App Usage & Installation
| ||
| Restrict App Usage | Allow all apps | Allow all apps, blocklist, or allowlist
Show options for restricting app usage hide Klicken für dauerhafte Anzeige Allow all apps Do not allow certain apps Allow only certain apps
Show additional configurations when selecting "Do not allow certain apps"
|
| Blocked apps | Select application | Select the apps to be blocked Multiple apps can be selected |
| Add system apps | All system apps are added.
System apps can then be removed individually. | |
| Erlaubte Apps | Select application | Select the apps to be allowed Multiple apps can be selected |
| Add system apps | All system apps are added.
System apps can then be removed individually. | |
| Single App Mode: Allowed Apps | Select application | List of apps allowed to run in single app mode |
| Allow removing apps | Allows the user to remove apps | |
| Allow app installation via Configurator/iTunes | When deactivated , the system disables the App Store, Configurator, marketplace, etc.
This prevents manual/sideloading installation methods and reduces shadow IT | |
| Allow automatic app downloads | When deactivated , the system prevents automatic downloading of apps purchased on other devices.
This prevents private Apple ID purchases from appearing on corporate devices; useful for BYOD/COBO | |
| Allow app installation from the App Store | When activated , it allows the user to install applications from the App Store | |
| Allow App Clips | When activated , App Clips are enabled.
When deactivated , all App Clips are removed | |
| Allow AirDrop | When activated , AirDrop is enabled | |
| Allow AirPrint | When activated , AirPrint is enabled | |
| Allow saving AirPrint credentials | When activated , it allows saving AirPrint login credentials in the iCloud keychain | |
| Allow AirPrint iBeacon detection | When activated , it allows detection of AirPrint printers via iBeacon | |
| Require trusted TLS for AirPrint | When activated , it requires trusted TLS certificates for secure AirPrint communication.
Protects against man-in-the-middle attacks but requires correctly issued certificates on the printers | |
| Allow change of mobile tariff | When activated , it allows changing mobile tariff settings | |
| Allow iCloud keychain synchronization | When activated , it allows iCloud keychain synchronization | |
| Allow private iCloud relay | When activated , iCloud Private Relay is enabled.
This obscures IP/DNS requests for more privacy but may bypass web filter/proxy policies | |
| Allow eSIM changes | When activated , it allows changes to settings related to the mobile tariff | |
| Allow Files app access to USB drives | When activated , it allows the Files app to connect to USB drives.
Facilitates offline data exchange but increases compliance risks | |
| Allow host pairing | When activated , it allows pairing with a computer notempty
If pairing is disabled , the end device can no longer be connected to a computer via USB.
Please ensure that the end device always has a functioning internet connection even without pairing | |
| Allow NFC | When activated , NFC is enabled | |
| Allow changing hotspot settings | When activated , it allows changing personal hotspot settings | |
| Allow VPN creation | When activated , it allows creating VPN configurations | |
| Allow configuration of nearby devices | When activated , it enables the prompt to configure new nearby devices upon proximity.
This accelerates rollouts/transfers but may allow unintended account/settings takeovers from unmanaged devices | |
Data Sharing
| ||
| Allow automatic password filling | When activated , the "AutoFill Passwords" feature is enabled.
This speeds up logins and reduces typing errors; due to domain reference and user confirmation, AutoFill usually does not apply to phishing sites | |
| Enforce authentication before automatic filling | When activated , it requires authentication before passwords or credit card information are autofilled | |
| Allow password requests to nearby devices | When activated , it allows the system to request passwords from nearby devices.
Applies only to Wi-Fi passwords; may allow sharing of network credentials with foreign devices | |
| Allow password sharing | When activated , it allows sharing passwords via AirDrop | |
| Allow account modification | When activated , it allows users to add, remove, or modify accounts (e.g., Apple IDs, internet-based accounts) in settings.
notempty
This option prevents, for example, the creation of another Apple account, which could then be used to install additional apps. notempty
iOS can only activate this restriction for all accounts. This also means that changing a password for an Exchange account is no longer possible. | |
| Allow modification of Find My Friends | When activated , it allows modifications to the settings for "Find My Friends" (within the "Find My" app) | |
Media & Entertainment
| ||
| Allow Podcasts | When activated , the Podcasts app is enabled | |
| Allow explicit content | When activated , it allows access to explicit content.
When activated, the SafeSearch function is switched off by Safari. | |
| Allow iMessage | When activated , iMessage is enabled.
For Wi-Fi-only devices, the "Messages" app is hidden; for cellular devices, the app remains but uses only SMS/MMS | |
| Allow Apple Books Store | When activated , the Apple Books Store is enabled.
Supervised only. If disabled, iBookstore will be disabled | |
| Allow erotica in Apple Books | When activated , it allows downloading books marked as erotica.
Supervised only. If disabled, the user will not be able to download media from the iBookstore marked as erotica | |
| Allow iTunes Store | When activated , the iTunes Music Store is enabled | |
| Allow Safari | When activated , the Safari browser is enabled.
Web Clips cannot be opened with Safari browser disabled | |
| Allow Game Center | When activated , Game Center is enabled | |
| Allow adding Game Center friends | When activated , it allows users to add friends in Game Center | |
| Allow FaceTime | When activated , the FaceTime app is allowed.
Camera usage must also be enabled | |
| Enable Siri profanity filter | When activated , the Siri profanity filter is enabled | |
| Allow AutoFill in Safari | When activated , AutoFill in Safari is enabled | |
| Allow changing wallpaper | When activated , it allows changing the wallpaper | |
| Allow shared albums | When activated , it allows shared photo albums.
This simplifies team-wide sharing. Shared photo albums are limited, stored in reduced resolution, and do not count against iCloud storage | |
System and Device Control
| ||
| Allow removal of system apps | When activated , it allows users to remove system apps.
If set to false, the removal of system apps is disabled | |
| Allow unpaired devices to start in recovery mode | When activated , it allows unpaired devices to start the device in recovery mode.
This can simplify service/repair workflows but reduces protection against unauthorized deletion attempts via USB. If set to false, unpaired external booting for recovery is disabled | |
| Enforce USB restricted mode | When activated , it enforces USB restricted mode, requiring authorization for USB accessories when the device is locked.
If set to false, the restricted USB mode will be disabled | |
| Enforce automatic date and time | When activated , it enforces the "Set Automatically" setting for date and time.
Prevents time manipulation (e.g., to bypass certificate/token checks). If set to true, the date and time are automatically enforced | |
| Enforce Wi-Fi | When activated , it prevents disabling the Wi-Fi function.
Useful for always-on management. If set to true, WLAN is forced only on allowed networks | |
| Allow joining only Wi-Fi networks from profiles |
If set to true, WLAN is forced only on allowed networks | |
| Allow changing device passcode | When activated , it allows changing the device passcode | |
| Allow user installation of configuration profiles | When activated , it allows users to install configuration profiles and certificates via the user interface.
Deactivating reduces the risk of unwanted profiles (e.g., unwanted VPN/Root CA) and enforces MDM-controlled changes. If set to false, the user is prohibited from installing configuration profiles and certificates interactively | |
| Allow reset to factory settings | When activated , the "Erase All Content and Settings" option in Settings is enabled.
Deactivating protects corporate devices from user-initiated wipes. If disabled, the user cannot select the "Clear all content and settings" option in Settings > General > Reset. notempty
A user-initiated "Find My" deletion can still take effect unless separately prevented | |
| Allow changing Screen Time settings | When activated , it allows changing Screen Time settings.
Deactivating prevents local bypassing of restrictions/age ratings. Allow configuration restrictions | |
| Allow iCloud document synchronization | When activated , it allows document synchronization with iCloud.
Deactivating disables document and key-value sync via iCloud; affected apps lose iCloud sync functionality. Allow document synchronization with iCloud | |
| Enforce delayed software updates | When activated , it delays the visibility of software updates for the user.
Suitable for staggered rollouts. When active, user visibility of software updates is delayed. | |
| Delay software updates (in days) | 30 | Sets the number of days by which the visibility of software updates is delayed.
Valid values are 1 - 90 days. With this restriction, the administrator can specify by how many days a software or app update is delayed on the device. With this restriction, the user will not see a software update until the specified number of days after the software update release date. |
| Enable predictions | When activated , text predictions on the keyboard are enabled.
Allow predictive keyboard. | |
| Enable keyboard shortcuts | When activated , it allows the use of keyboard shortcuts.
Allow keyboard shortcuts. | |
| Enable autocorrect | When activated , autocorrect during input is enabled.
Allow autocorrect. | |
| Enable spell check | When activated , spell check is enabled to underline misspelled words.
Allow correction help. | |
| Enable Look Up | When activated , quick lookup of word definitions is enabled.
Allow correction help. | |
| Enable automatic sleep mode | When activated , it allows the device to automatically switch to sleep mode when inactive.
If set to false, the hibernation of the device is disabled | |
| Enable automatic screensaver | When activated , the automatic screensaver is enabled | |
| Enable pairing with Remote App | When activated , it allows pairing Apple TV with the Remote App or the widget in the Control Center | |