The declaration to configure the Content Caching service.
| Setting | Type | Required | Default | Manual Install | Supported OS |
|---|---|---|---|---|---|
Allow cache delete AllowCacheDelete If `true`, the system purges content from the cache automatically when it needs disk space for other apps when free disk space runs low on the computer. Set to `false` to maximize effectiveness of Content Caching. | boolean | optional | true | ✓Yes | macOS (27.0+) |
Allow personal caching AllowPersonalCaching If `true`, the system caches the user's iCloud data. Changes to this value don't have an immediate effect. Clients may take some time to react to changes.
> Note:
> At least one of the `AllowPersonalCaching` or `AllowSharedCaching` keys need to be `true`. | boolean | optional | true | ✓Yes | macOS (27.0+) |
Allow shared caching AllowSharedCaching If `true`, the system caches non-iCloud content, such as apps and software updates. Changes to this value don't have an immediate effect. Clients may take some time to react to changes.
> Note:
> At least one of the `AllowPersonalCaching` or `AllowSharedCaching` keys need to be `true`. | boolean | optional | true | ✓Yes | macOS (27.0+) |
Auto activation AutoActivation If `true`, the system automatically activates the content cache when possible and prevents disabling it. If `allowContentCaching` is `false`, `AutoActivation` is also `false`.
Removing a profile that set `AutoActivation` to `true` doesn't deactivate the Content Cache. | boolean | optional | false | ✓Yes | macOS (27.0+) |
Auto enable tethered caching AutoEnableTetheredCaching If `true`, the system automatically enables Internet connection sharing when possible and prevent disabling Internet connection sharing. `DenyTetheredCaching` overrides `AutoEnableTetheredCaching`. Tethered caching requires Content Caching. | boolean | optional | false | ✓Yes | macOS (27.0+) |
Cache limit CacheLimit The maximum number of bytes of disk space to use for the content cache. Set to `0` for unlimited disk space. Also serves as the upper bound to the `PersonalCacheLimit`. | integer | optional | 0 | ✓Yes | macOS (27.0+) |
Data path DataPath The path to the directory used to store cached content. Changing this setting manually doesn't automatically move cached content from the old location to the new one. To move content automatically, use the Sharing preference's Content Caching pane. The value must be (or end with) `/Library/Application Support/Apple/AssetCache/Data`.
The system creates a directory and its intermediates for the given data path if it doesn't already exist. The directory is owned by `_assetcache:_assetcache` and has mode 0750. Its immediate parent directory (`.../Library/Application Support/Apple/AssetCache`) is owned by `_assetcache:_assetcache` and has mode `0755`. | string | optional | /Library/Application Support/Apple/AssetCache/Data | ✓Yes | macOS (27.0+) |
Deny activation DenyActivation If `true`, the system disables Content Caching. This is the inverse of the `allowContentCaching` restriction in MDM. It overrides the `AutoActivation` key. Use this key to prevent launching the Content Caching service. | boolean | optional | false | ✓Yes | macOS (27.0+) |
Deny tethered caching DenyTetheredCaching If `true`, the system disables tethered caching. | boolean | optional | false | ✓Yes | macOS (27.0+) |
Declarative status interval DeclarativeStatusInterval The time interval in seconds the system uses to update the `StatusContentCacheInfo` declarative status item. The reporting interval can't be less than 60 (1 per minute) or larger than 86400 (1 per day), defaults to 0 (off) Range: 300 - 86400 | integer | optional | 0 | ✓Yes | macOS (27.0+) |
Display alerts DisplayAlerts If `true`, Content Caching displays exceptional conditions (alerts) as system notifications in the upper corner of the screen. | boolean | optional | false | ✓Yes | macOS (27.0+) |
Keep awake KeepAwake If `true`, the system prevents the computer from sleeping as long as Content Caching is on (System Preferences > Sharing > Content Caching is on). Customers who want Content Caching to be as available as much as possible should turn this setting on. | boolean | optional | false | ✓Yes | macOS (27.0+) |
Listen ranges ListenRanges An array of dictionaries that describe a range of client IP addresses to serve. 1 subkey | array | optional | — | ✓Yes | macOS (27.0+) |
└─ Ranges item RangesItem A range of IP addresses to cache. 3 subkeys | dictionary | — | ✓Yes | macOS (27.0+) | |
└─ └─ Type type The IP address type. | string | optional | IPv4 | ✓Yes | macOS (27.0+) |
└─ └─ First first The first IP address in the range. | string | required | — | ✓Yes | macOS (27.0+) |
└─ └─ Last last The last IP address in the range. | string | required | — | ✓Yes | macOS (27.0+) |
Listen ranges only ListenRangesOnly If `true`, the content cache provides content to the clients in the `ListenRanges`. | boolean | optional | false | ✓Yes | macOS (27.0+) |
Listen with peers and parents ListenWithPeersAndParents If `true`, the content cache provides content to the clients in the union of the `ListenRanges`, `PeerListenRanges` and `Parents`. | boolean | optional | true | ✓Yes | macOS (27.0+) |
Local subnets only LocalSubnetsOnly If `true`, the content cache offers content to clients only on the same immediate local network only. The content cache offers no content to clients on other networks reachable by the content cache. If `LocalSubnetsOnly` is `true`, the system ignores `ListenRanges`. | boolean | optional | true | ✓Yes | macOS (27.0+) |
Log client identity LogClientIdentity If `true`, the Content Cache logs the IP address and port number of the clients that request content. | boolean | optional | false | ✓Yes | macOS (27.0+) |
Parents Parents An array of the local IP addresses of other content caches that this cache should download from or upload to, instead of downloading from or uploading to Apple directly. The system ignores invalid addresses and addresses of computers that aren't content caches. The system skips Parent caches that become unavailable. If all parent content caches become unavailable, the content cache downloads from or uploads to Apple directly, until a parent content cache becomes available again. 1 subkey | array | optional | — | ✓Yes | macOS (27.0+) |
└─ ParentsItem ParentsItem An IP address. | string | required | — | ✓Yes | macOS (27.0+) |
Parent selection policy ParentSelectionPolicy The policy to implement when choosing among more than one configured parent content cache. With every policy, the system skips parent caches that are temporarily unavailable. Allowed values:
- `first-available`: Always use the first available parent in the Parents list. Use this policy to designate permanent primary, secondary, and subsequent parents.
- `url-path-hash`: Hash the path part of the requested URL so that the same parent is always used for the same URL. This is useful for maximizing the size of the combined caches of the parents.
- `random`: Choose a parent at random. Use this policy for load balancing.
- `round-robin`: Rotate through the parents in order. Use this policy for load balancing.
- `sticky-available`: Use the first available parent in the Parents list until it becomes unavailable, then advance to the next one. Use this policy for designating floating primary, secondary, and subsequent parents. | string | optional | round-robin | ✓Yes | macOS (27.0+) |
Peer filter ranges PeerFilterRanges An array of dictionaries describing a range of peer IP addresses that the content cache uses to filter its list of peers to query for content. The content cache only queries peers in `PeerFilterRanges`. When `PeerFilterRanges` is an empty array, the content cache doesn't query any peers. 1 subkey | array | optional | — | ✓Yes | macOS (27.0+) |
└─ Ranges item RangesItem A range of IP addresses to cache. 3 subkeys | dictionary | — | ✓Yes | macOS (27.0+) | |
└─ └─ Type type The IP address type. | string | optional | IPv4 | ✓Yes | macOS (27.0+) |
└─ └─ First first The first IP address in the range. | string | required | — | ✓Yes | macOS (27.0+) |
└─ └─ Last last The last IP address in the range. | string | required | — | ✓Yes | macOS (27.0+) |
Peer listen ranges PeerListenRanges An array of dictionaries describing a range of peer IP addresses the content cache responds to. When `PeerListenRanges` is an empty array, the content cache responds with an error to all cache queries. 1 subkey | array | optional | — | ✓Yes | macOS (27.0+) |
└─ Ranges item RangesItem A range of IP addresses to cache. 3 subkeys | dictionary | — | ✓Yes | macOS (27.0+) | |
└─ └─ Type type The IP address type. | string | optional | IPv4 | ✓Yes | macOS (27.0+) |
└─ └─ First first The first IP address in the range. | string | required | — | ✓Yes | macOS (27.0+) |
└─ └─ Last last The last IP address in the range. | string | required | — | ✓Yes | macOS (27.0+) |
Peer local subnets only PeerLocalSubnetsOnly If `true`, the content cache only peers with other content caches on the same immediate local network, rather than with content caches that use the same public IP address as the device. When `PeerLocalSubnetsOnly` is `true`, it overrides the configuration of `PeerFilterRanges` and `PeerListenRanges`. If the network changes, the local network peering restrictions update appropriately. If `false`, the content cache defers to `PeerFilterRanges` and `PeerListenRanges` for configuring the peering restrictions. | boolean | optional | true | ✓Yes | macOS (27.0+) |
Personal cache limit PersonalCacheLimit The maximum number of bytes of disk space to use for the personal content cache. The content cache limits the maximum value to the `CacheLimit` value. Set to `0` to use the overall `CacheLimit`. | integer | optional | 0 | ✓Yes | macOS (27.0+) |
Port Port The TCP port number on which the content cache accepts requests for uploads or downloads. Set to `0` to pick a random, available port. | integer | optional | 0 | ✓Yes | macOS (27.0+) |
Public ranges PublicRanges An array of dictionaries describing a range of public IP addresses that the cloud servers should use for matching clients to content caches. 1 subkey | array | optional | — | ✓Yes | macOS (27.0+) |
└─ Ranges item RangesItem A range of IP addresses to cache. 3 subkeys | dictionary | — | ✓Yes | macOS (27.0+) | |
└─ └─ Type type The IP address type. | string | optional | IPv4 | ✓Yes | macOS (27.0+) |
└─ └─ First first The first IP address in the range. | string | required | — | ✓Yes | macOS (27.0+) |
└─ └─ Last last The last IP address in the range. | string | required | — | ✓Yes | macOS (27.0+) |
Management status target ManagementStatusTarget The target URL the system uses to send management statistics using an HTTP PUT request with a json dictionary as the payload. If the URL is an https URL (recommended) the `ManagementSecurityConfig` defines how the system secures the connection. The system sends the management statistics report to the target URL at an interval set by the `ManagementReportingInterval` value. | string | optional | — | ✓Yes | macOS (27.0+) |
Management security config ManagementSecurityConfig If the `ManagementStatusTarget` is an https URL, the system uses this field to determine how the connection is secured.
- `no-cert`: The system uses regular https processing using the built-in anchor certificates.
- `signedByCACert`: The system requires the https connection's certificate to be signed by the certificate provided in the `ManagementStatusCertificateReference` field. If your organization has a CA infrastructure this is the best choice.
- `specificServerCert`: The system requires the https connection's certificate to match the certificate provided in the `ManagementStatusCertificateReference` field. | string | optional | no-cert | ✓Yes | macOS (27.0+) |
Management reporting interval ManagementReportingInterval The reporting interval in seconds the system uses when `ManagementStatusTarget` is present. The reporting interval can't be less than 60 (1 per minute) or larger than 86400 (1 per day), and defaults to 300 (1 per 5 min). Range: 60 - 86400 | integer | optional | 300 | ✓Yes | macOS (27.0+) |
Management status certificate reference ManagementStatusCertificateReference The identifier of an asset declaration that contains the certificate the system uses to verify the security of the status reporting https connection. Required when `ManagementSecurityConfig` is set to `signedByCACert` or `specificServerCert`. | string | optional | — | ✓Yes | macOS (27.0+) |
Explore the full catalogue of Apple Mobile Device Management (MDM) and Declarative Device Management (DDM) policies for macOS and iOS. Search, filter, and reference policy keys for use with Microsoft Intune, Jamf, or any standards-compliant MDM solution.
com.apple.wifi.managed – Wi-Fi network configurationcom.apple.vpn.managed – VPN configurationcom.apple.applicationaccess – App and feature restrictionscom.apple.security.pkcs1 – Certificate (PKCS#1) payloadcom.apple.security.pkcs12 – Identity certificate (PKCS#12) payloadcom.apple.security.scep – SCEP certificate enrolmentcom.apple.mail.managed – Mail account configurationcom.apple.eas.account – Exchange ActiveSync accountcom.apple.MCX – Managed Client (macOS) preferencescom.apple.MCX.FileVault2 – FileVault 2 disk encryptioncom.apple.dock – macOS Dock configurationcom.apple.screensaver – Screensaver configurationcom.apple.loginwindow – macOS login window configurationcom.apple.systempolicy.managed – Gatekeeper / system policycom.apple.systempreferences – System Preferences pane restrictionscom.apple.SoftwareUpdate – Software update behaviourcom.apple.TCC.configuration-profile-policy – Privacy Preferences Policy Control (PPPC)com.apple.notificationsettings – Per-app notification settingscom.apple.webcontent-filter – Web content filtercom.apple.dnsSettings.managed – DNS settings (DoH / DoT)com.apple.relay.managed – Network relay configurationcom.apple.extensiblesso – Extensible Single Sign-Oncom.apple.configuration.passcode.settings – DDM: passcode policycom.apple.configuration.softwareupdate.enforcement.specific – DDM: enforced software updatecom.apple.configuration.services.configuration-files – DDM: service configuration filescom.apple.configuration.management.status-subscriptions – DDM: status subscriptionscom.apple.activation.simple – DDM: simple activation predicatecom.apple.management.organization-info – DDM: organization information