanaged apps to read managed contacts accounts allowUnmanagedToReadManagedContacts If `true`, the system allows unmanaged apps to read from managed contacts accounts. If `allowOpenFromManagedToUnmanaged` is `true`, this restriction has no effect. > Important: > Use MDM to install profiles that contain this restriction.	boolean	optional	`false`	✗No	iOS (12.0+)visionOS (2.0+)
allowUnpairedExternalBootToRecovery allowUnpairedExternalBootToRecovery If `true`, the system allows unpaired devices to boot devices into recovery.	boolean	optional	`false`	✓Yes	iOS (14.5+)
Allow user to accept untrusted TLS certificates allowUntrustedTLSPrompt If `false`, the system automatically rejects untrusted HTTPS certificates without prompting the user.	boolean	optional	`true`	✓Yes	iOS (5.0+)visionOS (1.1+)
allowUSBRestrictedMode allowUSBRestrictedMode If `false`, the system allows iOS devices to always connect to USB accessories while locked. In macOS, allows new USB and Thunderbolt accessories, and SD cards to connect without authorization. If the system has Lockdown mode enabled, it ignores this value. This restriction is not supported on the user channel.	boolean	optional	`true`	✓Yes	iOS (11.4.1+)macOS (13.0+)
Allow Video Conferencing allowVideoConferencing If `false`, the system hides the FaceTime app. Requires a supervised device in iOS 13 and later.	boolean	optional	`true`	✓Yes	visionOS (2.0+)
Allow Video Conferencing Remote Control allowVideoConferencingRemoteControl If `false`, disables the ability for a remote FaceTime session to request control of the device.	boolean	optional	`true`	✓Yes	iOS (18.4+)
Allow Visual Intelligence Summary allowVisualIntelligenceSummary If `false`, the system disables visual intelligence summarization.	boolean	optional	`true`	✓Yes	iOS (18.3+)
Allow Voice Dialing While Device is Locked allowVoiceDialing Deprecated (iOS 17.0) If `false`, the system disables voice dialing if the device is locked with a passcode.	boolean	optional	`true`	✓Yes	iOS (legacy - 17.0)
Allow Adding VPN Configurations (Supervised devices only) allowVPNCreation If `false`, the system allows only managed apps to create VPN configurations. Prior to iOS 18, the system also allows unmanaged apps to create VPN configurations.	boolean	optional	`true`	✓Yes	iOS (11.0+)visionOS (2.0+)
Allow Modifying Wallpaper allowWallpaperModification If `false`, the system prevents changing the wallpaper.	boolean	optional	`true`	✓Yes	iOS (9.0+)macOS (10.13+)
Allow App Installation from web sites allowWebDistributionAppInstallation If `false`, the device prevents installation of apps directly from the web.	boolean	optional	`true`	✓Yes	iOS (17.5+)
Allow writing tools allowWritingTools If `false`, disables Apple Intelligence writing tools.	boolean	optional	`true`	✓Yes	iOS (18.0+)macOS (15.0+)visionOS (2.4+)
autonomousSingleAppModePermittedAppIDs autonomousSingleAppModePermittedAppIDs If present, the system allows apps identified by the bundle IDs listed in the array to autonomously enter Single App Mode. 1 subkey	array	optional	—	✓Yes	iOS (7.0+)
└─ Apps allow list for Autonomous Single App Mode appAutonomousSingleAppModePermittedID	string		—	✓Yes	iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.1+)watchOS (10.0+)
Blacklisted Apps blacklistedAppBundleIDs Deprecated (iOS 15.0, tvOS 15.0) Use `blockedAppBundleIDs` instead. 1 subkey	array	optional	—	✓Yes	iOS (9.3 - 15.0)tvOS (11.0 - 15.0)
└─ Blacklisted App appBlacklistedBundleID	string		—	✓Yes	iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.1+)watchOS (10.0+)
Blocked Apps blockedAppBundleIDs If present, the system prevents showing or launching apps with bundle IDs in the array. Include the value `com.apple.webapp` to restrict all webclips. This applies to App Store apps, marketplace apps, and locally installed apps (using Configurator, Xcode, and so forth). > Note: > Denying system apps may disable other functionality. For example, denying the App Store app may prevent users from accepting the terms and conditions for the user-based Volume Purchase Program (VPP). 1 subkey	array	optional	—	✓Yes	iOS (15.0+)tvOS (15.0+)
└─ Blocked App appBlockedBundleID	string		—	✓Yes	iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.1+)watchOS (10.0+)
deniedICCIDsForiMessageFaceTime deniedICCIDsForiMessageFaceTime An array of strings representing ICCIDs of cellular plans. The device prevents use of any matching cellular networks in iMessage and FaceTime. The array must contain no more than 4 ICCID strings. 1 subkey	array	optional	—	✓Yes	iOS (26.0+)
└─ Denied ICCID for iMessage and FaceTime deniedICCIDForiMessageFaceTime An ICCID.	string		—	✓Yes	iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.1+)watchOS (10.0+)
deniedICCIDsForRCS deniedICCIDsForRCS An array of strings representing ICCIDs of cellular plans. The device prevents use of any matching cellular networks with RCS messaging. The array must contain no more than 4 ICCID strings. 1 subkey	array	optional	—	✓Yes	iOS (26.0+)
└─ Denied ICCID for RCS deniedICCIDForRCS An ICCID.	string		—	✓Yes	iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.1+)watchOS (10.0+)
enforcedFingerprintTimeout enforcedFingerprintTimeout The value, in seconds, after which the fingerprint unlock requires a password to authenticate. The default value is 48 hours.	integer	optional	`172800`	✓Yes	macOS (12.0+)
enforcedSoftwareUpdateDelay enforcedSoftwareUpdateDelay Deprecated (iOS 26.0, macOS 26.0, tvOS 26.0) How many days to delay a software update on the device. With this restriction in place, the user doesn't see a software update until the specified number of days after the software update release date. The restrictions `forceDelayedAppSoftwareUpdates` and `forceDelayedSoftwareUpdates` use this value. Range: 1 - 90	integer	optional	`30`	✓Yes	iOS (11.3 - 26.0)macOS (10.13.4 - 26.0)tvOS (12.2 - 26.0)
enforcedSoftwareUpdateMajorOSDeferredInstallDelay enforcedSoftwareUpdateMajorOSDeferredInstallDelay Deprecated (macOS 26.0) This restriction allows the administrator to set the number of days to delay a major software upgrade on the device. When this restriction is in place, the user sees a software upgrade only after the specified delay after the release of the software upgrade. This value controls the delay for `forceDelayedMajorSoftwareUpdates`. Range: 1 - 90	integer	optional	`30`	✓Yes	macOS (11.3 - 26.0)
enforcedSoftwareUpdateMinorOSDeferredInstallDelay enforcedSoftwareUpdateMinorOSDeferredInstallDelay Deprecated (macOS 26.0) This restriction allows the administrator to set the number of days to delay a minor OS software update on the device. When this restriction is in place, the user sees a software update only after the specified delay after the release of the software update. This value controls the delay for `forceDelayedSoftwareUpdates`. Range: 1 - 90	integer	optional	`30`	✓Yes	macOS (11.3 - 26.0)
enforcedSoftwareUpdateNonOSDeferredInstallDelay enforcedSoftwareUpdateNonOSDeferredInstallDelay Deprecated (macOS 26.0) This restriction allows the administrator to set the number of days to delay an app software update on the device. When this restriction is in place, the user sees a non-OS software update only after the specified delay after the release of the software. This value controls the delay for `forceDelayedAppSoftwareUpdates`. Range: 1 - 90	integer	optional	`30`	✓Yes	macOS (11.3 - 26.0)
Treat AirDrop as Unmanaged Destination forceAirDropUnmanaged If `true`, the system considers AirDrop to be an unmanaged drop target.	boolean	optional	`false`	✓Yes	iOS (9.0+)visionOS (2.0+)
forceAirPlayIncomingRequestsPairingPassword forceAirPlayIncomingRequestsPairingPassword If `true`, the system forces all devices sending AirPlay requests to this device to use a pairing password. This key isn't supported in tvOS 10.2 and later. Use the AirPlay Security Payload instead.	boolean	optional	`false`	✗No
forceAirPlayOutgoingRequestsPairingPassword forceAirPlayOutgoingRequestsPairingPassword If `true`, the system forces all devices receiving AirPlay requests from this device to use a pairing password.	boolean	optional	`false`	✓Yes	iOS (7.1+)
Disallow AirPrint to destinations with untrusted certificates forceAirPrintTrustedTLSRequirement If `true`, the system requires trusted certificates for TLS printing communication.	boolean	optional	`false`	✓Yes	iOS (11.0+)
Enable Siri Profanity Filter forceAssistantProfanityFilter If `true`, the system forces the use of the profanity filter for Siri and dictation. Requires a supervised device in iOS.	boolean	optional	`false`	✓Yes	iOS (5.0+)macOS (10.13+)
forceAuthenticationBeforeAutoFill forceAuthenticationBeforeAutoFill If `true`, the user needs to authenticate before the system can autofill passwords or credit card information in Safari and apps. If this restriction isn't enforced, the user can toggle this feature in Settings. Only supported on devices with Face ID or Touch ID.	boolean	optional	`false`	✓Yes	iOS (11.0+)visionOS (2.0+)
forceAutomaticDateAndTime forceAutomaticDateAndTime If `true`, the system enables the Set Automatically feature in Date & Time and the user can't disable it. The system updates the device's time zone only when the device can determine its location using a cellular connection or Wi-Fi with location services enabled.	boolean	optional	`false`	✓Yes	iOS (12.0+)tvOS (12.2+)visionOS (2.0+)
forceBypassScreenCaptureAlert forceBypassScreenCaptureAlert If `true`, then the system bypasses the presentation of a screen capture alert.	boolean	optional	`false`	✗No	macOS (15.1+)
forceClassroomAutomaticallyJoinClasses forceClassroomAutomaticallyJoinClasses If `true`, the system automatically gives permission to the teacher's requests without prompting the student.	boolean	optional	`false`	✓Yes	iOS (11.0+)macOS (10.14.4+)
forceClassroomRequestPermissionToLeaveClasses forceClassroomRequestPermissionToLeaveClasses If `true`, a student enrolled in an unmanaged course through Classroom needs to request permission from the teacher to leave the course.	boolean	optional	`false`	✓Yes	iOS (11.3+)macOS (10.14.4+)
forceClassroomUnpromptedAppAndDeviceLock forceClassroomUnpromptedAppAndDeviceLock If `true`, the system allows the teacher to lock apps or the device without prompting the student.	boolean	optional	`false`	✓Yes	iOS (11.0+)macOS (10.14.4+)
forceClassroomUnpromptedScreenObservation forceClassroomUnpromptedScreenObservation If `true` and `ScreenObservationPermissionModificationAllowed` is also `true` in the Education payload, a student enrolled in a managed course through the Classroom app automatically gives permission to that course teacher's requests to observe the student's screen without prompting the student.	boolean	optional	`false`	✓Yes	iOS (11.0+)macOS (10.14.4+)
forceDelayedAppSoftwareUpdates forceDelayedAppSoftwareUpdates Deprecated (macOS 26.0) If `true`, the system delays user visibility of non-OS software updates. Control visibility of operating system updates through `forceDelayedSoftwareUpdates`. The delay is 30 days unless you set `enforcedSoftwareUpdateDelay` to another value.	boolean	optional	`false`	✓Yes	macOS (11.0 - 26.0)
forceDelayedMajorSoftwareUpdates forceDelayedMajorSoftwareUpdates Deprecated (macOS 26.0) If `true`, the system delays user visibility of major OS updates.	boolean	optional	`false`	✓Yes	macOS (11.3 - 26.0)
forceDelayedSoftwareUpdates forceDelayedSoftwareUpdates Deprecated (iOS 26.0, macOS 26.0, tvOS 26.0) If `true`, the system delays user visibility of software updates. In macOS, the system allows seed build updates without delay. The delay is 30 days unless you set `enforcedSoftwareUpdateDelay` to another value.	boolean	optional	`false`	✓Yes	iOS (11.3 - 26.0)macOS (10.13 - 26.0)tvOS (12.2 - 26.0)
Force Encrypted Backups forceEncryptedBackup If `true`, the system encrypts all backups.	boolean	optional	`false`	✗No
Require iTunes password for all purchases forceITunesStorePasswordEntry Deprecated (iOS 17.0) If `true`, the system forces the user to enter their iTunes password for each transaction.	boolean	optional	`false`	✓Yes	iOS (6.0 - 17.0)
forceLimitAdTracking forceLimitAdTracking If `true`, the system limits ad tracking. Additionally, it disables app tracking and the Allow Apps to Request to Track setting.	boolean	optional	`false`	✓Yes	iOS (7.0+)
forceOnDeviceOnlyDictation forceOnDeviceOnlyDictation If `true`, the system disables connections to Siri servers for the purposes of dictation.	boolean	optional	`false`	✓Yes	iOS (14.5+)macOS (14.0+)visionOS (2.0+)
forceOnDeviceOnlyTranslation forceOnDeviceOnlyTranslation If `true`, the device can't connect to Siri servers for the purposes of translation.	boolean	optional	`false`	✓Yes	iOS (15.0+)
Force Preserve ESIM on Erase forcePreserveESIMOnErase If `true`, the system preserves eSIM when it erases the device due to too many failed password attempts or the Erase All Content and Settings option in Settings > General > Reset. > Note: > The system doesn't preserve eSIM if Find My initiates erasing the device.	boolean	optional	`false`	✓Yes	iOS (17.2+)
Force Apple Watch Wrist Detection forceWatchWristDetection If `true`, the system forces a paired Apple Watch to use Wrist Detection.	boolean	optional	`false`	✓Yes	iOS (8.2+)
Disallow Wi-Fi from being turned off forceWiFiPowerOn If `true`, the system prevents turning off Wi-Fi in Settings or Control Center, even by entering or leaving Airplane Mode. It doesn't prevent selecting which Wi-Fi network to use. and later.	boolean	optional	`false`	✓Yes	iOS (13.0+)
forceWiFiToAllowedNetworksOnly forceWiFiToAllowedNetworksOnly If `true`, the system limits the device to only join Wi-Fi networks set up through a configuration profile.	boolean	optional	`false`	✓Yes	iOS (14.5+)visionOS (2.0+)
Only join Wi-Fi networks installed by profiles forceWiFiWhitelisting Deprecated (iOS 14.5) Use `forceWiFiToAllowedNetworksOnly` instead.	boolean	optional	`false`	✓Yes	iOS (10.3 - 14.5)
Apps Ranking Number ratingApps The maximum level of app content allowed on the device. Preinstalled (first-party) apps ignore this restriction. Possible values, with the U.S. description of the rating level: - `1000`: All - `600`: 17+ - `300`: 12+ - `200`: 9+ - `100`: 4+ - `0`: None Age bands and the number of discrete age values vary by region, but the values are consistent across regions. For example, in a region that defines rating level 14+, its value is guaranteed to be larger than 300 (12+) and smaller than 600 (17+). Also, the value of rating level 15+ is guaranteed to be larger than the assigned value of rating level 14+. For more information about age ratings, see [Age ratings values and definitions](https://developer.apple.com/help/app-store-connect/reference/age-ratings-values-and-definitions). Examples of values in other regions include: - `1000`: All - `621`: 21+ - `620`: 20+ - `619`: 19+ - `618`: 18+ - `600`: 17+ - `416`: 16+ - `415`: 15+ - `314`: 14+ - `313`: 13+ - `300`: 12+ - `211`: 11+ - `210`: 10+ - `200`: 9+ - `108`: 8+ - `107`: 7+ - `106`: 6+ - `105`: 5+ - `100`: 4+ - `3`: 3+ - `2`: 2+ - `1`: 1+ - `0`: None This restriction will require supervision in a future release. Range: 0 - 1000	integer	optional	`1000`	✓Yes	macOS (15.0+)tvOS (11.3+)
Apps Exempted from Rating Restrictions ratingAppsExemptedBundleIDs If present, the system exempts apps with bundle IDs in the array from age-based rating restrictions. The system uses intersection combine rules to combine multiple payloads and any exceptions that parental control apps provide, including ScreenTime. 1 subkey	array	optional	—	✗No	iOS (26.1+)
└─ Exempted App ratingAppsExemptedBundleID	string		—	✓Yes	iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.1+)watchOS (10.0+)
Movies Ranking Number ratingMovies The maximum level of movie content allowed on the device. Support for this restriction on unsupervised devices is deprecated. Possible values, with the U.S. description of the rating level: - `1000`: All - `500`: NC-17 - `400`: R - `300`: PG-13 - `200`: PG - `100`: G - `0`: None Range: 0 - 1000	integer	optional	`1000`	✓Yes	macOS (15.0+)tvOS (11.3+)
Region Code ratingRegion The two-letter key that profile tools use to display the proper ratings for the given region. The client doesn't recognize or report this data.	string	optional	—	✗No
TV Shows Ranking Number ratingTVShows The maximum level of TV content allowed on the device. Support for this restriction on unsupervised devices is deprecated. Possible values, with the U.S. description of the rating level: - `1000`: All - `600`: TV-MA - `500`: TV-14 - `400`: TV-PG - `300`: TV-G - `200`: TV-Y7 - `100`: TV-Y - `0`: None Range: 0 - 1000	integer	optional	`1000`	✓Yes	macOS (15.0+)tvOS (11.3+)
requireManagedPasteboard requireManagedPasteboard If `true`, copy-and-paste functionality is limited by the `allowOpenFromManagedToUnmanaged` and `allowOpenFromUnmanagedToManaged` restrictions.	boolean	optional	`false`	✓Yes	iOS (15.0+)visionOS (2.0+)
Accept Cookies in Safari safariAcceptCookies Defines the conditions under which the device accepts cookies. The user-facing settings changed in iOS 11, although the possible values remain the same. Support for this restriction on unsupervised devices is deprecated. Allowed values: - `0`: Enables Prevent Cross-Site Tracking and Block All Cookies, and the user canʼt disable either setting. - `1` or `1.5`: Enables Prevent Cross-Site Tracking, and the user canʼt disable it. Doesn't enable Block All Cookies, but the user can enable it. - `2`: Enables Prevent Cross-Site Tracking, but doesn't enable Block All Cookies. The user can toggle either setting.	real	optional	`2`	✗No
Allow AutoFill in Safari safariAllowAutoFill If `false`, the system disables Safari AutoFill for passwords, contact info, and credit cards, and also prevents using the Keychain for AutoFill. Requires a supervised device in iOS 13 and later. > Note: > The system still allows third-party password managers, and apps can use AutoFill.	boolean	optional	`true`	✓Yes	macOS (10.13+)visionOS (2.0+)
Allow JavaScript safariAllowJavaScript If `false`, Safari doesn't execute JavaScript. This restriction will require supervision in a future release.	boolean	optional	`true`	✗No
Allow Pop-ups safariAllowPopups If `false`, Safari doesn't allow pop-up windows. Support for this restriction on unsupervised devices is deprecated.	boolean	optional	`true`	✗No
Enable Fraud Warning safariForceFraudWarning If `true`, the system enables Safari fraud warning.	boolean	optional	`false`	✗No
Whitelisted Apps whitelistedAppBundleIDs Deprecated (iOS 15.0, tvOS 15.0) Use `allowListedAppBundleIDs` instead. 1 subkey	array	optional	—	✓Yes	iOS (9.3 - 15.0)tvOS (11.0 - 15.0)
└─ Whitelisted App appWhitelistedBundleID	string		—	✓Yes	iOS (4.0+)macOS (10.7+)tvOS (9.0+)visionOS (1.1+)watchOS (10.0+)