The payload that configures media management.
| Setting | Type | Required | Default | Manual Install | Supported OS |
|---|---|---|---|---|---|
logout-eject logout-eject Deprecated (macOS 11.0) The media type dictionary that defines volumes to eject when the user logs out. 12 subkeys | dictionary | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ all-media all-media Deprecated (macOS 11.0) Unused; set to an empty string. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ cd cd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ dvd dvd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ bd bd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ blankcd blankcd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ blankdvd blankdvd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ blankbd blankbd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ dvdram dvdram Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ disk-image disk-image Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ harddisk-internal harddisk-internal Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ harddisk-external harddisk-external Deprecated (macOS 11.0) A string or an array of media action strings. The hard disk-external category includes internally installed SD cards and USB flash drives.
This key is the default for media types that don't fall into other categories. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ networkdisk networkdisk Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
mount-controls mount-controls Deprecated (macOS 11.0) The media type dictionary that controls volume mounting. 12 subkeys | dictionary | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ all-media all-media Deprecated (macOS 11.0) Unused; set to an empty string. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ cd cd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ dvd dvd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ bd bd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ blankcd blankcd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ blankdvd blankdvd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ blankbd blankbd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ dvdram dvdram Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ disk-image disk-image Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ harddisk-internal harddisk-internal Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ harddisk-external harddisk-external Deprecated (macOS 11.0) A string or an array of media action strings. The hard disk-external category includes internally installed SD cards and USB flash drives.
This key is the default for media types that don't fall into other categories. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ networkdisk networkdisk Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
unmount-controls unmount-controls Deprecated (macOS 11.0) The media type dictionary that controls volume unmounting. 12 subkeys | dictionary | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ all-media all-media Deprecated (macOS 11.0) Unused; set to an empty string. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ cd cd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ dvd dvd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ bd bd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ blankcd blankcd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ blankdvd blankdvd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ blankbd blankbd Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ dvdram dvdram Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ disk-image disk-image Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ harddisk-internal harddisk-internal Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ harddisk-external harddisk-external Deprecated (macOS 11.0) A string or an array of media action strings. The hard disk-external category includes internally installed SD cards and USB flash drives.
This key is the default for media types that don't fall into other categories. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ networkdisk networkdisk Deprecated (macOS 11.0) A media action string or an array of media action strings. 1 subkey | array | optional | — | ✓Yes | macOS (10.7 - 11.0) |
└─ └─ ActionStringItem ActionStringItem Deprecated (macOS 11.0) One of the following values:
* authenticate - User will be authenticated before media is mounted
* read-only - The media will be mounted read-only. Not valid for unmount-controls.
* deny - The media will not be mounted.
* eject - The media will not be mounted and it will be ejected if possible. Note that some volumes are not defined as ejectable, so using the deny key may be the best solution. Not valid for unmount-controls. | string | optional | — | ✓Yes | macOS (10.7 - 11.0) |
Explore the full catalogue of Apple Mobile Device Management (MDM) and Declarative Device Management (DDM) policies for macOS and iOS. Search, filter, and reference policy keys for use with Microsoft Intune, Jamf, or any standards-compliant MDM solution.
com.apple.wifi.managed – Wi-Fi network configurationcom.apple.vpn.managed – VPN configurationcom.apple.applicationaccess – App and feature restrictionscom.apple.security.pkcs1 – Certificate (PKCS#1) payloadcom.apple.security.pkcs12 – Identity certificate (PKCS#12) payloadcom.apple.security.scep – SCEP certificate enrolmentcom.apple.mail.managed – Mail account configurationcom.apple.eas.account – Exchange ActiveSync accountcom.apple.MCX – Managed Client (macOS) preferencescom.apple.MCX.FileVault2 – FileVault 2 disk encryptioncom.apple.dock – macOS Dock configurationcom.apple.screensaver – Screensaver configurationcom.apple.loginwindow – macOS login window configurationcom.apple.systempolicy.managed – Gatekeeper / system policycom.apple.systempreferences – System Preferences pane restrictionscom.apple.SoftwareUpdate – Software update behaviourcom.apple.TCC.configuration-profile-policy – Privacy Preferences Policy Control (PPPC)com.apple.notificationsettings – Per-app notification settingscom.apple.webcontent-filter – Web content filtercom.apple.dnsSettings.managed – DNS settings (DoH / DoT)com.apple.relay.managed – Network relay configurationcom.apple.extensiblesso – Extensible Single Sign-Oncom.apple.configuration.passcode.settings – DDM: passcode policycom.apple.configuration.softwareupdate.enforcement.specific – DDM: enforced software updatecom.apple.configuration.services.configuration-files – DDM: service configuration filescom.apple.configuration.management.status-subscriptions – DDM: status subscriptionscom.apple.activation.simple – DDM: simple activation predicatecom.apple.management.organization-info – DDM: organization information