Apple Device Policy
Back to Explorer
GitHub YAML

WebContentFilter:Plugin ()

New in iOS 27.0, macOS 27.0, visionOS 27.0

The declaration to configure a WebContent Filter that uses a plugin.

iOS(27.0)macOS(27.0)visionOS(27.0)
Branch: seed_OS_27_0

Settings (28)

SettingTypeRequiredDefaultManual InstallSupported OS
Visible name
VisibleName
The name of the web content filter that the system displays on the device.
stringrequired—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
Plugin bundle ID
PluginBundleID
The bundle ID of the plug-in that provides filtering service. Consult your filtering solution vendor to determine what to specify for this value.
stringrequired—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
Content filter UUID
ContentFilterUUID
A globally unique identifier for this content filter configuration. The content filter processes network traffic for managed apps with the same `ContentFilterUUID` in their app attributes. This key must be present for unsupervised devices and user enrollment.
stringoptional—
✗No
Server address
ServerAddress
The server address, which may be the IP address, hostname, or URL.
stringoptional—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
Organization
Organization
The organization string to pass to the third-party plug-in.
stringoptional—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
Vendor config
VendorConfig
The custom dictionary that the filtering service plug-in needs.
1 subkey
dictionaryoptional—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─
ANY
ANY
The custom key/value pairs for the filtering service.
anyrequired—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
Authentication details
Authentication
Settings that control authentication.
2 subkeys
dictionaryoptional—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─
Credentials asset reference
CredentialsAssetReference
The identifier of an asset declaration that contains the credentials (user name and password) to authenticate with the service.
stringoptional—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─
Identity asset reference
IdentityAssetReference
The identifier of a credential asset declaration that contains the identity that this account requires to authenticate with the service.
stringoptional—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
Filter details
Filter
Settings that control authentication.
5 subkeys
dictionaryoptional—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─
Filter grade
Grade
The system uses this value to derive the relative order of content filters. Filters with a grade of `firewall` see network traffic before filters with a grade of `inspector`. However, the system doesn't define the order of filters within a grade.
stringoptionalfirewall
✗No
└─
Browser filter details
Browsers
Settings that control the browser filter. If not present, the system doesn't use browser filtering.
1 subkey
dictionaryoptional—
✗No
└─ └─
Enable browser filter
Enabled
If `true`, the system enables filtering WebKit traffic.
booleanrequired—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─
Socket filter details
Sockets
Settings that control the socket filter. If not present, the system doesn't use socket filtering.
2 subkeys
dictionaryoptional—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─ └─
Enable socket filter
Enabled
If `true`, enables the filtering of socket traffic.
booleanrequired—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─ └─
Data provider composed identifier
ProviderComposedIdentifier
The data provider identifier. This string identifies the filter data provider when the filter starts running. Required when Enabled is true. In iOS and visionOS, the identifier is a bundle ID, for example, "com.example.app". In macOS, the identifier is a composed identifier. The format of the composed identifier is "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string from the code signature of the provider. For example, "com.example.app {anchor apple generic}".
stringoptional—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─
Packet filter details
Packets
Settings that control the packet filter. If not present, the system doesn't use packet filtering.
2 subkeys
dictionaryoptional—
✗No
└─ └─
Enable packet filter
Enabled
If `true`, the system enables filtering network packets.
booleanrequired—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─ └─
Packet provider composed identifier
ProviderComposedIdentifier
The packet provider identifier. This string identifies the filter data provider when the filter starts running. Required when Enabled is true. The identifier is a composed identifier. The format of the composed identifier is "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string from the code signature of the provider. For example, "com.example.app {anchor apple generic}".
stringoptional—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─
URL filter details
URLs
Settings that control the URL filter. If not present, the system doesn't use URL filtering.
2 subkeys
dictionaryoptional—
✗No
└─ └─
Enable URL filter
Enabled
If `true`, the system filters URL requests.
booleanrequired—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─ └─
URL filter parameters.
Parameters
A dictionary containing URL filter parameters. Required when `Enabled` is `true`.
4 subkeys
dictionaryoptional—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─ └─ └─
Control provider composed identifier
ProviderComposedIdentifier
The URL filter control provider identifier. This string identifies the filter data provider when the filter starts running. Required when Enabled is true. In iOS, the identifier is a bundle ID, for example, "com.example.app". In macOS, the identifier is a composed identifier. The format of the composed identifier is "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string from the code signature of the provider. For example, "com.example.app {anchor apple generic}".
stringrequired—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─ └─ └─
Private information retrieval server settings.
PIR
A dictionary containing Private Information Retrieval server settings.
3 subkeys
dictionaryrequired—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─ └─ └─ └─
[Structure continues recursively]
↻
This structure continues with 3 subkeys (deeply nested - 3 subkeys). See Apple's documentation for the complete structure.
—
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─ └─ └─
URL filter fail closed
FailClosed
If `true`, the system blocks URLs if the filter is enabled, but it fails to make any filtering decision; for example, if there's a communication failure with the PIR server. If `false`, the system allows URLs if the filter is enabled, but it fails to make any filtering decision.
booleanoptionalfalse
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)
└─ └─ └─
Prefilter fetch frequency
PrefilterFetchFrequency
The time interval in seconds that the system uses to periodically run the `NEURLFilterControlProvider` app extension. The default value is 86400 seconds (1 day). The minimum allowed value is 2700 seconds (45 minutes). The system allows `NEURLFilterControlProvider` implementations to download prefilter Bloom filter data onto the device periodically at the specified interval. Implementations need to allow for a slight difference between the scheduled time and the actual runtime of the task, due to the scheduling mechanism on the system.
Range: 2700 -
integeroptional86400
✓Yes
iOS (27.0+)macOS (27.0+)visionOS (27.0+)

Apple MDM & DDM Policy Explorer

Explore the full catalogue of Apple Mobile Device Management (MDM) and Declarative Device Management (DDM) policies for macOS and iOS. Search, filter, and reference policy keys for use with Microsoft Intune, Jamf, or any standards-compliant MDM solution.

Reference: policy categories & common keys

Policy categories

  • Configuration Profile
  • Declarative Configuration
  • Declarative Activation
  • Declarative Asset
  • Declarative Management

Common policy keys

  • com.apple.wifi.managed – Wi-Fi network configuration
  • com.apple.vpn.managed – VPN configuration
  • com.apple.applicationaccess – App and feature restrictions
  • com.apple.security.pkcs1 – Certificate (PKCS#1) payload
  • com.apple.security.pkcs12 – Identity certificate (PKCS#12) payload
  • com.apple.security.scep – SCEP certificate enrolment
  • com.apple.mail.managed – Mail account configuration
  • com.apple.eas.account – Exchange ActiveSync account
  • com.apple.MCX – Managed Client (macOS) preferences
  • com.apple.MCX.FileVault2 – FileVault 2 disk encryption
  • com.apple.dock – macOS Dock configuration
  • com.apple.screensaver – Screensaver configuration
  • com.apple.loginwindow – macOS login window configuration
  • com.apple.systempolicy.managed – Gatekeeper / system policy
  • com.apple.systempreferences – System Preferences pane restrictions
  • com.apple.SoftwareUpdate – Software update behaviour
  • com.apple.TCC.configuration-profile-policy – Privacy Preferences Policy Control (PPPC)
  • com.apple.notificationsettings – Per-app notification settings
  • com.apple.webcontent-filter – Web content filter
  • com.apple.dnsSettings.managed – DNS settings (DoH / DoT)
  • com.apple.relay.managed – Network relay configuration
  • com.apple.extensiblesso – Extensible Single Sign-On
  • com.apple.configuration.passcode.settings – DDM: passcode policy
  • com.apple.configuration.softwareupdate.enforcement.specific – DDM: enforced software update
  • com.apple.configuration.services.configuration-files – DDM: service configuration files
  • com.apple.configuration.management.status-subscriptions – DDM: status subscriptions
  • com.apple.activation.simple – DDM: simple activation predicate
  • com.apple.management.organization-info – DDM: organization information