Jump to:navigation, search
Wiki

Configuration iOS profile: AppleTV

From Securepoint Wiki












































Managing iOS profiles with the Apple TV type in the Mobile Security Portal

Last adaptation to the version: 2.20 (08.2026)

New:
notempty
This article refers to a Beta version
Access: portal.securepoint.cloud  Mobile Security iOS/iPadOS Profile



In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
Diese Seite wird auf folgenden Seiten eingebunden









































Preamble

In a profile permissions, restrictions, password requirements, email settings and security settings are configured.
Several users or user groups (roles) can be assigned to a profile.
Several devices or device groups (devices designated by tags) can be assigned to a profile.

notempty
For a large number of devices and users it is recommended to map the assignment via groups.
  • Device registration is directly tied to a profile
  • A profile must be created first' (and configured) before a device can be registered

In Android Enterprise profiles, numerous security-relevant settings can be made, e.g.

  • Disable Kamara
  • Disable microphone
  • Disable USB file transfer
  • Disable outgoing calls
  • Disable Bluetooth
  • Disable contact sharing
  • Disable tethering
  • Disable sms
  • Enable network only with VPN
  • and much more.
notempty
Android Enterprise Profiles are used immediately and do not need to be published!
Note on previous Android profiles
hide
Klicken für dauerhafte Anzeige
  • Outdated Android profiles behave fundamentally different than Android Enterprise Profiles (EMM)
  • It is no longer possible to assign a profile to a role, user or tag

Overview of profile management

In the profile overview new profiles can be created, existing ones can be edited and deleted. The view of the profiles can be displayed in the list or tile view. You can also view details of existing profiles, update the list of profiles, and publish profiles.
Overview of profile management iOS
Overview of profile management Android

General Options

Search Filters on profile tiles that contain the search text
 Sort
Clicking this button opens a menu where you can sort the tiles according to specific criteria
 Sort
Clicking this button opens a menu where you can sort the tiles according to specific criteria
Name
Sorts the tiles by profile name
Priority
Sorts the tiles according to the priority of the profile
Ascending
Sorts the tiles in ascending or descending order according to the selected criterion
 Add profile Creates a new profile. The settings in the profile vary depending on the operating system.
 Import profile Existing profiles that were previously exported from the Securepoint Mobile Security Portal can be imported here
 Hide generated profiles Hides the generated profiles
Show details Show / hide details: For a large number of profiles, it can be useful to hide the most important details for clarity.
/ List view / Grid view Switch between lists and grid view
Refresh Refreshes the display

Profile tile

Profile-Options
The button at the top right of each profile tile provides the following options:
 Edit Editing the settings (see below)
  Copy Copying the profile to the clipboard
  Export Exporting the settings
  Delete The profile is deleted
notempty
New as of: 2.5
Android profiles that have at least one assigned device cannot be deleted.
Details displayed in the profile tile:
 Updated Changes have been made to the profile that have not yet been published!
 Partially installed Not all sub profiles were able to be installed
Profile information
  Type Profile type (see below)
  Roles Roles
  Users User
 Devices Devices
  tags Tags
  Parts Listing of the sub-profiles that make up the complete Mobile Security Profile.

Copy & paste of profiles

Click on the logo of the profile tile to mark one or more profiles In the general options, another field now appears under the filter mask:
Action for selected items Please choose Execute the selected action with Ok
Copy Copies one or more selected profiles to the clipboard
Delete Deletes one or more selected profiles
notempty
New as of: 2.5
Android profiles that have at least one assigned device cannot be deleted.
  Paste Inserts a copy of a profile from the clipboard
This also works from one tenant / customer to another as long as they are assigned to the same reseller account   AnyIdeas GmbH


Configuration iOS profile AppleTV

In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
Diese Seite wird auf folgenden Seiten eingebunden


























General

 Add profile

Caption Value Description
General menu item
Type Device profile Standard device profile
Shared iPad Profile that allows different users for one iPad
  • Only for devices with iPadOS
    • Apple TV profiles Profile with limited settings options. Additional settings for Apple TV
    User Enrollmant profile Profile owned by the user on which managed apps of the company can be installed
    Name Name Profile name
    Priority 5 The higher the number, the higher the priority. This is only used if a device is assigned to multiple profiles.
    Roles Add roles Click-Box: The profile will be assigned to all devices of all users with these roles
    Users Add users The profile will be assigned to all devices from these users
    Ge­rä­te-Ali­as mit Ge­rä­te­na­men syn­chro­ni­sie­ren    Bei aktivierter Option wird der Geräte-Alias auf das betreute Gerät übertragen.
    Devices Add devices The profile will be assigned to these devices
    Tags Add tags The profile will be assigned to all devices with these tags
    Comment Comment Comment

    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden







    Close Closes the tab without applying changes
     Save Applies the changes / new creation, saves and closes the tab

    Restrictions

    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden

































































































    {{var | Regionscode--desc | 2-Buchstaben-Code für Regionen die in bestimmten Ratings benutzt werden.


























    Caption Value Description
    Allow automatic unlocking    When enabled   , it allows automatic unlocking for quick device access (e.g., via Apple Watch)

    However, it increases the risk in the event of loss or unauthorized access

    Allow Control Center on Lock Screen    When enabled   , it allows access to the Control Center directly from the lock screen

    This facilitates quick actions (Wi-Fi, flashlight) but can allow unwanted changes without authentication

    Allow notification view on lock screen    When activated   , it enables the display of past notifications on the lock screen.

    This improves the visibility of important information but increases the risk that sensitive content may be viewed by third parties

    Allow Today View on Lock Screen    When enabled   , it allows the "Today" view to be displayed on the lock screen.

    This provides an at-a-glance view of widgets and appointments but may expose operational data without unlocking the device

    Force encrypted backups    When enabled   , it encrypts all device backups.

    This protects corporate data in local backups (Finder/iTunes) and secures sensitive app data

    Restrict Ad Tracking    When enabled   , it limits ad and app tracking to enhance privacy

    Reduces cross-app and cross-website tracking (ATT) and supports compliance

    Allow Find My Device    When activated   , Find My Device is allowed in the Find My app
    Allow Find My Friends    When activated   , Find My Friends is allowed in the Find My app
    Allow trusting enterprise apps    When activated   , it disables the "Trust Enterprise Developer" button (Settings > General > Profiles & Device Management) and prevents users from manually marking apps outside the App Store and MDM as trusted.

    This prevents shadow IT and ensures that only apps distributed and signed via MDM are used

    Allow Screenshots and Screen Recordings    When activated   , it allows the user to take screenshots and screen recordings
    Wallet Notifications on Lock Screen    When activated   , it enables wallet notifications on the lock screen.

    This displays, for example, boarding passes/receipts without unlocking but may expose sensitive payment information

    Allow Mail Privacy Protection    When activated   , it enables the "Mail Privacy Protection" option in "Mail".

    Hides IP addresses and opening times (tracking pixels)

    Allow unlocking with Touch & Face ID    When activated   , it allows biometric unlocking
    Allow changing Touch & Face ID    When activated   , it allows changing Touch & Face IDs
    Allow sending diagnostic data    When activated   , it allows the automatic sending of diagnostic reports to Apple.

    This supports troubleshooting and stability but may share telemetry data outside the company

    Allow changing diagnostic settings    When activated   , it allows changes to diagnostic and analysis settings.

    May bypass compliance requirements; usually    deactivated in regulated environments

    Allow network access for files    When activated   , it allows connection to network drives in the "Files" app
    Allow changing Bluetooth settings    When activated   , it allows changes to Bluetooth settings
    Allow changing mobile data usage for apps    When activated   , it allows adjusting mobile data usage settings for apps
    Allow accepting untrusted TLS certificates    When activated   , it allows the user to accept untrusted TLS certificates.

    When    deactivated, the device rejects unconfirmed HTTPS certificates without prompting

    Allow Handoff    When activated   , it allows the continuation of activities between devices.

    This improves cross-platform workflow (iPhone ⇄ iPad ⇄ Mac) but may expose content outside the managed device context

    Allow iCloud Photos    When activated   , it allows the use of iCloud Photos.

    This automatically backs up photos/videos and makes them available across devices but may lead to data leakage into private Apple IDs

    Allow iCloud Backup    When activated   , it allows device backups via iCloud
    Allow automatic synchronization during roaming    When activated   , it allows data synchronization during roaming.

    This keeps apps and files up to date for field service/travel but may incur high roaming costs and increased battery/data usage

    Allow backup of Enterprise Books    When activated   , it allows backing up Enterprise Books
    Allow synchronization of notes/highlights in Enterprise Books    When activated   , it allows synchronization of notes and highlights in Enterprise Books
    Allow In-App Purchases    When activated   , it allows making purchases within apps
    notempty
    Only relevant if purchases with private Apple ID are allowed
    Allow Multiplayer Gaming    When activated   , it allows playing multiplayer games
    Require iTunes password for all purchases    When activated   , it requires the iTunes password for every purchase
    notempty
    Only relevant if purchases with private Apple ID are allowed
    Allow Siri    When activated   , it allows the use of Siri
    Allow Siri on Lock Screen    When activated   , it allows the use of Siri on a locked device.

    Allows voice commands from the lock screen; depending on the request, Siri may still require unlocking for personal data/actions

    Allow Siri access to user-generated content    When activated   , it allows Siri to query and use user-generated content from the web.

    Expands responses to include content from forums/social networks but increases the risk of inappropriate or unreliable information

    Allow Dictation    When activated   , it allows dictation input on the device
    On-Device Dictation    When activated   , speech input is processed entirely on the device without contacting Siri servers.

    This enhances privacy and offline capability but may limit language coverage/features compared to server dictation

    Force translation on the device only    When activated   , it processes translations entirely on the device.

    This protects confidential content and works offline but may increase computational load and sometimes result in lower quality or language support

    Allow QuickPath Keyboard    When activated   , it activates the QuickPath keyboard for smooth typing by swiping
    Content & Entertainment
    Content & Entertainment
    Allow Apple Music    When activated   , it allows the use of Apple Music in the Music app
    Allow iTunes Radio    When activated   , it allows the use of iTunes Radio in the Music app
    Allow News App    When activated   , it allows access to the News app
    Set App Age Rating Allow All Apps Sets the highest allowed app age rating
    Show options for setting app age ratings
    hide
    Klicken für dauerhafte Anzeige
    Allow All Apps 17+ 12+ 9+ 4+ Allow Nothing
    Set Movie Age Rating All Movies Sets the highest allowed movie age rating (FSK)
    Show options for setting movie age ratings
    hide
    Klicken für dauerhafte Anzeige
    All Movies FSK 18 FSK 16 FSK 12 FSK 6 FSK 0 No Movies
    Set TV Show Age Rating All TV Shows Sets the highest allowed TV show age rating
    Show options for setting TV show age ratings
    hide
    Klicken für dauerhafte Anzeige
    All TV Shows 18+ 16+ 12+ 6+ 0+ No TV Shows
    Allow Cookies in Safari Only from current website (iOS 8) or visited sites (pre-iOS 8) Options for setting cookie acceptance in Safari
    Show options for accepted cookies in Safari
    hide
    Klicken für dauerhafte Anzeige
    Only from current website (iOS 8) or visited sites (pre-iOS 8) Never Websites I visited Always
    Allow JavaScript    When activated   , it enables the execution of JavaScript in Safari.

    This is essential for modern web apps; deactivation increases security but breaks interactive functions

    Allow Pop-ups    When activated   , it allows pop-up windows in Safari.

    This is sometimes necessary for authentication flows, downloads, or print dialogs of older portals but increases the risk of ads/phishing

    Enable Fraud Warning    When activated   , it activates the Safari fraud warning
    System & Miscellaneous
    System & Miscellaneous
    Allow OTAPKI Updates   
    Allow Temporary Sessions (Shared iPad)    When activated   , it allows temporary sessions on "Shared iPad" devices.

    This supports spontaneous use without permanent accounts (e.g., training/kiosk). Local data is deleted after logout

    Force AirPlay Pairing Password (Outgoing)    When activated   , a pairing password is required for all devices receiving AirPlay requests from this device; prevents unauthorized screen sharing
    Allow Changing Device Name    When activated   , it allows changing the device name
    Allow Voice Dialing When Device is Locked    When activated   , it allows voice dialing when the device is locked
    Force Apple Watch Wrist Detection    When activated   , it enforces wrist detection on paired Apple Watches.

    Automatically locks the watch when removed (e.g., for Apple Pay/unlocking) and prevents access by unauthorized users

    Allow Pairing with Apple Watch    When activated   , it allows pairing with an Apple Watch
    Allow Web Results in Spotlight    When activated   , it allows web search results in Spotlight and Siri suggestions.

    This improves research and quick access but may display uncurated web content and potentially sensitive search terms

    Allow Personalized Advertising    When activated   , it enables personalized advertising features.

    Increases relevance in Apple ads but reduces privacy through profiling and may conflict with compliance requirements

    Allow Camera Usage    When activated   , it allows the user to use the camera.

    Deactivating    locks the camera for all applications

    Allow Changing Notification Settings    When activated   , it allows changing notification settings
    Allow Managed Apps to Write to Unmanaged Contacts    When activated   , it allows managed apps to write contacts to unmanaged accounts.

    This facilitates caller identification in private apps but may lead to data flow from the managed area to personal address books

    Allow Unmanaged Apps to Read Managed Contacts    When activated   , it allows unmanaged apps to access contacts stored in managed accounts.

    This increases convenience in private apps (e.g., caller identification) but may expose managed contacts to unmanaged apps

    Allow iCloud Synchronization for Managed Apps    When activated   , it allows managed apps to synchronize data via iCloud
    Allow Opening from Unmanaged Sources in Managed Apps    When activated   , it allows opening documents from unmanaged apps in managed apps.

    This facilitates collecting external files (e.g., from system apps like Camera, Contacts, etc.) into the protected container but may import potentially harmful or private content

    Allow Opening from Managed Sources in Unmanaged Apps    When activated   , it allows opening documents from managed apps in unmanaged apps.

    This reduces friction in mixed workflows but poses a high compliance risk

    Managed Clipboard    When activated   , it enforces that the clipboard distinguishes between managed and unmanaged sources
    Treat AirDrop as Unmanaged Destination    When activated   , it enforces that AirDrop transfers are treated as 'unmanaged'.

    In combination with Allow opening from managed sources in unmanaged apps    deactivated, sharing via AirDrop from managed apps is prevented



    Restrictions for supervised devices
    Restrictions for supervised devices

    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden



















































































    Restriction Explanation
    App Usage & Installation
    Restrict App Usage Allow all apps Allow all apps, blocklist, or allowlist
    Show options for restricting app usage
    hide
    Klicken für dauerhafte Anzeige
    Allow all apps Do not allow certain apps Allow only certain apps

    Show additional configurations when selecting "Do not allow certain apps"
    Show additional configurations when selecting "Allow only certain apps"

    Blocked apps Select application Select the apps to be blocked
    Multiple apps can be selected
     Add system apps All system apps are added.

    System apps can then be removed individually.

    Erlaubte Apps Select application Select the apps to be allowed
    Multiple apps can be selected
     Add system apps All system apps are added.

    System apps can then be removed individually.

    Single App Mode: Allowed Apps Select application List of apps allowed to run in single app mode
    Allow removing apps    Allows the user to remove apps
    Allow app installation via Configurator/iTunes    When deactivated   , the system disables the App Store, Configurator, marketplace, etc.

    This prevents manual/sideloading installation methods and reduces shadow IT

    Allow automatic app downloads    When deactivated   , the system prevents automatic downloading of apps purchased on other devices.

    This prevents private Apple ID purchases from appearing on corporate devices; useful for BYOD/COBO

    Allow app installation from the App Store    When activated   , it allows the user to install applications from the App Store
    Allow App Clips    When activated   , App Clips are enabled.

    When deactivated   , all App Clips are removed

    Allow AirDrop    When activated   , AirDrop is enabled
    Allow AirPrint    When activated   , AirPrint is enabled
    Allow saving AirPrint credentials    When activated   , it allows saving AirPrint login credentials in the iCloud keychain
    Allow AirPrint iBeacon detection    When activated   , it allows detection of AirPrint printers via iBeacon
    Require trusted TLS for AirPrint    When activated   , it requires trusted TLS certificates for secure AirPrint communication.

    Protects against man-in-the-middle attacks but requires correctly issued certificates on the printers

    Allow change of mobile tariff    When activated   , it allows changing mobile tariff settings
    Allow iCloud keychain synchronization    When activated   , it allows iCloud keychain synchronization
    Allow private iCloud relay    When activated   , iCloud Private Relay is enabled.

    This obscures IP/DNS requests for more privacy but may bypass web filter/proxy policies

    Allow eSIM changes    When activated   , it allows changes to settings related to the mobile tariff
    Allow Files app access to USB drives    When activated   , it allows the Files app to connect to USB drives.

    Facilitates offline data exchange but increases compliance risks

    Allow host pairing    When activated   , it allows pairing with a computer
    notempty
    If pairing is disabled   , the end device can no longer be connected to a computer via USB. Please ensure that the end device always has a functioning internet connection even without pairing
    Allow NFC    When activated   , NFC is enabled
    Allow changing hotspot settings    When activated   , it allows changing personal hotspot settings
    Allow VPN creation    When activated   , it allows creating VPN configurations
    Allow configuration of nearby devices    When activated   , it enables the prompt to configure new nearby devices upon proximity.

    This accelerates rollouts/transfers but may allow unintended account/settings takeovers from unmanaged devices

    Data Sharing
    Allow automatic password filling    When activated   , the "AutoFill Passwords" feature is enabled.

    This speeds up logins and reduces typing errors; due to domain reference and user confirmation, AutoFill usually does not apply to phishing sites

    Enforce authentication before automatic filling    When activated   , it requires authentication before passwords or credit card information are autofilled
    Allow password requests to nearby devices    When activated   , it allows the system to request passwords from nearby devices.

    Applies only to Wi-Fi passwords; may allow sharing of network credentials with foreign devices

    Allow password sharing    When activated   , it allows sharing passwords via AirDrop
    Allow account modification    When activated   , it allows users to add, remove, or modify accounts (e.g., Apple IDs, internet-based accounts) in settings.
    notempty
    This option prevents, for example, the creation of another Apple account, which could then be used to install additional apps.

    notempty
    iOS can only activate this restriction for all accounts. This also means that changing a password for an Exchange account is no longer possible.
    Allow modification of Find My Friends    When activated   , it allows modifications to the settings for "Find My Friends" (within the "Find My" app)
    Media & Entertainment
    Allow Podcasts    When activated   , the Podcasts app is enabled
    Allow explicit content    When activated   , it allows access to explicit content.

    When activated, the SafeSearch function is switched off by Safari.

    Allow iMessage    When activated   , iMessage is enabled.

    For Wi-Fi-only devices, the "Messages" app is hidden; for cellular devices, the app remains but uses only SMS/MMS

    Allow Apple Books Store    When activated   , the Apple Books Store is enabled.

    Supervised only. If disabled, iBookstore will be disabled

    Allow erotica in Apple Books    When activated   , it allows downloading books marked as erotica.

    Supervised only. If disabled, the user will not be able to download media from the iBookstore marked as erotica

    Allow iTunes Store    When activated   , the iTunes Music Store is enabled
    Allow Safari    When activated   , the Safari browser is enabled.

    Web Clips cannot be opened with Safari browser disabled   

    Allow Game Center    When activated   , Game Center is enabled
    Allow adding Game Center friends    When activated   , it allows users to add friends in Game Center
    Allow FaceTime    When activated   , the FaceTime app is allowed.

    Camera usage must also be enabled

    Enable Siri profanity filter    When activated   , the Siri profanity filter is enabled
    Allow AutoFill in Safari    When activated   , AutoFill in Safari is enabled
    Allow changing wallpaper    When activated   , it allows changing the wallpaper
    Allow shared albums    When activated   , it allows shared photo albums.

    This simplifies team-wide sharing. Shared photo albums are limited, stored in reduced resolution, and do not count against iCloud storage

    System and Device Control
    Allow removal of system apps    When activated   , it allows users to remove system apps.

    If set to false, the removal of system apps is disabled

    Allow unpaired devices to start in recovery mode    When activated   , it allows unpaired devices to start the device in recovery mode.

    This can simplify service/repair workflows but reduces protection against unauthorized deletion attempts via USB. If set to false, unpaired external booting for recovery is disabled

    Enforce USB restricted mode    When activated   , it enforces USB restricted mode, requiring authorization for USB accessories when the device is locked.

    If set to false, the restricted USB mode will be disabled

    Enforce automatic date and time    When activated   , it enforces the "Set Automatically" setting for date and time.

    Prevents time manipulation (e.g., to bypass certificate/token checks). If set to true, the date and time are automatically enforced

    Enforce Wi-Fi    When activated   , it prevents disabling the Wi-Fi function.

    Useful for always-on management. If set to true, WLAN is forced only on allowed networks

    Allow joining only Wi-Fi networks from profiles   
    • When activated   , it allows joining only Wi-Fi networks set up via a configuration profile.
    • Hardens against insecure/open networks.
    • However, it reduces flexibility for mobile work and similar scenarios.
    • Only works if at least one Wi-Fi profile is distributed.

    If set to true, WLAN is forced only on allowed networks

    Allow changing device passcode    When activated   , it allows changing the device passcode
    Allow user installation of configuration profiles    When activated   , it allows users to install configuration profiles and certificates via the user interface.

    Deactivating    reduces the risk of unwanted profiles (e.g., unwanted VPN/Root CA) and enforces MDM-controlled changes. If set to false, the user is prohibited from installing configuration profiles and certificates interactively

    Allow reset to factory settings    When activated   , the "Erase All Content and Settings" option in Settings is enabled.

    Deactivating    protects corporate devices from user-initiated wipes. If disabled, the user cannot select the "Clear all content and settings" option in Settings > General > Reset.

    notempty
    A user-initiated "Find My" deletion can still take effect unless separately prevented
    Allow changing Screen Time settings    When activated   , it allows changing Screen Time settings.

    Deactivating    prevents local bypassing of restrictions/age ratings. Allow configuration restrictions

    Allow iCloud document synchronization    When activated   , it allows document synchronization with iCloud.

    Deactivating    disables document and key-value sync via iCloud; affected apps lose iCloud sync functionality. Allow document synchronization with iCloud

    Enforce delayed software updates    When activated   , it delays the visibility of software updates for the user.

    Suitable for staggered rollouts. When active, user visibility of software updates is delayed.

    Delay software updates (in days) 30 Sets the number of days by which the visibility of software updates is delayed.

    Valid values are 1 - 90 days. With this restriction, the administrator can specify by how many days a software or app update is delayed on the device. With this restriction, the user will not see a software update until the specified number of days after the software update release date.

    Enable predictions    When activated   , text predictions on the keyboard are enabled.

    Allow predictive keyboard.

    Enable keyboard shortcuts    When activated   , it allows the use of keyboard shortcuts.

    Allow keyboard shortcuts.

    Enable autocorrect    When activated   , autocorrect during input is enabled.

    Allow autocorrect.

    Enable spell check    When activated   , spell check is enabled to underline misspelled words.

    Allow correction help.

    Enable Look Up    When activated   , quick lookup of word definitions is enabled.

    Allow correction help.

    tvOS Exclusive
    Enable automatic sleep mode    When activated   , it allows the device to automatically switch to sleep mode when inactive.

    If set to false, the hibernation of the device is disabled

    Enable automatic screensaver    When activated   , the automatic screensaver is enabled
    Enable pairing with Remote App    When activated   , it allows pairing Apple TV with the Remote App or the widget in the Control Center

    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden







    Close Closes the tab without applying changes
     Save Applies the changes / new creation, saves and closes the tab


    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden










































    Apps

    Profile created from portal version 1.31 onwards
    notempty
    Profile created from portal version 1.31 onwards
    Managing apps and web clips via profiles is outdated and no longer available. Reassigning applications to devices is now done via the menu item  Mobile Security iOS/iPadOS Apps .
    Further information can be found in the Wiki article on iOS apps
    Apps & Web clips
    Profile created before portal version 1.31
    notempty
    Profile created before portal version 1.31
    notempty
    This function is deprecated. In profiles before version 1.31, apps can be removed but not newly added. Reassigning applications to devices is now handled via the menu item  Mobile Security iOS/iPadOS Apps in the side menu. This also allows for later uninstallation of the application.
    Further information can be found in the Wiki article on iOS apps
    Caption Value Description
    Apps & Web clips
    Apps
    		Securepoint VPN Client The created apps can only be deleted.
    New apps cannot be added,
    Apps are added and removed from an iOS profile via the portal page  Apps
    Web clips Securepoint Wiki [Label: SP Wiki] (https://wiki.securepoint.de) The created Web clips can only be deleted.
    New Web clips cannot be added,
    Web clips are added and removed from an iOS profile via the portal page  Apps


    App-Lock (Kiosk mode)

    The app lock activates the guided mode which limits the device to a single app. In this state - also called kiosk mode - you can control which app functions are available.
    Activate configuration   

    Show restrictions
    Hide restrictions





    1. 2. 3.
    Abb.1 Abb.2 Abb.3
    Abbildungen
    App-Lock (Kiosk mode)
    Caption Value Description
    Bundle ID Enter ID The bundle ID of the application
    notempty
    Entering an unknown bundle ID can cause problems
    Options
    Disable Touch Input    If active   , the touch screen is disabled
    Disable Auto-Rotation    If active   , it prevents the screen orientation from changing when the device is rotated
    Disable Volume Buttons    If active   , the physical volume buttons are disabled
    Disable Ringer (Mute) Switch    If active   , the physical mute switch is disabled
    Disable Sleep/Wake Button    If active   , the physical sleep/wake button is disabled
    Disable Auto-Lock    If active   , it prevents the device from automatically locking after a period of inactivity
    Force Enable VoiceOver    If active   , the VoiceOver feature is forced enabled
    Enable Zoom    If active   , the Zoom feature is forced enabled
    Enable Inverted Colors    If active   , the Invert Colors feature is forced enabled
    Enable AssistiveTouch    If active   , the AssistiveTouch feature is forced enabled
    Force Enable Speak Selection    If active   , the Speak Selection feature is forced enabled
    Force Enable Mono Audio    If active   , mono audio is forced on the device
    Force Enable Voice Control    If active   , the voice control is forced.
    User Enabled Options
    Allow VoiceOver    If active   , user control for the VoiceOver customization is allowed
    Allow Zoom    If active   , user control for the zoom setting is allowed
    Allow Inverted Colors    If active   , user control for inverted colors is enabled
    Allow AssistiveTouch    If active   , user control for AssistiveTouch is permitted
    Allow Voice Control    If active   , user control for voice control is enabled

    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden







    Close Closes the tab without applying changes
     Save Applies the changes / new creation, saves and closes the tab

    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden



















    Home screen layout


    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden




















    Caption Value Description
    Menu item Home Screen Layout: Select template
    Enable home screen layout    After activation, changes can be made to the home screen layout
    Select type Use a predefined layout Uses an already existing home screen layout
    Create an individual home screen layout Creates a profile specific layout
    Select layout
    Only for Use predefined layout    		 Test layout Displays a selection of predefined layouts under  Home screen layouts.

    Only for Create an individual home screen layout:
    Menu item Home Screen Layout: Profile-specific layout
    Type Application Applications from the Apple Appstore'
    System application Provides a list of Apple system applications on the device as a selection
    Web clip Provides a list of apps created as Web clips as a selection
    Folder Adds a folder.
    Apps can then be moved into it via drag'n drop.
    Once the maximum number of apps that can be added to a page is reached, the folder can be configured by clicking the gear icon in the upper left corner and adding another page with +.
    Choose app
    Only for the type Application and System application    		 Choose app
    • For System apps, an app can be selected from the drop-down menu
    • For Applications at least 2 characters must be entered to perform a search in the app store
    Web clip
    Only for the type Web clip    		 Choose a web clip List of Web Clips
    Name
    Only for the type Folder    		 Name Name of the folder on the home screen
    Add Adds the selected element to the last page of the home screen
    The elements can be subsequently moved to other areas
    Add all system applications
    Only for the type System application    		 Adds the selected element to the last page of the home screen
    The elements can be subsequently moved to other areas
    Add all apps
    Only for the type Application    		 Adds all apps from the   Apps menu or apps with  VPP licenses to the last page of the homescreen
    The elements can be subsequently moved to other areas

    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden







    Close Closes the tab without applying changes
     Save Applies the changes / new creation, saves and closes the tab


    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden





















































    {{var | Captive-Login erlauben--desc | Wenn aktiv {{ButtonAn||class=small}, kann das Gerät den Proxyserver umgehen, um die Anmeldeseite für Netzwerke mit einem Captive-Portal anzuzeigen | When active








    Networks

    In this section, access profiles for WiFi networks can be configured and pushed to the device.

    Network configuration
    Caption Value Description
    Network configurations
    Network configurations  Add configuration Network configuration
    Name Name Name of the configuration
    Type WiFi Configuration type (WiFi predefined)
    Wifi
    SSID SSID The SSID of the network
    Security Security level of the network key
    None No security
    WEP-PSK Insecure
    WPA-PSK Secure
    Password Password Password of the account for the server
    Hidden SSID    When activated   , the network's SSID is hidden
    Autoconnect    When activated   , the device automatically connects to the network
    Deactivate MAC randomisation    When activated   , the devices always identify themselves with the same MAC address in a network. Cannot be changed by the user.
    This function also displays a data protection warning in the settings that the network has limited data protection.
    This value is only locked if the profile is installed via an MDM.
    If the value is set with the Apple Configurator, for example, it can be changed by the user.
    EAP-Client / WPA2 Enterprise
    Use EAP Client    When activated   , the EAP client, the WPA2 Enterprise, can be used
    Available options for the EAP type EAP-AKA. Additional options will be available for other EAP types
    EAP Types Select EAP Types The EAP type is selected. Several types can be selected.
    The choices are:
    Payload Certificate Anchor UUID     The certificate that is handed to the server by the client as authentication when logging on to the WLAN.
    Apple: An array of the UUID of a certificate payload to trust for authentication

    The user certificate $user_cert$ can be used
    System Mode Credentials Source     The server for the system mode credentials
    Use Open Directory credentials    When activated    logging in through Open Directory is possible
    Allow two-factor authentication    When activated   , two-factor authentication is possible
    Trusted certificates     The certificates that are to be trusted are entered.
    These certificates must first be stored in the  Mobile Security  Certificate
    The user certificate $user_cert$ can be used
    Trusted server names     The names of the servers that are to be trusted are entered
    Show additional options with EAP-FAST
    Hide EAP-FAST
    Klicken für dauerhafte Anzeige
    Provision PAC    When activated    PAC will be provided
    Provision anonymously
    Displayed when Provision PAC is activated.    		    When activated    PAC will be provided anonymously
    Use existing PAC    When activated    existing PAC will be used
    One time user password    If activated   , the user will be prompted to enter the password each time they connect
    Outer Identity     A name that hides the user's true name
    Max. TLS Version 1.2
    default    		 The maximum TLS version is selected.
    The choice is:
    • 1.0
    • 1.1
    • 1.2
    Min. TLS Version 1.0
    default    		 The minimum TLS version is selected.
    The choice is:
    • 1.0
    • 1.1
    • 1.2
    Username     Username of the account for the server
    Password     Password of the account for the server
    Show additional options with EAP-SIM
    Hide EAP-SIM
    Klicken für dauerhafte Anzeige
    EAP SIM Number Of RANDs 3
    default    		 The number of EAP SIMs of the RANDs is selected
    Show additional options with LEAP
    Hide LEAP
    Klicken für dauerhafte Anzeige
    One time user password    If activated   , the user will be prompted to enter the password each time they connect
    Username     Username of the account for the server
    Password     Password of the account for the server
    Show additional options PEAP
    Hide PEAP
    Klicken für dauerhafte Anzeige
    One time user password    If activated   , the user will be prompted to enter the password each time they connect
    Outer Identity     A name that hides the user's true name
    Max. TLS Version 1.2
    default    		 The maximum TLS version is selected.
    The choice is:
    • 1.0
    • 1.1
    • 1.2
    Min. TLS Version 1.0
    default    		 The minimum TLS version is selected.
    The choice is:
    • 1.0
    • 1.1
    • 1.2
    Username     Username of the account for the server
    Password     Password of the account for the server
    Show additional with TLS
    Hide TLS
    Klicken für dauerhafte Anzeige
    Max. TLS Version 1.2
    default    		 The maximum TLS version is selected.
    The choice is:
    • 1.0
    • 1.1
    • 1.2
    Min. TLS Version 1.0
    default    		 The minimum TLS version is selected.
    The choice is:
    • 1.0
    • 1.1
    • 1.2
    Show additional with TTLS
    Hide TTLS
    Klicken für dauerhafte Anzeige
    One time user password    If activated   , the user will be prompted to enter the password each time they connect
    Outer Identity     A name that hides the user's true name
    Max. TLS Version 1.2
    default    		 The maximum TLS version is selected.
    The choice is:
    • 1.0
    • 1.1
    • 1.2
    Min. TLS Version 1.0
    default    		 The minimum TLS version is selected.
    The choice is:
    • 1.0
    • 1.1
    • 1.2
    TTLS Inner Authentication MSCHAPv2
    default    		 The inner authentication of TTLS is selected.
    The choices are:
    • PAP
    • EAP
    • CHAP
    • MSCHAP
    • MSCHAPv2
    Username     Username of the account for the server
    Password     Password of the account for the server
    Global HTTP proxy
    A Global HTTP proxy can be configured, for example, if devices are permanently on the same network and a local proxy is to be used on the device.
    Especially recommended for devices that only have an MDM license. These can then use, for example, the protection functions of a Securepoint UTM with web filter, etc.
    Global HTTP proxy configuration
    Use global HTTP proxy    When activated    the global HTTP proxy is used
    Type Manual
    Automatic    		 For a manual proxy type, the profile contains the proxy server address, including the port, and optionally a user name and password. For an auto proxy type, you can enter a PAC URL.
    Allow captive login   
    Username Username The username used to authenticate to the proxy server
    Password Password The password used for authentication to the proxy server
    Server Server The network address of the proxy server
    Server port 8080 The port used to connect to the proxy server

    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden







    Close Closes the tab without applying changes
     Save Applies the changes / new creation, saves and closes the tab


    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden














    Certificates

    Certificates are required, for example, to retrieve emails from an Exchange server with https or to confirm the authenticity of self-signed apps.

    Caption Values Description
    Certificates
    Activate certificates    After activation   , certificates can be added
    Certificates
    		Select certificates Selection of certificates, Base-64-encoded X.509 or PKCS#12, imported in the  Mobile Security  Certificate menu.
    Further information can be found in the Wiki article Certificates.
    notempty
    New as of: 2.7
    The user certificate $user_cert$ can be used

    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden







    Close Closes the tab without applying changes
     Save Applies the changes / new creation, saves and closes the tab


    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden



















    Personalization

    notempty
    New as of: 2.21
    Information that can be displayed on the login screen and lock screen.
    Devices used by different people
    Shared device in Apple terminology
    can thus display accessible information for everyone (e.g. an inventory number).

    notempty
    Supervised devices only.

    Show variables overview
    hide
    Klicken für dauerhafte Anzeige


    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden






























    The values are taken from the user settings of the user to whom the respective device is assigned
    Variable name in profiles Description Example
    $username$
    alternative names:
    %device_user%
    %device_user_username%
    		Username jdoe
    $emailaddress$
    alternative name:
    %device_email%
    		Email address jdoe@ttt-point.de
    $firstname$
    alternative name:
    %device_user_firstname%
    		First name John
    $lastname$
    alternative name:
    %device_user_lastname%
    		Last name Doe
    $name$
    alternative name:
    %device_user_name%
    		First name and surname John Doe
    $variable1$
    alternative name:
    %variable1%
    		custom value jdoe/ttt-point.local
    $variable2$
    alternative name:
    %variable2%
    		custom value
    $variable3$
    alternative name:
    %variable3%
    		custom value
    $device_name$
    alternative name:
    %device_name%
    		Only for   iOS: The name assigned on the phone (see: Settings → General → Info → Name)
  • This variable can also be used in iOS profiles in the Shared device section
    		•  Cell phone from Markus Müller
    $device_alias$
    alternative name:
    %device_alias%
    		Only for   iOS: The alias assigned in the portal.
    If the alias is not assigned, the device_name is displayed.
  • This variable can also be used in iOS profiles in the Shared device section
    		•  Tablet Storage1
    Defining the values in the user administration in the portal under:  General  Users or for the device alias in the device tile.
    To avoid input errors, different variable names are possible for compatibility reasons.
    A distinction between Android and iOS is no longer necessary.


    Caption Value Description
    Reiter Personalisierung für iOS-Profile
    Reiter Personalisierung für shared iPad- und AppleTV-Profile
    Reiter Personalisierung für shared iPad- und AppleTV-Profile
    Shared device configuration
    Activate configuration    After setting this, you can set the shared device configuration. Shared device configuration options allow you to specify optional text to be displayed in the login window and lock screen (i.e. a ”If lost, return to” message and Asset Tag information). It is supported on iOS 9.3 and later.
    Lock screen footnote Enter display text Optional. A footnote displayed on the login window and lock screen.
    Asset Tag Information Enter display text Optional. Asset tag information for the device, displayed on the login window and lock screen.
    Example: This device belongs to the company TTT-Point AG. The device is called %device_name% and is managed under %device_alias%.
    Synchronization
    Sync the de­vice alias with the de­vice name
    		   When enabled   , the device alias configured in the portal is automatically transferred to the iOS device as the device name.

    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden







    Close Closes the tab without applying changes
     Save Applies the changes / new creation, saves and closes the tab





























    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden





























    Apple TV

    Conference room display
    Caption Value Description
    Apple TV menu item
    Activate conference room display    When enabled   , the conference room display mode locks the Apple TV in this mode to prevent other types of usage
    Message Type message The custom message displayed on the screen in the conference room display mode
    TV-remote
    Caption Value Description
    Activate TV-remote    Activating    enables the remote configuration of the Apple TV
    Allowed remotes  Add remote Add remotes
    Remote devices ID MAC address Either the MAC address of a device is entered, or a configured device is selected from the drop-down menu
    Allowed TVs  Add TV Add TVs
    Name Name of the TV The name of the TV
    TV ID MAC address Either the MAC address of a device is entered, or a configured device is selected from the drop-down menu
    AirPlay-Security
    Caption Value Description
    Activate AirPlay-Security    When    is enabled, the AirPlay security settings are activated
    Access type
    Any The access policy for AirPlay:
    Allows connections both via Ethernet/WiFi and Apple Wireless Direct Link
    WiFi only Allows connections only from devices on the same Ethernet/WiFi network as Apple TV
    Security level
    Passcode once The AirPlay security policy:
    Requires a screen passcode for the first connection from a device. Subsequent connections from the same device are not prompted
    Always passcode Requires a screen passcode for each AirPlay connection
    Password Requires a passphrase as specified in the password key

    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden







    Close Closes the tab without applying changes
     Save Applies the changes / new creation, saves and closes the tab
    Retrieved from "https://wiki.securepoint.de/index.php?title=MS/deployment/profile-AppleTV&oldid=112177"