Last adaptation to the version: 2.15 (03.2026)
- The options under Restrictions have been regrouped and given new descriptions.
- Regrouping and updated description of Classroom App
- New Option: Allow Apple Intelligence
This tab is available for iOS/iPadOS profiles of the type
Restrictions
Configuration by clicking on Activate restrictions
Numerous restrictions can be configured to control the behavior of a device.
List of possible restrictions with default values and explanations:
| 1. | 2. | 3. |
| Abb.1 | Abb.2 | Abb.3 |
| Abbildungen | ||
| Caption | Value | Description |
|---|---|---|
Device Security & Data Privacy
| ||
| Allow automatic unlocking | When enabled , it allows automatic unlocking for quick device access (e.g., via Apple Watch)
However, it increases the risk in the event of loss or unauthorized access | |
| Allow Control Center on Lock Screen | When enabled , it allows access to the Control Center directly from the lock screen
This facilitates quick actions (Wi-Fi, flashlight) but can allow unwanted changes without authentication | |
| Allow notification view on lock screen | When activated , it enables the display of past notifications on the lock screen.
This improves the visibility of important information but increases the risk that sensitive content may be viewed by third parties | |
| Allow Today View on Lock Screen | When enabled , it allows the "Today" view to be displayed on the lock screen.
This provides an at-a-glance view of widgets and appointments but may expose operational data without unlocking the device | |
| Force encrypted backups | When enabled , it encrypts all device backups.
This protects corporate data in local backups (Finder/iTunes) and secures sensitive app data | |
| Restrict Ad Tracking | When enabled , it limits ad and app tracking to enhance privacy
Reduces cross-app and cross-website tracking (ATT) and supports compliance | |
| Allow Find My Device | When activated , Find My Device is allowed in the Find My app | |
| Allow Find My Friends | When activated , Find My Friends is allowed in the Find My app | |
| Allow trusting enterprise apps | When activated , it disables the "Trust Enterprise Developer" button (Settings > General > Profiles & Device Management) and prevents users from manually marking apps outside the App Store and MDM as trusted.
This prevents shadow IT and ensures that only apps distributed and signed via MDM are used | |
| Allow Screenshots and Screen Recordings | When activated , it allows the user to take screenshots and screen recordings | |
| Wallet Notifications on Lock Screen | When activated , it enables wallet notifications on the lock screen.
This displays, for example, boarding passes/receipts without unlocking but may expose sensitive payment information | |
| Allow Mail Privacy Protection | When activated , it enables the "Mail Privacy Protection" option in "Mail".
Hides IP addresses and opening times (tracking pixels) | |
| Allow unlocking with Touch & Face ID | When activated , it allows biometric unlocking | |
| Allow changing Touch & Face ID | When activated , it allows changing Touch & Face IDs | |
| Allow sending diagnostic data | When activated , it allows the automatic sending of diagnostic reports to Apple.
This supports troubleshooting and stability but may share telemetry data outside the company | |
| Allow changing diagnostic settings | When activated , it allows changes to diagnostic and analysis settings.
May bypass compliance requirements; usually deactivated in regulated environments | |
Network & Connectivity
| ||
| Allow network access for files | When activated , it allows connection to network drives in the "Files" app | |
| Allow changing Bluetooth settings | When activated , it allows changes to Bluetooth settings | |
| Allow changing mobile data usage for apps | When activated , it allows adjusting mobile data usage settings for apps | |
| Allow accepting untrusted TLS certificates | When activated , it allows the user to accept untrusted TLS certificates.
When deactivated, the device rejects unconfirmed HTTPS certificates without prompting | |
| Allow Handoff | When activated , it allows the continuation of activities between devices.
This improves cross-platform workflow (iPhone ⇄ iPad ⇄ Mac) but may expose content outside the managed device context | |
Cloud & SynchronizationCloud & Synchronization | ||
| Allow iCloud Photos | When activated , it allows the use of iCloud Photos.
This automatically backs up photos/videos and makes them available across devices but may lead to data leakage into private Apple IDs | |
| Allow iCloud Backup | When activated , it allows device backups via iCloud | |
| Allow automatic synchronization during roaming | When activated , it allows data synchronization during roaming.
This keeps apps and files up to date for field service/travel but may incur high roaming costs and increased battery/data usage | |
| Allow backup of Enterprise Books | When activated , it allows backing up Enterprise Books | |
| Allow synchronization of notes/highlights in Enterprise Books | When activated , it allows synchronization of notes and highlights in Enterprise Books | |
App & Purchase RestrictionsApp & Purchase Restrictions | ||
| Allow In-App Purchases | When activated , it allows making purchases within apps
notempty
Only relevant if purchases with private Apple ID are allowed | |
| Allow Multiplayer Gaming | When activated , it allows playing multiplayer games | |
| Require iTunes password for all purchases | When activated , it requires the iTunes password for every purchase
notempty
Only relevant if purchases with private Apple ID are allowed | |
Siri & DictationSiri & Dictation | ||
| Allow Siri | When activated , it allows the use of Siri | |
| Allow Siri on Lock Screen | When activated , it allows the use of Siri on a locked device.
Allows voice commands from the lock screen; depending on the request, Siri may still require unlocking for personal data/actions | |
| Allow Siri access to user-generated content | When activated , it allows Siri to query and use user-generated content from the web.
Expands responses to include content from forums/social networks but increases the risk of inappropriate or unreliable information | |
| Allow Dictation | When activated , it allows dictation input on the device | |
| On-Device Dictation | When activated , speech input is processed entirely on the device without contacting Siri servers.
This enhances privacy and offline capability but may limit language coverage/features compared to server dictation | |
| Force translation on the device only | When activated , it processes translations entirely on the device.
This protects confidential content and works offline but may increase computational load and sometimes result in lower quality or language support | |
| Allow QuickPath Keyboard | When activated , it activates the QuickPath keyboard for smooth typing by swiping | |
Content & EntertainmentContent & Entertainment | ||
| Allow Apple Music | When activated , it allows the use of Apple Music in the Music app | |
| Allow iTunes Radio | When activated , it allows the use of iTunes Radio in the Music app | |
| Allow News App | When activated , it allows access to the News app | |
| Set App Age Rating | Allow All Apps | Sets the highest allowed app age rating
Show options for setting app age ratings hide Klicken für dauerhafte Anzeige Allow All Apps 17+ 12+ 9+ 4+ Allow Nothing
|
| Set Movie Age Rating | All Movies | Sets the highest allowed movie age rating (FSK)
Show options for setting movie age ratings hide Klicken für dauerhafte Anzeige All Movies FSK 18 FSK 16 FSK 12 FSK 6 FSK 0 No Movies
|
| Set TV Show Age Rating | All TV Shows | Sets the highest allowed TV show age rating
Show options for setting TV show age ratings hide Klicken für dauerhafte Anzeige All TV Shows 18+ 16+ 12+ 6+ 0+ No TV Shows
|
Safari Browser SettingsSafari Browser Settings | ||
| Allow Cookies in Safari | Only from current website (iOS 8) or visited sites (pre-iOS 8) | Options for setting cookie acceptance in Safari
Show options for accepted cookies in Safari hide Klicken für dauerhafte Anzeige Only from current website (iOS 8) or visited sites (pre-iOS 8) Never Websites I visited Always
|
| Allow JavaScript | When activated , it enables the execution of JavaScript in Safari.
This is essential for modern web apps; deactivation increases security but breaks interactive functions | |
| Allow Pop-ups | When activated , it allows pop-up windows in Safari.
This is sometimes necessary for authentication flows, downloads, or print dialogs of older portals but increases the risk of ads/phishing | |
| Enable Fraud Warning | When activated , it activates the Safari fraud warning | |
System & MiscellaneousSystem & Miscellaneous | ||
| Allow OTAPKI Updates | ||
| Allow Temporary Sessions (Shared iPad) | When activated , it allows temporary sessions on "Shared iPad" devices.
This supports spontaneous use without permanent accounts (e.g., training/kiosk). Local data is deleted after logout | |
| Force AirPlay Pairing Password (Outgoing) | When activated , a pairing password is required for all devices receiving AirPlay requests from this device; prevents unauthorized screen sharing | |
| Allow Changing Device Name | When activated , it allows changing the device name | |
| Allow Voice Dialing When Device is Locked | When activated , it allows voice dialing when the device is locked | |
| Force Apple Watch Wrist Detection | When activated , it enforces wrist detection on paired Apple Watches.
Automatically locks the watch when removed (e.g., for Apple Pay/unlocking) and prevents access by unauthorized users | |
| Allow Pairing with Apple Watch | When activated , it allows pairing with an Apple Watch | |
| Allow Web Results in Spotlight | When activated , it allows web search results in Spotlight and Siri suggestions.
This improves research and quick access but may display uncurated web content and potentially sensitive search terms | |
| Allow Personalized Advertising | When activated , it enables personalized advertising features.
Increases relevance in Apple ads but reduces privacy through profiling and may conflict with compliance requirements | |
| Allow Camera Usage | When activated , it allows the user to use the camera.
Deactivating locks the camera for all applications | |
| Allow Changing Notification Settings | When activated , it allows changing notification settings | |
Data FlowData Flow | ||
| Allow Managed Apps to Write to Unmanaged Contacts | When activated , it allows managed apps to write contacts to unmanaged accounts.
This facilitates caller identification in private apps but may lead to data flow from the managed area to personal address books | |
| Allow Unmanaged Apps to Read Managed Contacts | When activated , it allows unmanaged apps to access contacts stored in managed accounts.
This increases convenience in private apps (e.g., caller identification) but may expose managed contacts to unmanaged apps | |
| Allow iCloud Synchronization for Managed Apps | When activated , it allows managed apps to synchronize data via iCloud | |
| Allow Opening from Unmanaged Sources in Managed Apps | When activated , it allows opening documents from unmanaged apps in managed apps.
This facilitates collecting external files (e.g., from system apps like Camera, Contacts, etc.) into the protected container but may import potentially harmful or private content | |
| Allow Opening from Managed Sources in Unmanaged Apps | When activated , it allows opening documents from managed apps in unmanaged apps.
This reduces friction in mixed workflows but poses a high compliance risk | |
| Managed Clipboard | When activated , it enforces that the clipboard distinguishes between managed and unmanaged sources | |
| Treat AirDrop as Unmanaged Destination | When activated , it enforces that AirDrop transfers are treated as 'unmanaged'.
In combination with Allow opening from managed sources in unmanaged apps deactivated, sharing via AirDrop from managed apps is prevented | |
For Apple TVs
| 1. | 2. | 3. |
| Abb.1 | Abb.2 | Abb.3 |
| Abbildungen | ||
| Caption | Value | Description |
|---|---|---|
| Allow automatic unlocking | When enabled , it allows automatic unlocking for quick device access (e.g., via Apple Watch)
However, it increases the risk in the event of loss or unauthorized access | |
| Allow Control Center on Lock Screen | When enabled , it allows access to the Control Center directly from the lock screen
This facilitates quick actions (Wi-Fi, flashlight) but can allow unwanted changes without authentication | |
| Allow notification view on lock screen | When activated , it enables the display of past notifications on the lock screen.
This improves the visibility of important information but increases the risk that sensitive content may be viewed by third parties | |
| Allow Today View on Lock Screen | When enabled , it allows the "Today" view to be displayed on the lock screen.
This provides an at-a-glance view of widgets and appointments but may expose operational data without unlocking the device | |
| Force encrypted backups | When enabled , it encrypts all device backups.
This protects corporate data in local backups (Finder/iTunes) and secures sensitive app data | |
| Restrict Ad Tracking | When enabled , it limits ad and app tracking to enhance privacy
Reduces cross-app and cross-website tracking (ATT) and supports compliance | |
| Allow Find My Device | When activated , Find My Device is allowed in the Find My app | |
| Allow Find My Friends | When activated , Find My Friends is allowed in the Find My app | |
| Allow trusting enterprise apps | When activated , it disables the "Trust Enterprise Developer" button (Settings > General > Profiles & Device Management) and prevents users from manually marking apps outside the App Store and MDM as trusted.
This prevents shadow IT and ensures that only apps distributed and signed via MDM are used | |
| Allow Screenshots and Screen Recordings | When activated , it allows the user to take screenshots and screen recordings | |
| Wallet Notifications on Lock Screen | When activated , it enables wallet notifications on the lock screen.
This displays, for example, boarding passes/receipts without unlocking but may expose sensitive payment information | |
| Allow Mail Privacy Protection | When activated , it enables the "Mail Privacy Protection" option in "Mail".
Hides IP addresses and opening times (tracking pixels) | |
| Allow unlocking with Touch & Face ID | When activated , it allows biometric unlocking | |
| Allow changing Touch & Face ID | When activated , it allows changing Touch & Face IDs | |
| Allow sending diagnostic data | When activated , it allows the automatic sending of diagnostic reports to Apple.
This supports troubleshooting and stability but may share telemetry data outside the company | |
| Allow changing diagnostic settings | When activated , it allows changes to diagnostic and analysis settings.
May bypass compliance requirements; usually deactivated in regulated environments | |
| Allow network access for files | When activated , it allows connection to network drives in the "Files" app | |
| Allow changing Bluetooth settings | When activated , it allows changes to Bluetooth settings | |
| Allow changing mobile data usage for apps | When activated , it allows adjusting mobile data usage settings for apps | |
| Allow accepting untrusted TLS certificates | When activated , it allows the user to accept untrusted TLS certificates.
When deactivated, the device rejects unconfirmed HTTPS certificates without prompting | |
| Allow Handoff | When activated , it allows the continuation of activities between devices.
This improves cross-platform workflow (iPhone ⇄ iPad ⇄ Mac) but may expose content outside the managed device context | |
| Allow iCloud Photos | When activated , it allows the use of iCloud Photos.
This automatically backs up photos/videos and makes them available across devices but may lead to data leakage into private Apple IDs | |
| Allow iCloud Backup | When activated , it allows device backups via iCloud | |
| Allow automatic synchronization during roaming | When activated , it allows data synchronization during roaming.
This keeps apps and files up to date for field service/travel but may incur high roaming costs and increased battery/data usage | |
| Allow backup of Enterprise Books | When activated , it allows backing up Enterprise Books | |
| Allow synchronization of notes/highlights in Enterprise Books | When activated , it allows synchronization of notes and highlights in Enterprise Books | |
| Allow In-App Purchases | When activated , it allows making purchases within apps
notempty
Only relevant if purchases with private Apple ID are allowed | |
| Allow Multiplayer Gaming | When activated , it allows playing multiplayer games | |
| Require iTunes password for all purchases | When activated , it requires the iTunes password for every purchase
notempty
Only relevant if purchases with private Apple ID are allowed | |
| Allow Siri | When activated , it allows the use of Siri | |
| Allow Siri on Lock Screen | When activated , it allows the use of Siri on a locked device.
Allows voice commands from the lock screen; depending on the request, Siri may still require unlocking for personal data/actions | |
| Allow Siri access to user-generated content | When activated , it allows Siri to query and use user-generated content from the web.
Expands responses to include content from forums/social networks but increases the risk of inappropriate or unreliable information | |
| Allow Dictation | When activated , it allows dictation input on the device | |
| On-Device Dictation | When activated , speech input is processed entirely on the device without contacting Siri servers.
This enhances privacy and offline capability but may limit language coverage/features compared to server dictation | |
| Force translation on the device only | When activated , it processes translations entirely on the device.
This protects confidential content and works offline but may increase computational load and sometimes result in lower quality or language support | |
| Allow QuickPath Keyboard | When activated , it activates the QuickPath keyboard for smooth typing by swiping | |
Content & EntertainmentContent & Entertainment | ||
| Allow Apple Music | When activated , it allows the use of Apple Music in the Music app | |
| Allow iTunes Radio | When activated , it allows the use of iTunes Radio in the Music app | |
| Allow News App | When activated , it allows access to the News app | |
| Set App Age Rating | Allow All Apps | Sets the highest allowed app age rating
Show options for setting app age ratings hide Klicken für dauerhafte Anzeige Allow All Apps 17+ 12+ 9+ 4+ Allow Nothing
|
| Set Movie Age Rating | All Movies | Sets the highest allowed movie age rating (FSK)
Show options for setting movie age ratings hide Klicken für dauerhafte Anzeige All Movies FSK 18 FSK 16 FSK 12 FSK 6 FSK 0 No Movies
|
| Set TV Show Age Rating | All TV Shows | Sets the highest allowed TV show age rating
Show options for setting TV show age ratings hide Klicken für dauerhafte Anzeige All TV Shows 18+ 16+ 12+ 6+ 0+ No TV Shows
|
| Allow Cookies in Safari | Only from current website (iOS 8) or visited sites (pre-iOS 8) | Options for setting cookie acceptance in Safari
Show options for accepted cookies in Safari hide Klicken für dauerhafte Anzeige Only from current website (iOS 8) or visited sites (pre-iOS 8) Never Websites I visited Always
|
| Allow JavaScript | When activated , it enables the execution of JavaScript in Safari.
This is essential for modern web apps; deactivation increases security but breaks interactive functions | |
| Allow Pop-ups | When activated , it allows pop-up windows in Safari.
This is sometimes necessary for authentication flows, downloads, or print dialogs of older portals but increases the risk of ads/phishing | |
| Enable Fraud Warning | When activated , it activates the Safari fraud warning | |
System & MiscellaneousSystem & Miscellaneous | ||
| Allow OTAPKI Updates | ||
| Allow Temporary Sessions (Shared iPad) | When activated , it allows temporary sessions on "Shared iPad" devices.
This supports spontaneous use without permanent accounts (e.g., training/kiosk). Local data is deleted after logout | |
| Force AirPlay Pairing Password (Outgoing) | When activated , a pairing password is required for all devices receiving AirPlay requests from this device; prevents unauthorized screen sharing | |
| Allow Changing Device Name | When activated , it allows changing the device name | |
| Allow Voice Dialing When Device is Locked | When activated , it allows voice dialing when the device is locked | |
| Force Apple Watch Wrist Detection | When activated , it enforces wrist detection on paired Apple Watches.
Automatically locks the watch when removed (e.g., for Apple Pay/unlocking) and prevents access by unauthorized users | |
| Allow Pairing with Apple Watch | When activated , it allows pairing with an Apple Watch | |
| Allow Web Results in Spotlight | When activated , it allows web search results in Spotlight and Siri suggestions.
This improves research and quick access but may display uncurated web content and potentially sensitive search terms | |
| Allow Personalized Advertising | When activated , it enables personalized advertising features.
Increases relevance in Apple ads but reduces privacy through profiling and may conflict with compliance requirements | |
| Allow Camera Usage | When activated , it allows the user to use the camera.
Deactivating locks the camera for all applications | |
| Allow Changing Notification Settings | When activated , it allows changing notification settings | |
| Allow Managed Apps to Write to Unmanaged Contacts | When activated , it allows managed apps to write contacts to unmanaged accounts.
This facilitates caller identification in private apps but may lead to data flow from the managed area to personal address books | |
| Allow Unmanaged Apps to Read Managed Contacts | When activated , it allows unmanaged apps to access contacts stored in managed accounts.
This increases convenience in private apps (e.g., caller identification) but may expose managed contacts to unmanaged apps | |
| Allow iCloud Synchronization for Managed Apps | When activated , it allows managed apps to synchronize data via iCloud | |
| Allow Opening from Unmanaged Sources in Managed Apps | When activated , it allows opening documents from unmanaged apps in managed apps.
This facilitates collecting external files (e.g., from system apps like Camera, Contacts, etc.) into the protected container but may import potentially harmful or private content | |
| Allow Opening from Managed Sources in Unmanaged Apps | When activated , it allows opening documents from managed apps in unmanaged apps.
This reduces friction in mixed workflows but poses a high compliance risk | |
| Managed Clipboard | When activated , it enforces that the clipboard distinguishes between managed and unmanaged sources | |
| Treat AirDrop as Unmanaged Destination | When activated , it enforces that AirDrop transfers are treated as 'unmanaged'.
In combination with Allow opening from managed sources in unmanaged apps deactivated, sharing via AirDrop from managed apps is prevented | |
For User Enrollment
| 1. | 2. | 3. |
| Abb.1 | Abb.2 | Abb.3 |
| Abbildungen | ||
| Caption | Value | Description |
|---|---|---|
Device Security & Data Privacy
| ||
| Allow automatic unlocking | When enabled , it allows automatic unlocking for quick device access (e.g., via Apple Watch)
However, it increases the risk in the event of loss or unauthorized access | |
| Allow Control Center on Lock Screen | When enabled , it allows access to the Control Center directly from the lock screen
This facilitates quick actions (Wi-Fi, flashlight) but can allow unwanted changes without authentication | |
| Allow notification view on lock screen | When activated , it enables the display of past notifications on the lock screen.
This improves the visibility of important information but increases the risk that sensitive content may be viewed by third parties | |
| Allow Today View on Lock Screen | When enabled , it allows the "Today" view to be displayed on the lock screen.
This provides an at-a-glance view of widgets and appointments but may expose operational data without unlocking the device | |
| Force encrypted backups | When enabled , it encrypts all device backups.
This protects corporate data in local backups (Finder/iTunes) and secures sensitive app data | |
| Restrict Ad Tracking | When enabled , it limits ad and app tracking to enhance privacy
Reduces cross-app and cross-website tracking (ATT) and supports compliance | |
| Allow Find My Device | When activated , Find My Device is allowed in the Find My app | |
| Allow Find My Friends | When activated , Find My Friends is allowed in the Find My app | |
| Allow trusting enterprise apps | When activated , it disables the "Trust Enterprise Developer" button (Settings > General > Profiles & Device Management) and prevents users from manually marking apps outside the App Store and MDM as trusted.
This prevents shadow IT and ensures that only apps distributed and signed via MDM are used | |
| Allow Screenshots and Screen Recordings | When activated , it allows the user to take screenshots and screen recordings | |
| Wallet Notifications on Lock Screen | When activated , it enables wallet notifications on the lock screen.
This displays, for example, boarding passes/receipts without unlocking but may expose sensitive payment information | |
| Allow Mail Privacy Protection | When activated , it enables the "Mail Privacy Protection" option in "Mail".
Hides IP addresses and opening times (tracking pixels) | |
| Allow unlocking with Touch & Face ID | When activated , it allows biometric unlocking | |
| Allow changing Touch & Face ID | When activated , it allows changing Touch & Face IDs | |
| Allow sending diagnostic data | When activated , it allows the automatic sending of diagnostic reports to Apple.
This supports troubleshooting and stability but may share telemetry data outside the company | |
| Allow changing diagnostic settings | When activated , it allows changes to diagnostic and analysis settings.
May bypass compliance requirements; usually deactivated in regulated environments | |
| Allow network access for files | When activated , it allows connection to network drives in the "Files" app | |
| Allow changing Bluetooth settings | When activated , it allows changes to Bluetooth settings | |
| Allow changing mobile data usage for apps | When activated , it allows adjusting mobile data usage settings for apps | |
| Allow accepting untrusted TLS certificates | When activated , it allows the user to accept untrusted TLS certificates.
When deactivated, the device rejects unconfirmed HTTPS certificates without prompting | |
| Allow Handoff | When activated , it allows the continuation of activities between devices.
This improves cross-platform workflow (iPhone ⇄ iPad ⇄ Mac) but may expose content outside the managed device context | |
Cloud & SynchronizationCloud & Synchronization | ||
| Allow iCloud Photos | When activated , it allows the use of iCloud Photos.
This automatically backs up photos/videos and makes them available across devices but may lead to data leakage into private Apple IDs | |
| Allow iCloud Backup | When activated , it allows device backups via iCloud | |
| Allow automatic synchronization during roaming | When activated , it allows data synchronization during roaming.
This keeps apps and files up to date for field service/travel but may incur high roaming costs and increased battery/data usage | |
| Allow backup of Enterprise Books | When activated , it allows backing up Enterprise Books | |
| Allow synchronization of notes/highlights in Enterprise Books | When activated , it allows synchronization of notes and highlights in Enterprise Books | |
| Allow In-App Purchases | When activated , it allows making purchases within apps
notempty
Only relevant if purchases with private Apple ID are allowed | |
| Allow Multiplayer Gaming | When activated , it allows playing multiplayer games | |
| Require iTunes password for all purchases | When activated , it requires the iTunes password for every purchase
notempty
Only relevant if purchases with private Apple ID are allowed | |
Siri & DictationSiri & Dictation | ||
| Allow Siri | When activated , it allows the use of Siri | |
| Allow Siri on Lock Screen | When activated , it allows the use of Siri on a locked device.
Allows voice commands from the lock screen; depending on the request, Siri may still require unlocking for personal data/actions | |
| Allow Siri access to user-generated content | When activated , it allows Siri to query and use user-generated content from the web.
Expands responses to include content from forums/social networks but increases the risk of inappropriate or unreliable information | |
| Allow Dictation | When activated , it allows dictation input on the device | |
| On-Device Dictation | When activated , speech input is processed entirely on the device without contacting Siri servers.
This enhances privacy and offline capability but may limit language coverage/features compared to server dictation | |
| Force translation on the device only | When activated , it processes translations entirely on the device.
This protects confidential content and works offline but may increase computational load and sometimes result in lower quality or language support | |
| Allow QuickPath Keyboard | When activated , it activates the QuickPath keyboard for smooth typing by swiping | |
| Allow Apple Music | When activated , it allows the use of Apple Music in the Music app | |
| Allow iTunes Radio | When activated , it allows the use of iTunes Radio in the Music app | |
| Allow News App | When activated , it allows access to the News app | |
| Set App Age Rating | Allow All Apps | Sets the highest allowed app age rating
Show options for setting app age ratings hide Klicken für dauerhafte Anzeige Allow All Apps 17+ 12+ 9+ 4+ Allow Nothing
|
| Set Movie Age Rating | All Movies | Sets the highest allowed movie age rating (FSK)
Show options for setting movie age ratings hide Klicken für dauerhafte Anzeige All Movies FSK 18 FSK 16 FSK 12 FSK 6 FSK 0 No Movies
|
| Set TV Show Age Rating | All TV Shows | Sets the highest allowed TV show age rating
Show options for setting TV show age ratings hide Klicken für dauerhafte Anzeige All TV Shows 18+ 16+ 12+ 6+ 0+ No TV Shows
|
Safari Browser SettingsSafari Browser Settings | ||
| Allow Cookies in Safari | Only from current website (iOS 8) or visited sites (pre-iOS 8) | Options for setting cookie acceptance in Safari
Show options for accepted cookies in Safari hide Klicken für dauerhafte Anzeige Only from current website (iOS 8) or visited sites (pre-iOS 8) Never Websites I visited Always
|
| Allow JavaScript | When activated , it enables the execution of JavaScript in Safari.
This is essential for modern web apps; deactivation increases security but breaks interactive functions | |
| Allow Pop-ups | When activated , it allows pop-up windows in Safari.
This is sometimes necessary for authentication flows, downloads, or print dialogs of older portals but increases the risk of ads/phishing | |
| Enable Fraud Warning | When activated , it activates the Safari fraud warning | |
System & MiscellaneousSystem & Miscellaneous | ||
| Allow OTAPKI Updates | ||
| Allow Temporary Sessions (Shared iPad) | When activated , it allows temporary sessions on "Shared iPad" devices.
This supports spontaneous use without permanent accounts (e.g., training/kiosk). Local data is deleted after logout | |
| Force AirPlay Pairing Password (Outgoing) | When activated , a pairing password is required for all devices receiving AirPlay requests from this device; prevents unauthorized screen sharing | |
| Allow Changing Device Name | When activated , it allows changing the device name | |
| Allow Voice Dialing When Device is Locked | When activated , it allows voice dialing when the device is locked | |
| Force Apple Watch Wrist Detection | When activated , it enforces wrist detection on paired Apple Watches.
Automatically locks the watch when removed (e.g., for Apple Pay/unlocking) and prevents access by unauthorized users | |
| Allow Pairing with Apple Watch | When activated , it allows pairing with an Apple Watch | |
| Allow Web Results in Spotlight | When activated , it allows web search results in Spotlight and Siri suggestions.
This improves research and quick access but may display uncurated web content and potentially sensitive search terms | |
| Allow Personalized Advertising | When activated , it enables personalized advertising features.
Increases relevance in Apple ads but reduces privacy through profiling and may conflict with compliance requirements | |
| Allow Camera Usage | When activated , it allows the user to use the camera.
Deactivating locks the camera for all applications | |
| Allow Changing Notification Settings | When activated , it allows changing notification settings | |
Data FlowData Flow | ||
| Allow Managed Apps to Write to Unmanaged Contacts | When activated , it allows managed apps to write contacts to unmanaged accounts.
This facilitates caller identification in private apps but may lead to data flow from the managed area to personal address books | |
| Allow Unmanaged Apps to Read Managed Contacts | When activated , it allows unmanaged apps to access contacts stored in managed accounts.
This increases convenience in private apps (e.g., caller identification) but may expose managed contacts to unmanaged apps | |
| Allow iCloud Synchronization for Managed Apps | When activated , it allows managed apps to synchronize data via iCloud | |
| Allow Opening from Unmanaged Sources in Managed Apps | When activated , it allows opening documents from unmanaged apps in managed apps.
This facilitates collecting external files (e.g., from system apps like Camera, Contacts, etc.) into the protected container but may import potentially harmful or private content | |
| Allow Opening from Managed Sources in Unmanaged Apps | When activated , it allows opening documents from managed apps in unmanaged apps.
This reduces friction in mixed workflows but poses a high compliance risk | |
| Managed Clipboard | When activated , it enforces that the clipboard distinguishes between managed and unmanaged sources | |
| Treat AirDrop as Unmanaged Destination | When activated , it enforces that AirDrop transfers are treated as 'unmanaged'.
In combination with Allow opening from managed sources in unmanaged apps deactivated, sharing via AirDrop from managed apps is prevented | |
Classroom-App
The Classroom App is available free of charge in the App-Store and offers possibilities for use in school classes.
Important restrictions can be configured here.
| 1. | 2. | 3. |
| Abb.1 | Abb.2 | Abb.3 |
| Abbildungen | ||
| Restrictions | Default | Explanation |
|---|---|---|
| Allow remote screen monitoring | When activated , remote screen monitoring via the Classroom app is enabled.
If screenshots are disabled, remote screen monitoring is also disabled | |
| Force automatic course enrollment | When activated , it automatically approves requests from instructors | |
| Leaving classes only with permission | When activated , it requires students in unmanaged courses to obtain instructor permission before leaving the course | |
| Enforce app and device locking without prompting | When activated , it allows instructors to lock apps or the device without student confirmation | |
| Force screen monitoring without prompting | When activated , it automatically grants instructors in managed courses permission to monitor students' screens.
Only works if remote screen monitoring is allowed |
Restrictions for supervised devices
A range of restrictions is only available for devices in the Supervised embedding mode.
| 1. | 2. | 3. |
| Abb.1 | Abb.2 | Abb.3 |
| Abbildungen | ||
| Restriction | Default | Explanation |
|---|---|---|
App Usage & Installation
| ||
| Restrict App Usage | Allow all apps | Allow all apps, blocklist, or allowlist
Show options for restricting app usage hide Klicken für dauerhafte Anzeige Allow all apps Do not allow certain apps Allow only certain apps
Show additional configurations when selecting "Do not allow certain apps"
|
| Blocked apps | Select application | Select the apps to be blocked Multiple apps can be selected |
| Add system apps | All system apps are added.
System apps can then be removed individually. | |
| Erlaubte Apps | Select application | Select the apps to be allowed Multiple apps can be selected |
| Add system apps | All system apps are added.
System apps can then be removed individually. | |
| Single App Mode: Allowed Apps | Select application | List of apps allowed to run in single app mode |
| Allow removing apps | Allows the user to remove apps | |
| Allow app installation via Configurator/iTunes | When deactivated , the system disables the App Store, Configurator, marketplace, etc.
This prevents manual/sideloading installation methods and reduces shadow IT | |
| Allow automatic app downloads | When deactivated , the system prevents automatic downloading of apps purchased on other devices.
This prevents private Apple ID purchases from appearing on corporate devices; useful for BYOD/COBO | |
| Allow app installation from the App Store | When activated , it allows the user to install applications from the App Store | |
| Allow App Clips | When activated , App Clips are enabled.
When deactivated , all App Clips are removed | |
Communication
| ||
| Allow AirDrop | When activated , AirDrop is enabled | |
| Allow AirPrint | When activated , AirPrint is enabled | |
| Allow saving AirPrint credentials | When activated , it allows saving AirPrint login credentials in the iCloud keychain | |
| Allow AirPrint iBeacon detection | When activated , it allows detection of AirPrint printers via iBeacon | |
| Require trusted TLS for AirPrint | When activated , it requires trusted TLS certificates for secure AirPrint communication.
Protects against man-in-the-middle attacks but requires correctly issued certificates on the printers | |
| Allow change of mobile tariff | When activated , it allows changing mobile tariff settings | |
| Allow iCloud keychain synchronization | When activated , it allows iCloud keychain synchronization | |
| Allow private iCloud relay | When activated , iCloud Private Relay is enabled.
This obscures IP/DNS requests for more privacy but may bypass web filter/proxy policies | |
| Allow eSIM changes | When activated , it allows changes to settings related to the mobile tariff | |
| Allow Files app access to USB drives | When activated , it allows the Files app to connect to USB drives.
Facilitates offline data exchange but increases compliance risks | |
| Allow host pairing | When activated , it allows pairing with a computer notempty
If pairing is disabled , the end device can no longer be connected to a computer via USB.
Please ensure that the end device always has a functioning internet connection even without pairing | |
| Allow NFC | When activated , NFC is enabled | |
| Allow changing hotspot settings | When activated , it allows changing personal hotspot settings | |
| Allow VPN creation | When activated , it allows creating VPN configurations | |
| Allow configuration of nearby devices | When activated , it enables the prompt to configure new nearby devices upon proximity.
This accelerates rollouts/transfers but may allow unintended account/settings takeovers from unmanaged devices | |
Data Sharing
| ||
| Allow automatic password filling | When activated , the "AutoFill Passwords" feature is enabled.
This speeds up logins and reduces typing errors; due to domain reference and user confirmation, AutoFill usually does not apply to phishing sites | |
| Enforce authentication before automatic filling | When activated , it requires authentication before passwords or credit card information are autofilled | |
| Allow password requests to nearby devices | When activated , it allows the system to request passwords from nearby devices.
Applies only to Wi-Fi passwords; may allow sharing of network credentials with foreign devices | |
| Allow password sharing | When activated , it allows sharing passwords via AirDrop | |
| Allow account modification | When activated , it allows users to add, remove, or modify accounts (e.g., Apple IDs, internet-based accounts) in settings.
notempty
This option prevents, for example, the creation of another Apple account, which could then be used to install additional apps. notempty
iOS can only activate this restriction for all accounts. This also means that changing a password for an Exchange account is no longer possible. | |
| Allow modification of Find My Friends | When activated , it allows modifications to the settings for "Find My Friends" (within the "Find My" app) | |
Media & Entertainment
| ||
| Allow Podcasts | When activated , the Podcasts app is enabled | |
| Allow explicit content | When activated , it allows access to explicit content.
When activated, the SafeSearch function is switched off by Safari. | |
| Allow iMessage | When activated , iMessage is enabled.
For Wi-Fi-only devices, the "Messages" app is hidden; for cellular devices, the app remains but uses only SMS/MMS | |
| Allow Apple Books Store | When activated , the Apple Books Store is enabled.
Supervised only. If disabled, iBookstore will be disabled | |
| Allow erotica in Apple Books | When activated , it allows downloading books marked as erotica.
Supervised only. If disabled, the user will not be able to download media from the iBookstore marked as erotica | |
| Allow iTunes Store | When activated , the iTunes Music Store is enabled | |
| Allow Safari | When activated , the Safari browser is enabled.
Web Clips cannot be opened with Safari browser disabled | |
| Allow Game Center | When activated , Game Center is enabled | |
| Allow adding Game Center friends | When activated , it allows users to add friends in Game Center | |
| Allow FaceTime | When activated , the FaceTime app is allowed.
Camera usage must also be enabled | |
| Enable Siri profanity filter | When activated , the Siri profanity filter is enabled | |
| Allow AutoFill in Safari | When activated , AutoFill in Safari is enabled | |
| Allow changing wallpaper | When activated , it allows changing the wallpaper | |
| Allow shared albums | When activated , it allows shared photo albums.
This simplifies team-wide sharing. Shared photo albums are limited, stored in reduced resolution, and do not count against iCloud storage | |
System and Device Control
| ||
| Allow removal of system apps | When activated , it allows users to remove system apps.
If set to false, the removal of system apps is disabled | |
| Allow unpaired devices to start in recovery mode | When activated , it allows unpaired devices to start the device in recovery mode.
This can simplify service/repair workflows but reduces protection against unauthorized deletion attempts via USB. If set to false, unpaired external booting for recovery is disabled | |
| Enforce USB restricted mode | When activated , it enforces USB restricted mode, requiring authorization for USB accessories when the device is locked.
If set to false, the restricted USB mode will be disabled | |
| Enforce automatic date and time | When activated , it enforces the "Set Automatically" setting for date and time.
Prevents time manipulation (e.g., to bypass certificate/token checks). If set to true, the date and time are automatically enforced | |
| Enforce Wi-Fi | When activated , it prevents disabling the Wi-Fi function.
Useful for always-on management. If set to true, WLAN is forced only on allowed networks | |
| Allow joining only Wi-Fi networks from profiles |
If set to true, WLAN is forced only on allowed networks | |
| Allow changing device passcode | When activated , it allows changing the device passcode | |
| Allow user installation of configuration profiles | When activated , it allows users to install configuration profiles and certificates via the user interface.
Deactivating reduces the risk of unwanted profiles (e.g., unwanted VPN/Root CA) and enforces MDM-controlled changes. If set to false, the user is prohibited from installing configuration profiles and certificates interactively | |
| Allow reset to factory settings | When activated , the "Erase All Content and Settings" option in Settings is enabled.
Deactivating protects corporate devices from user-initiated wipes. If disabled, the user cannot select the "Clear all content and settings" option in Settings > General > Reset. notempty
A user-initiated "Find My" deletion can still take effect unless separately prevented | |
| Allow changing Screen Time settings | When activated , it allows changing Screen Time settings.
Deactivating prevents local bypassing of restrictions/age ratings. Allow configuration restrictions | |
| Allow iCloud document synchronization | When activated , it allows document synchronization with iCloud.
Deactivating disables document and key-value sync via iCloud; affected apps lose iCloud sync functionality. Allow document synchronization with iCloud | |
| Enforce delayed software updates | When activated , it delays the visibility of software updates for the user.
Suitable for staggered rollouts. When active, user visibility of software updates is delayed. | |
| Delay software updates (in days) | 30 | Sets the number of days by which the visibility of software updates is delayed.
Valid values are 1 - 90 days. With this restriction, the administrator can specify by how many days a software or app update is delayed on the device. With this restriction, the user will not see a software update until the specified number of days after the software update release date. |
Keyboard
| ||
| Enable predictions | When activated , text predictions on the keyboard are enabled.
Allow predictive keyboard. | |
| Enable keyboard shortcuts | When activated , it allows the use of keyboard shortcuts.
Allow keyboard shortcuts. | |
| Enable autocorrect | When activated , autocorrect during input is enabled.
Allow autocorrect. | |
| Enable spell check | When activated , spell check is enabled to underline misspelled words.
Allow correction help. | |
| Enable Look Up | When activated , quick lookup of word definitions is enabled.
Allow correction help. | |
| Enable automatic sleep mode | When activated , it allows the device to automatically switch to sleep mode when inactive.
If set to false, the hibernation of the device is disabled | |
| Enable automatic screensaver | When activated , the automatic screensaver is enabled | |
| Enable pairing with Remote App | When activated , it allows pairing Apple TV with the Remote App or the widget in the Control Center | |
For Apple TVs
| 1. | 2. | 3. |
| Abb.1 | Abb.2 | Abb.3 |
| Abbildungen | ||
| Restriction | Default | Explanation |
|---|---|---|
App Usage & Installation
| ||
| Restrict App Usage | Allow all apps | Allow all apps, blocklist, or allowlist
Show options for restricting app usage hide Klicken für dauerhafte Anzeige Allow all apps Do not allow certain apps Allow only certain apps
Show additional configurations when selecting "Do not allow certain apps"
|
| Blocked apps | Select application | Select the apps to be blocked Multiple apps can be selected |
| Add system apps | All system apps are added.
System apps can then be removed individually. | |
| Erlaubte Apps | Select application | Select the apps to be allowed Multiple apps can be selected |
| Add system apps | All system apps are added.
System apps can then be removed individually. | |
| Single App Mode: Allowed Apps | Select application | List of apps allowed to run in single app mode |
| Allow removing apps | Allows the user to remove apps | |
| Allow app installation via Configurator/iTunes | When deactivated , the system disables the App Store, Configurator, marketplace, etc.
This prevents manual/sideloading installation methods and reduces shadow IT | |
| Allow automatic app downloads | When deactivated , the system prevents automatic downloading of apps purchased on other devices.
This prevents private Apple ID purchases from appearing on corporate devices; useful for BYOD/COBO | |
| Allow app installation from the App Store | When activated , it allows the user to install applications from the App Store | |
| Allow App Clips | When activated , App Clips are enabled.
When deactivated , all App Clips are removed | |
| Allow AirDrop | When activated , AirDrop is enabled | |
| Allow AirPrint | When activated , AirPrint is enabled | |
| Allow saving AirPrint credentials | When activated , it allows saving AirPrint login credentials in the iCloud keychain | |
| Allow AirPrint iBeacon detection | When activated , it allows detection of AirPrint printers via iBeacon | |
| Require trusted TLS for AirPrint | When activated , it requires trusted TLS certificates for secure AirPrint communication.
Protects against man-in-the-middle attacks but requires correctly issued certificates on the printers | |
| Allow change of mobile tariff | When activated , it allows changing mobile tariff settings | |
| Allow iCloud keychain synchronization | When activated , it allows iCloud keychain synchronization | |
| Allow private iCloud relay | When activated , iCloud Private Relay is enabled.
This obscures IP/DNS requests for more privacy but may bypass web filter/proxy policies | |
| Allow eSIM changes | When activated , it allows changes to settings related to the mobile tariff | |
| Allow Files app access to USB drives | When activated , it allows the Files app to connect to USB drives.
Facilitates offline data exchange but increases compliance risks | |
| Allow host pairing | When activated , it allows pairing with a computer notempty
If pairing is disabled , the end device can no longer be connected to a computer via USB.
Please ensure that the end device always has a functioning internet connection even without pairing | |
| Allow NFC | When activated , NFC is enabled | |
| Allow changing hotspot settings | When activated , it allows changing personal hotspot settings | |
| Allow VPN creation | When activated , it allows creating VPN configurations | |
| Allow configuration of nearby devices | When activated , it enables the prompt to configure new nearby devices upon proximity.
This accelerates rollouts/transfers but may allow unintended account/settings takeovers from unmanaged devices | |
Data Sharing
| ||
| Allow automatic password filling | When activated , the "AutoFill Passwords" feature is enabled.
This speeds up logins and reduces typing errors; due to domain reference and user confirmation, AutoFill usually does not apply to phishing sites | |
| Enforce authentication before automatic filling | When activated , it requires authentication before passwords or credit card information are autofilled | |
| Allow password requests to nearby devices | When activated , it allows the system to request passwords from nearby devices.
Applies only to Wi-Fi passwords; may allow sharing of network credentials with foreign devices | |
| Allow password sharing | When activated , it allows sharing passwords via AirDrop | |
| Allow account modification | When activated , it allows users to add, remove, or modify accounts (e.g., Apple IDs, internet-based accounts) in settings.
notempty
This option prevents, for example, the creation of another Apple account, which could then be used to install additional apps. notempty
iOS can only activate this restriction for all accounts. This also means that changing a password for an Exchange account is no longer possible. | |
| Allow modification of Find My Friends | When activated , it allows modifications to the settings for "Find My Friends" (within the "Find My" app) | |
Media & Entertainment
| ||
| Allow Podcasts | When activated , the Podcasts app is enabled | |
| Allow explicit content | When activated , it allows access to explicit content.
When activated, the SafeSearch function is switched off by Safari. | |
| Allow iMessage | When activated , iMessage is enabled.
For Wi-Fi-only devices, the "Messages" app is hidden; for cellular devices, the app remains but uses only SMS/MMS | |
| Allow Apple Books Store | When activated , the Apple Books Store is enabled.
Supervised only. If disabled, iBookstore will be disabled | |
| Allow erotica in Apple Books | When activated , it allows downloading books marked as erotica.
Supervised only. If disabled, the user will not be able to download media from the iBookstore marked as erotica | |
| Allow iTunes Store | When activated , the iTunes Music Store is enabled | |
| Allow Safari | When activated , the Safari browser is enabled.
Web Clips cannot be opened with Safari browser disabled | |
| Allow Game Center | When activated , Game Center is enabled | |
| Allow adding Game Center friends | When activated , it allows users to add friends in Game Center | |
| Allow FaceTime | When activated , the FaceTime app is allowed.
Camera usage must also be enabled | |
| Enable Siri profanity filter | When activated , the Siri profanity filter is enabled | |
| Allow AutoFill in Safari | When activated , AutoFill in Safari is enabled | |
| Allow changing wallpaper | When activated , it allows changing the wallpaper | |
| Allow shared albums | When activated , it allows shared photo albums.
This simplifies team-wide sharing. Shared photo albums are limited, stored in reduced resolution, and do not count against iCloud storage | |
System and Device Control
| ||
| Allow removal of system apps | When activated , it allows users to remove system apps.
If set to false, the removal of system apps is disabled | |
| Allow unpaired devices to start in recovery mode | When activated , it allows unpaired devices to start the device in recovery mode.
This can simplify service/repair workflows but reduces protection against unauthorized deletion attempts via USB. If set to false, unpaired external booting for recovery is disabled | |
| Enforce USB restricted mode | When activated , it enforces USB restricted mode, requiring authorization for USB accessories when the device is locked.
If set to false, the restricted USB mode will be disabled | |
| Enforce automatic date and time | When activated , it enforces the "Set Automatically" setting for date and time.
Prevents time manipulation (e.g., to bypass certificate/token checks). If set to true, the date and time are automatically enforced | |
| Enforce Wi-Fi | When activated , it prevents disabling the Wi-Fi function.
Useful for always-on management. If set to true, WLAN is forced only on allowed networks | |
| Allow joining only Wi-Fi networks from profiles |
If set to true, WLAN is forced only on allowed networks | |
| Allow changing device passcode | When activated , it allows changing the device passcode | |
| Allow user installation of configuration profiles | When activated , it allows users to install configuration profiles and certificates via the user interface.
Deactivating reduces the risk of unwanted profiles (e.g., unwanted VPN/Root CA) and enforces MDM-controlled changes. If set to false, the user is prohibited from installing configuration profiles and certificates interactively | |
| Allow reset to factory settings | When activated , the "Erase All Content and Settings" option in Settings is enabled.
Deactivating protects corporate devices from user-initiated wipes. If disabled, the user cannot select the "Clear all content and settings" option in Settings > General > Reset. notempty
A user-initiated "Find My" deletion can still take effect unless separately prevented | |
| Allow changing Screen Time settings | When activated , it allows changing Screen Time settings.
Deactivating prevents local bypassing of restrictions/age ratings. Allow configuration restrictions | |
| Allow iCloud document synchronization | When activated , it allows document synchronization with iCloud.
Deactivating disables document and key-value sync via iCloud; affected apps lose iCloud sync functionality. Allow document synchronization with iCloud | |
| Enforce delayed software updates | When activated , it delays the visibility of software updates for the user.
Suitable for staggered rollouts. When active, user visibility of software updates is delayed. | |
| Delay software updates (in days) | 30 | Sets the number of days by which the visibility of software updates is delayed.
Valid values are 1 - 90 days. With this restriction, the administrator can specify by how many days a software or app update is delayed on the device. With this restriction, the user will not see a software update until the specified number of days after the software update release date. |
| Enable predictions | When activated , text predictions on the keyboard are enabled.
Allow predictive keyboard. | |
| Enable keyboard shortcuts | When activated , it allows the use of keyboard shortcuts.
Allow keyboard shortcuts. | |
| Enable autocorrect | When activated , autocorrect during input is enabled.
Allow autocorrect. | |
| Enable spell check | When activated , spell check is enabled to underline misspelled words.
Allow correction help. | |
| Enable Look Up | When activated , quick lookup of word definitions is enabled.
Allow correction help. | |
tvOS Exclusive
| ||
| Enable automatic sleep mode | When activated , it allows the device to automatically switch to sleep mode when inactive.
If set to false, the hibernation of the device is disabled | |
| Enable automatic screensaver | When activated , the automatic screensaver is enabled | |
| Enable pairing with Remote App | When activated , it allows pairing Apple TV with the Remote App or the widget in the Control Center | |