Apple Device Policy
Back to Explorer
GitHub YAMLApple Docs

Mail (com.apple.mail.managed)

com.apple.mail.managed

The payload that configures a Mail account.

iOS(4.0)macOS(10.7)visionOS(1.1)
Branch: release

Settings (35)

SettingTypeRequiredDefaultManual InstallSupported OS
Account description
EmailAccountDescription
A user-visible description of the email account, shown in the Mail and Settings applications.
stringoptional—
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Account name
EmailAccountName
The full user name for the account. The system displays this name in sent messages.
stringoptional—
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Account type
EmailAccountType
Defines the protocol to use for the account.
stringrequired—
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Email address
EmailAddress
The full email address for the account. If this string isn't present in the payload, the device prompts the user for this string during interactive profile installation in Settings or System Preferences.
stringoptional—
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Incoming mail server authentication
IncomingMailServerAuthentication
The authentication scheme for incoming mail.
stringrequired—
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Mail server
IncomingMailServerHostName
The incoming mail server host name.
stringrequired—
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Port
IncomingMailServerPortNumber
The incoming mail server port number. If not set, the system uses the default port for a given protocol.
integeroptional—
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Use SSL
IncomingMailServerUseSSL
If `true`, the system enables SSL for authentication on the incoming mail server.
booleanoptionalfalse
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Username
IncomingMailServerUsername
The user name for the email account, usually the same as the email address up to the "@" character. If not set and the account requires authentication for incoming email, the device prompts the user for this string during interactive profile installation in Settings or System Preferences.
stringoptional—
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Password
IncomingPassword
The password for the incoming mail server. Only use this in encrypted profiles.
stringoptional—
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Password
OutgoingPassword
The password for the outgoing mail server. Only use this in encrypted profiles.
stringoptional—
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Outgoing password same as incoming
OutgoingPasswordSameAsIncomingPassword
If `true`, the system prompts the user only once for the password, which it uses for both outgoing and incoming mail. This setting supports only interactive profile installations. Non-interactive installations, such as MDM on iOS, don't support this setting.
booleanoptionalfalse
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Authentication type
OutgoingMailServerAuthentication
The authentication scheme for outgoing mail.
stringrequired—
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Mail server
OutgoingMailServerHostName
The outgoing mail server host name.
stringrequired—
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Port
OutgoingMailServerPortNumber
The outgoing mail server port number. If not set, the system uses ports 25, 587, and 465, in that order.
integeroptional—
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Use SSL
OutgoingMailServerUseSSL
If `true`, the system enables SSL authentication on the outgoing mail server.
booleanoptionalfalse
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Username
OutgoingMailServerUsername
The user name for the email account, usually the same as the email address up to the "@" character. If not set and the account requires authentication for outgoing email, the device prompts the user for this string during interactive profile installation in Settings or System Preferences.
stringoptional—
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
Prevent move
PreventMove
If `true`, the system prevents moving messages out of this email account and into another account. It also prevents forwarding or replying from an account other than the recipient of the message.
booleanoptionalfalse
✓Yes
iOS (5.0+)
Prevent app sheet
PreventAppSheet
If `true`, the system prevents this account from sending mail in any app other than the Apple Mail app.
booleanoptionalfalse
✓Yes
iOS (5.0+)
S/MIME enabled
SMIMEEnabled
If `true`, the system enables S/MIME encryption. The system ignores this key in iOS 10.0 and later.
booleanoptionalfalse
✓Yes
iOS (5.0+)
S/MIME signing enabled
SMIMESigningEnabled
If `true`, the system enables S/MIME signing for this account.
booleanoptionalfalse
✓Yes
iOS (10.0+)
S/MIME signing certificate
SMIMESigningCertificateUUID
The payload UUID of the identity certificate used to sign messages sent from this account.
stringoptional—
✓Yes
iOS (5.0+)
S/MIME encryption enabled
SMIMEEncryptionEnabled
If `true`, the system enables S/MIME encryption for this account.
booleanoptionalfalse
✓Yes
iOS (10.0+)
S/MIME encryption certificate
SMIMEEncryptionCertificateUUID
The UUID of the identity certificate used to decrypt messages sent to this account. The system attaches the public certificate to outgoing mail to allow the user to receive encrypted mail. When the user sends encrypted mail, the system uses the public certificate to encrypt the copy of the mail in their Sent mailbox.
stringoptional—
✓Yes
iOS (5.0+)
S/MIME enable per-message switch
SMIMEEnablePerMessageSwitch
Deprecated (iOS 10.0)
If `true`, the system displays the per-message encryption switch in the Mail Compose UI. Deprecated in iOS 12.0. Use `SMIMEEnableEncryptionPerMessageSwitch` instead.
booleanoptionalfalse
✓Yes
iOS (8.0 - 10.0)
Disable mail recents syncing
disableMailRecentsSyncing
If `true`, the system excludes this account from Recent Addresses syncing.
booleanoptionalfalse
✓Yes
iOS (6.0+)
Allow mail drop
allowMailDrop
If `true`, the system enables this account to use Mail Drop.
booleanoptionalfalse
✓Yes
iOS (9.2+)macOS (10.12+)
Path prefix
IncomingMailServerIMAPPathPrefix
The path prefix for the IMAP mail server.
stringoptional—
✓Yes
iOS (4.0+)macOS (10.7+)visionOS (1.1+)
SMIMESigningUserOverrideable
SMIMESigningUserOverrideable
If `true`, the user can turn S/MIME signing on or off in Settings.
booleanoptionalfalse
✓Yes
iOS (12.0+)
SMIMESigningCertificateUUIDUserOverrideable
SMIMESigningCertificateUUIDUserOverrideable
If `true`, the user can select the signing identity.
booleanoptionalfalse
✓Yes
iOS (12.0+)
SMIMEEncryptByDefault
SMIMEEncryptByDefault
If `true`, the system enables S/MIME encryption by default.
booleanoptionalfalse
✓Yes
iOS (12.0+)
SMIMEEncryptByDefaultUserOverrideable
SMIMEEncryptByDefaultUserOverrideable
If `true`, the user can turn encryption by default on/off, and encryption is on.
booleanoptionalfalse
✓Yes
iOS (12.0+)
SMIMEEncryptionCertificateUUIDUserOverrideable
SMIMEEncryptionCertificateUUIDUserOverrideable
If `true`, the user can select the S/MIME encryption identity, and encryption is on.
booleanoptionalfalse
✓Yes
iOS (12.0+)
SMIMEEnableEncryptionPerMessageSwitch
SMIMEEnableEncryptionPerMessageSwitch
If `true`, the system displays the per-message encryption switch in the Mail Compose UI.
booleanoptionalfalse
✓Yes
iOS (12.0+)
VPNUUID
VPNUUID
The VPNUUID of the per-app VPN the account uses for network communication.
stringoptional—
✓Yes
iOS (14.0+)

Apple MDM & DDM Policy Explorer

Explore the full catalogue of Apple Mobile Device Management (MDM) and Declarative Device Management (DDM) policies for macOS and iOS. Search, filter, and reference policy keys for use with Microsoft Intune, Jamf, or any standards-compliant MDM solution.

Reference: policy categories & common keys

Policy categories

  • Configuration Profile
  • Declarative Configuration
  • Declarative Activation
  • Declarative Asset
  • Declarative Management

Common policy keys

  • com.apple.wifi.managed – Wi-Fi network configuration
  • com.apple.vpn.managed – VPN configuration
  • com.apple.applicationaccess – App and feature restrictions
  • com.apple.security.pkcs1 – Certificate (PKCS#1) payload
  • com.apple.security.pkcs12 – Identity certificate (PKCS#12) payload
  • com.apple.security.scep – SCEP certificate enrolment
  • com.apple.mail.managed – Mail account configuration
  • com.apple.eas.account – Exchange ActiveSync account
  • com.apple.MCX – Managed Client (macOS) preferences
  • com.apple.MCX.FileVault2 – FileVault 2 disk encryption
  • com.apple.dock – macOS Dock configuration
  • com.apple.screensaver – Screensaver configuration
  • com.apple.loginwindow – macOS login window configuration
  • com.apple.systempolicy.managed – Gatekeeper / system policy
  • com.apple.systempreferences – System Preferences pane restrictions
  • com.apple.SoftwareUpdate – Software update behaviour
  • com.apple.TCC.configuration-profile-policy – Privacy Preferences Policy Control (PPPC)
  • com.apple.notificationsettings – Per-app notification settings
  • com.apple.webcontent-filter – Web content filter
  • com.apple.dnsSettings.managed – DNS settings (DoH / DoT)
  • com.apple.relay.managed – Network relay configuration
  • com.apple.extensiblesso – Extensible Single Sign-On
  • com.apple.configuration.passcode.settings – DDM: passcode policy
  • com.apple.configuration.softwareupdate.enforcement.specific – DDM: enforced software update
  • com.apple.configuration.services.configuration-files – DDM: service configuration files
  • com.apple.configuration.management.status-subscriptions – DDM: status subscriptions
  • com.apple.activation.simple – DDM: simple activation predicate
  • com.apple.management.organization-info – DDM: organization information