The payload that configures privacy preferences.
| Setting | Type | Required | Default | Manual Install | Supported OS |
|---|---|---|---|---|---|
Services Services A dictionary whose keys are limited to the privacy policy control services. In the case of conflicting specifications, the most restrictive setting (deny) is used. 24 subkeys | dictionary | required | — | ✗No | macOS (10.14+) |
└─ AddressBook AddressBook Specifies the policies for contact information managed by the Contacts.app. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ Calendar Calendar Specifies the policies for calendar information managed by the Calendar.app. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ Reminders Reminders Specifies the policies for reminders information managed by the Reminders app. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ Photos Photos The pictures managed by the Photos app in `~/Pictures/.photoslibrary`. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ Camera Camera Deprecated (macOS 27.0) A system camera. A profile can't grant access to the camera; it can only deny it. 1 subkey | array | optional | — | ✓Yes | macOS (legacy - 27.0) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ Microphone Microphone Deprecated (macOS 27.0) A system microphone. A profile can't grant access to the microphone; it can only deny it. 1 subkey | array | optional | — | ✓Yes | macOS (legacy - 27.0) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ Accessibility Accessibility Deprecated (macOS 27.0) Specifies the policies for the app via the Accessibility subsystem. This profile deprecated its ability to grant access as of macOS 26.2, and removes that ability in macOS 27.0.
Deprecated: use the `Privacy` key in the declarative management `com.apple.configuration.app-settings` configuration. 1 subkey | array | optional | — | ✓Yes | macOS (legacy - 27.0) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ PostEvent PostEvent Specifies the policies for the application to use CoreGraphics APIs to send CGEvents to the system event stream. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyAllFiles SystemPolicyAllFiles Allows the application access to all protected files, including system administration files. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicySysAdminFiles SystemPolicySysAdminFiles Allows the application access to some files used in system administration. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ AppleEvents AppleEvents Specifies the policies for the app sending restricted AppleEvents to another process. 1 subkey | array | optional | — | ✗No | macOS (10.14+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ MediaLibrary MediaLibrary Allows the application to access Apple Music, music and video activity, and the media library. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ FileProviderPresence FileProviderPresence Allows a File Provider application to know when the user is using files managed by the File Provider. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ ListenEvent ListenEvent Allows the application to use CoreGraphics and HID APIs to listen to (receive) CGEvents and HID events from all processes. A profile can't grant access to these events; it can only deny it. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ ScreenCapture ScreenCapture Allows the application to capture (read) the contents of the system display. A profile can't grant access to the contents; it can only deny it. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SpeechRecognition SpeechRecognition Deprecated (macOS 27.0) Allows the application to use the system Speech Recognition facility and to send speech data to Apple.
Deprecated: use the `Privacy` key in the declarative management `com.apple.configuration.app-settings` configuration. 1 subkey | array | optional | — | ✓Yes | macOS (10.15 - 27.0) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyDesktopFolder SystemPolicyDesktopFolder Allows the application to access files in the user's Desktop folder. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyDocumentsFolder SystemPolicyDocumentsFolder Allows the application to access files in the user's Documents folder. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyDownloadsFolder SystemPolicyDownloadsFolder Allows the application to access files in the user's Downloads folder. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyNetworkVolumes SystemPolicyNetworkVolumes Allows the application to access files on network volumes. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyRemovableVolumes SystemPolicyRemovableVolumes Allows the application to access files on removable volumes. 1 subkey | array | optional | — | ✓Yes | macOS (10.15+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyAppBundles SystemPolicyAppBundles Allows the application to update or delete other apps. 1 subkey | array | optional | — | ✓Yes | macOS (13.0+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ SystemPolicyAppData SystemPolicyAppData Specifies the policies for the app to access the data of other apps. 1 subkey | array | optional | — | ✓Yes | macOS (14.0+) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ BluetoothAlways BluetoothAlways Deprecated (macOS 27.0) Specifies the policies for the app to access Bluetooth devices.
Deprecated: use the `Privacy` key in the declarative management `com.apple.configuration.app-settings` configuration. 1 subkey | array | optional | — | ✓Yes | macOS (11.0 - 27.0) |
└─ └─ IdentityDict IdentityDict A dictionary listing apps and the privacy policy to apply to them. 10 subkeys | dictionary | — | ✗No | macOS (10.14+) | |
└─ └─ └─ Identifier Identifier The bundle ID or installation path of the binary.
> Note:
> This value is case-sensitive. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ IdentifierType IdentifierType The type of identifier value. Application bundles must be identified by bundle ID. Nonbundled binaries must be identified by installation path. Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ CodeRequirement CodeRequirement Obtain this value by running `codesign -display -r -`. | string | required | — | ✗No | macOS (10.14+) |
└─ └─ └─ StaticCode StaticCode If `true`, statically validate the code requirement. Used only if the process invalidates its dynamic code signature. | boolean | optional | false | ✗No | macOS (10.14+) |
└─ └─ └─ Allowed Allowed If `true`, access is granted; otherwise, the process doesn't have access. The user isn't prompted and can't change this value.
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | boolean | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ Authorization Authorization The `Authorization` key is an optional replacement for the `Allowed` key, which has one of the following possible values:
- `Allow`: Equivalent to a `true` value for the `Allowed` key
- `Deny`: Equivalent to a `false` value for the `Allowed` key
- `AllowStandardUserToSetSystemService`: Allows a standard (non-admin) user to configure the permissions for the specified app in the Privacy preferences for services that otherwise require admin authorization; only valid for the `ListenEvent` and `ScreenCapture` services
> Note:
> Every payload needs to include either `Authorization` or `Allowed`, but not both. | string | optional | — | ✓Yes | macOS (11.0+) |
└─ └─ └─ Comment Comment Not used. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifier AEReceiverIdentifier The identifier of the process receiving an AppleEvent sent by the Identifier process. This identifier is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverIdentifierType AEReceiverIdentifierType The type of AEReceiverIdentifier value, either `bundleID` or `path`. This setting is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
└─ └─ └─ AEReceiverCodeRequirement AEReceiverCodeRequirement The code requirement for the receiving binary. This code requirement is required for AppleEvents service; not valid for other services. | string | optional | — | ✗No | macOS (10.14+) |
Explore the full catalogue of Apple Mobile Device Management (MDM) and Declarative Device Management (DDM) policies for macOS and iOS. Search, filter, and reference policy keys for use with Microsoft Intune, Jamf, or any standards-compliant MDM solution.
com.apple.wifi.managed – Wi-Fi network configurationcom.apple.vpn.managed – VPN configurationcom.apple.applicationaccess – App and feature restrictionscom.apple.security.pkcs1 – Certificate (PKCS#1) payloadcom.apple.security.pkcs12 – Identity certificate (PKCS#12) payloadcom.apple.security.scep – SCEP certificate enrolmentcom.apple.mail.managed – Mail account configurationcom.apple.eas.account – Exchange ActiveSync accountcom.apple.MCX – Managed Client (macOS) preferencescom.apple.MCX.FileVault2 – FileVault 2 disk encryptioncom.apple.dock – macOS Dock configurationcom.apple.screensaver – Screensaver configurationcom.apple.loginwindow – macOS login window configurationcom.apple.systempolicy.managed – Gatekeeper / system policycom.apple.systempreferences – System Preferences pane restrictionscom.apple.SoftwareUpdate – Software update behaviourcom.apple.TCC.configuration-profile-policy – Privacy Preferences Policy Control (PPPC)com.apple.notificationsettings – Per-app notification settingscom.apple.webcontent-filter – Web content filtercom.apple.dnsSettings.managed – DNS settings (DoH / DoT)com.apple.relay.managed – Network relay configurationcom.apple.extensiblesso – Extensible Single Sign-Oncom.apple.configuration.passcode.settings – DDM: passcode policycom.apple.configuration.softwareupdate.enforcement.specific – DDM: enforced software updatecom.apple.configuration.services.configuration-files – DDM: service configuration filescom.apple.configuration.management.status-subscriptions – DDM: status subscriptionscom.apple.activation.simple – DDM: simple activation predicatecom.apple.management.organization-info – DDM: organization information