The declaration to configure app settings.
| Setting | Type | Required | Default | Manual Install | Supported OS |
|---|---|---|---|---|---|
Allowed apps Allowed The dictionary of allowed app settings. 5 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Allowed apps AllowedApps If present, the device only shows or launches apps with bundle IDs in the array. Include the value `com.apple.webapp` to allow all webclips. This applies to App Store apps, marketplace apps, and locally installed apps (using Configurator, Xcode, and so forth). 1 subkey | array | optional | — | ✗No | |
└─ └─ AppIdentifier AppIdentifier String containing an identifier to match an app. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Denied apps DeniedApps If present, the device prevents showing or launching apps with bundle IDs in the
array. Include the value `com.apple.webapp` to restrict all webclips. This applies to
App Store apps, marketplace apps, and locally installed apps (using Configurator,
Xcode, and so forth).
> Note:
> Denying system apps may disable other functionality. For example, denying the App
Store app may prevent users from accepting the terms and conditions for the user-based
Volume Purchase Program (VPP). 1 subkey | array | optional | — | ✗No | |
└─ └─ AppIdentifier AppIdentifier String containing an identifier to match an app. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Allowed binaries AllowedBinaries If present, the device only allows binaries that match the binary identifier properties to run. A binary only matches when all the binary identifiers match. The device always runs system critical processes. Use "codesign -dvvv <path_to_binary>" to show the information you need to generate these values. 1 subkey | array | optional | — | ✗No | |
└─ └─ Binary identifier BinaryIdentifier Dictionary containing one or more identifier fields to match a binary. 5 subkeys | dictionary | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Code directory hash CDHash The code signature code directory hash of the binary. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Signing ID SigningID The code signature signing identifier of the binary. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Team ID TeamID The code signature team identifier of the binary. Use the value "*APPLE*" instead of an empty string for Apple binaries with an empty team identifier. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Path prefix PathPrefix The file system path prefix to match binaries. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Signing state SigningState The code signing state to match binaries. | string | optional | All | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Denied binaries DeniedBinaries If present, the device doesn't allow binaries that match the binary identifier properties to run. A binary only matches when all the binary identifiers match. 1 subkey | array | optional | — | ✗No | |
└─ └─ Binary identifier BinaryIdentifier Dictionary containing one or more identifier fields to match a binary. 5 subkeys | dictionary | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Code directory hash CDHash The code signature code directory hash of the binary. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Signing ID SigningID The code signature signing identifier of the binary. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Team ID TeamID The code signature team identifier of the binary. Use the value "*APPLE*" instead of an empty string for Apple binaries with an empty team identifier. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Path prefix PathPrefix The file system path prefix to match binaries. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Signing state SigningState The code signing state to match binaries. | string | optional | All | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ Always allow managed apps AlwaysAllowManagedApps If `true`, the device implicitly includes managed apps in the effective allow list when `AllowedApps` or `AllowedBinaries` is present. | boolean | optional | false | ✗No | |
App privacy Privacy The dictionary of app settings. 1 subkey | dictionary | optional | — | ✗No | |
└─ App privacy permission defaults PermissionDefaults The dictionary of app privacy permission defaults. Each key in the dictionary is an app identifier. The dictionary values represent the permission defaults that the device applies for each matching app.
In iOS, the app identifier is a bundle ID, for example, "com.example.app".
In macOS, the app identifier is a composed identifier. The format of the composed identifier is either "Bundle-ID", "Bundle-ID (Team-ID)", or "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the app. "Team-ID" is the team identifier from the app's code signature. "Designated-Requirement" is the designated requirement string from the code signature of the app. For example, "com.example.app" for the bundle ID format, "com.example.app (ABCD1234)" for the team ID format, or "com.example.app {anchor apple generic}" for the designated requirement format. The device only applies defaults for an app if its code signature matches the composed identifier. 1 subkey | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ ANY ANY The dictionary that defines the app privacy permission defaults. Each key is an app identifier. 9 subkeys | dictionary | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Organization justification OrganizationJustification Text you provide that clearly explains to the user the reason why the organization requires these app permission defaults. The device includes this text in the permission consent prompt it displays when it launches the app. | string | required | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Accessibility permission Accessibility Controls whether an app privacy permission default is set.
* `None`: No app privacy permission default is set for use of accessibility.
* `Allow`: The app privacy permission default is set to allow use of accessibility. | string | optional | — | ✗No | |
└─ └─ └─ Bluetooth permission Bluetooth Controls whether an app privacy permission default is set.
* `None`: No app privacy permission default is set for use of Bluetooth.
* `Allow`: The app privacy permission default is set to allow use of Bluetooth. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Camera permission Camera Controls whether an app privacy permission default is set.
* `None`: No app privacy permission default is set for use of the camera.
* `Allow`: The app privacy permission default is set to allow use of the camera. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Dictation permission Dictation Controls whether an app privacy permission default is set.
* `None`: No app privacy permission default is set for use of dictation.
* `Allow`: The app privacy permission default is set to allow use of dictation. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Local network permission LocalNetwork Controls whether an app privacy permission default is set.
* `None`: No app privacy permission default is set for use of the local network.
* `Allow`: The app privacy permission default is set to allow use of the local network. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Location permission Location Controls whether an app privacy permission default is set.
* `None`: No app privacy permission default is set for access to location.
* `WhileUsing`: The app privacy permission default is set to allow access to location only while the user is using the app In macOS, this is equivalent to `Always`.
* `Always`: The app privacy permission default is set to allow access to location always. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
└─ └─ └─ Location accuracy permission LocationAccuracy Controls whether an app privacy permission default is set.
* `None`: No app privacy permission default is set for access to precise location.
* `Approximate`: The app privacy permission default is set to allow approximate access to location.
* `Precise`: The app privacy permission default is set to allow precise access to location. | string | optional | — | ✗No | |
└─ └─ └─ Microphone permission Microphone Controls whether an app privacy permission default is set.
* `None`: No app privacy permission default is set for use of the microphone.
* `Allow`: The app privacy permission default is set to allow use of the microphone. | string | optional | — | ✓Yes | iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+) |
Explore the full catalogue of Apple Mobile Device Management (MDM) and Declarative Device Management (DDM) policies for macOS and iOS. Search, filter, and reference policy keys for use with Microsoft Intune, Jamf, or any standards-compliant MDM solution.
com.apple.wifi.managed – Wi-Fi network configurationcom.apple.vpn.managed – VPN configurationcom.apple.applicationaccess – App and feature restrictionscom.apple.security.pkcs1 – Certificate (PKCS#1) payloadcom.apple.security.pkcs12 – Identity certificate (PKCS#12) payloadcom.apple.security.scep – SCEP certificate enrolmentcom.apple.mail.managed – Mail account configurationcom.apple.eas.account – Exchange ActiveSync accountcom.apple.MCX – Managed Client (macOS) preferencescom.apple.MCX.FileVault2 – FileVault 2 disk encryptioncom.apple.dock – macOS Dock configurationcom.apple.screensaver – Screensaver configurationcom.apple.loginwindow – macOS login window configurationcom.apple.systempolicy.managed – Gatekeeper / system policycom.apple.systempreferences – System Preferences pane restrictionscom.apple.SoftwareUpdate – Software update behaviourcom.apple.TCC.configuration-profile-policy – Privacy Preferences Policy Control (PPPC)com.apple.notificationsettings – Per-app notification settingscom.apple.webcontent-filter – Web content filtercom.apple.dnsSettings.managed – DNS settings (DoH / DoT)com.apple.relay.managed – Network relay configurationcom.apple.extensiblesso – Extensible Single Sign-Oncom.apple.configuration.passcode.settings – DDM: passcode policycom.apple.configuration.softwareupdate.enforcement.specific – DDM: enforced software updatecom.apple.configuration.services.configuration-files – DDM: service configuration filescom.apple.configuration.management.status-subscriptions – DDM: status subscriptionscom.apple.activation.simple – DDM: simple activation predicatecom.apple.management.organization-info – DDM: organization information