Configuration iOS profile: Device

Managing iOS profiles with the Device type in the Mobile Security Portal

Last adaptation to the version: 2.18 (06.2026)

New:

Umbenennung des Reiters von Nachrichten auf Speerbildschirm zu Personalisierung
Gerätenamen aus dem Portal können auf das Gerät gepusht werden

Die Optionen bei Einschränkungen wurden neu gruppiert und haben neue Beschreibungen erhalten
Beschreibungstexte bei Benachrichtigungseinstellungen wurden angepasst
Neugruppierung und angepasste Beschreibung bei App-Lock
Einige angepasste Optionsbeschreibungen bei E-Mail Konten und Exchange Konten
Aktualisiert Beschreibung von Mobilconfig

notempty

This article refers to a Beta version

Preamble

In a profile permissions, restrictions, password requirements, email settings and security settings are configured.
Several users or user groups (roles) can be assigned to a profile.
Several devices or device groups (devices designated by tags) can be assigned to a profile.

notempty

For a large number of devices and users it is recommended to map the assignment via groups.

Device registration is directly tied to a profile
A profile must be created first' (and configured) before a device can be registered

In Android Enterprise profiles, numerous security-relevant settings can be made, e.g.

Disable Kamara
Disable microphone
Disable USB file transfer
Disable outgoing calls
Disable Bluetooth
Disable contact sharing
Disable tethering
Disable sms
Enable network only with VPN
and much more.

notempty

Android Enterprise Profiles are used immediately and do not need to be published!

Note on previous Android profiles

hide

Klicken für dauerhafte Anzeige

Outdated Android profiles behave fundamentally different than Android Enterprise Profiles (EMM)
It is no longer possible to assign a profile to a role, user or tag

Overview of profile management

In the profile overview new profiles can be created, existing ones can be edited and deleted. The view of the profiles can be displayed in the list or tile view. You can also view details of existing profiles, update the list of profiles, and publish profiles.

Overview of profile management iOS

Overview of profile management Android

General Options

Search

Filters on profile tiles that contain the search text

Sort

Clicking this button opens a menu where you can sort the tiles according to specific criteria

Sort

Clicking this button opens a menu where you can sort the tiles according to specific criteria

Name
Sorts the tiles by profile name

Priority
Sorts the tiles according to the priority of the profile

Ascending
Sorts the tiles in ascending or descending order according to the selected criterion

Add profile

Creates a new profile. The settings in the profile vary depending on the operating system.

Import profile

Existing profiles that were previously exported from the Securepoint Mobile Security Portal can be imported here

Hide generated profiles

Hides the generated profiles

Show details

Show / hide details: For a large number of profiles, it can be useful to hide the most important details for clarity.

/ List view / Grid view

Switch between lists and grid view

Refresh

Refreshes the display

Profile tile

Profile-Options

The button at the top right of each profile tile provides the following options:

Edit

Editing the settings (see below)

Copy

Copying the profile to the clipboard

Export

Exporting the settings

Delete

The profile is deleted

notempty

New as of: 2.5

Android profiles that have at least one assigned device cannot be deleted.

Details displayed in the profile tile:

Updated

Changes have been made to the profile that have not yet been published!

Partially installed

Not all sub profiles were able to be installed

Profile information

Type

Profile type (see below)

Roles

Users

User

Devices

Copy & paste of profiles

Click on the logo of the profile tile to mark one or more profiles In the general options, another field now appears under the filter mask:

Action for selected items

Please choose

Execute the selected action with Ok

Copy

Copies one or more selected profiles to the clipboard

Delete

Deletes one or more selected profiles

notempty

New as of: 2.5

Android profiles that have at least one assigned device cannot be deleted.

Paste

Inserts a copy of a profile from the clipboard

This also works from one tenant / customer to another as long as they are assigned to the same reseller account

Configuration iOS profile Device

General

Add profile

Caption	Value	Description	General menu item
Type	Device profile	Standard device profile
	Shared iPad	Profile that allows different users for one iPad Only for devices with iPadOS
	Apple TV profiles	Profile with limited settings options. Additional settings for Apple TV
	User Enrollmant profile	Profile owned by the user on which managed apps of the company can be installed
Name	Name	Profile name
Priority	5	The higher the number, the higher the priority. This is only used if a device is assigned to multiple profiles.
Roles	Add roles	Click-Box: The profile will be assigned to all devices of all users with these roles
Users	Add users	The profile will be assigned to all devices from these users
Geräte-Alias mit Gerätenamen synchronisieren		Bei aktivierter Option wird der Geräte-Alias auf das betreute Gerät übertragen.
Devices	Add devices	The profile will be assigned to these devices
Tags	Add tags	The profile will be assigned to all devices with these tags
Comment	Comment	Comment

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Restrictions

Caption	Value	Description
Device Security & Data Privacy
Allow automatic unlocking		When enabled , it allows automatic unlocking for quick device access (e.g., via Apple Watch) However, it increases the risk in the event of loss or unauthorized access
Allow Control Center on Lock Screen		When enabled , it allows access to the Control Center directly from the lock screen This facilitates quick actions (Wi-Fi, flashlight) but can allow unwanted changes without authentication
Allow notification view on lock screen		When activated , it enables the display of past notifications on the lock screen. This improves the visibility of important information but increases the risk that sensitive content may be viewed by third parties
Allow Today View on Lock Screen		When enabled , it allows the "Today" view to be displayed on the lock screen. This provides an at-a-glance view of widgets and appointments but may expose operational data without unlocking the device
Force encrypted backups		When enabled , it encrypts all device backups. This protects corporate data in local backups (Finder/iTunes) and secures sensitive app data
Restrict Ad Tracking		When enabled , it limits ad and app tracking to enhance privacy Reduces cross-app and cross-website tracking (ATT) and supports compliance
Allow Find My Device		When activated , Find My Device is allowed in the Find My app
Allow Find My Friends		When activated , Find My Friends is allowed in the Find My app
Allow trusting enterprise apps		When activated , it disables the "Trust Enterprise Developer" button (Settings > General > Profiles & Device Management) and prevents users from manually marking apps outside the App Store and MDM as trusted. This prevents shadow IT and ensures that only apps distributed and signed via MDM are used
Allow Screenshots and Screen Recordings		When activated , it allows the user to take screenshots and screen recordings
Wallet Notifications on Lock Screen		When activated , it enables wallet notifications on the lock screen. This displays, for example, boarding passes/receipts without unlocking but may expose sensitive payment information
Allow Mail Privacy Protection		When activated , it enables the "Mail Privacy Protection" option in "Mail". Hides IP addresses and opening times (tracking pixels)
Allow unlocking with Touch & Face ID		When activated , it allows biometric unlocking
Allow changing Touch & Face ID		When activated , it allows changing Touch & Face IDs
Allow sending diagnostic data		When activated , it allows the automatic sending of diagnostic reports to Apple. This supports troubleshooting and stability but may share telemetry data outside the company
Allow changing diagnostic settings		When activated , it allows changes to diagnostic and analysis settings. May bypass compliance requirements; usually deactivated in regulated environments
Network & Connectivity
Allow network access for files		When activated , it allows connection to network drives in the "Files" app
Allow changing Bluetooth settings		When activated , it allows changes to Bluetooth settings
Allow changing mobile data usage for apps		When activated , it allows adjusting mobile data usage settings for apps
Allow accepting untrusted TLS certificates		When activated , it allows the user to accept untrusted TLS certificates. When deactivated, the device rejects unconfirmed HTTPS certificates without prompting
Allow Handoff		When activated , it allows the continuation of activities between devices. This improves cross-platform workflow (iPhone ⇄ iPad ⇄ Mac) but may expose content outside the managed device context
Cloud & Synchronization Cloud & Synchronization
Allow iCloud Photos		When activated , it allows the use of iCloud Photos. This automatically backs up photos/videos and makes them available across devices but may lead to data leakage into private Apple IDs
Allow iCloud Backup		When activated , it allows device backups via iCloud
Allow automatic synchronization during roaming		When activated , it allows data synchronization during roaming. This keeps apps and files up to date for field service/travel but may incur high roaming costs and increased battery/data usage
Allow backup of Enterprise Books		When activated , it allows backing up Enterprise Books
Allow synchronization of notes/highlights in Enterprise Books		When activated , it allows synchronization of notes and highlights in Enterprise Books
App & Purchase Restrictions App & Purchase Restrictions
Allow In-App Purchases		When activated , it allows making purchases within apps notempty Only relevant if purchases with private Apple ID are allowed
Allow Multiplayer Gaming		When activated , it allows playing multiplayer games
Require iTunes password for all purchases		When activated , it requires the iTunes password for every purchase notempty Only relevant if purchases with private Apple ID are allowed
Siri & Dictation Siri & Dictation
Allow Siri		When activated , it allows the use of Siri
Allow Siri on Lock Screen		When activated , it allows the use of Siri on a locked device. Allows voice commands from the lock screen; depending on the request, Siri may still require unlocking for personal data/actions
Allow Siri access to user-generated content		When activated , it allows Siri to query and use user-generated content from the web. Expands responses to include content from forums/social networks but increases the risk of inappropriate or unreliable information
Allow Dictation		When activated , it allows dictation input on the device
On-Device Dictation		When activated , speech input is processed entirely on the device without contacting Siri servers. This enhances privacy and offline capability but may limit language coverage/features compared to server dictation
Force translation on the device only		When activated , it processes translations entirely on the device. This protects confidential content and works offline but may increase computational load and sometimes result in lower quality or language support
Allow QuickPath Keyboard		When activated , it activates the QuickPath keyboard for smooth typing by swiping
Content & Entertainment Content & Entertainment
Allow Apple Music		When activated , it allows the use of Apple Music in the Music app
Allow iTunes Radio		When activated , it allows the use of iTunes Radio in the Music app
Allow News App		When activated , it allows access to the News app
Set App Age Rating	Allow All Apps	Sets the highest allowed app age rating Show options for setting app age ratings hide Klicken für dauerhafte Anzeige Allow All Apps 17+ 12+ 9+ 4+ Allow Nothing
Set Movie Age Rating	All Movies	Sets the highest allowed movie age rating (FSK) Show options for setting movie age ratings hide Klicken für dauerhafte Anzeige All Movies FSK 18 FSK 16 FSK 12 FSK 6 FSK 0 No Movies
Set TV Show Age Rating	All TV Shows	Sets the highest allowed TV show age rating Show options for setting TV show age ratings hide Klicken für dauerhafte Anzeige All TV Shows 18+ 16+ 12+ 6+ 0+ No TV Shows
Safari Browser Settings Safari Browser Settings
Allow Cookies in Safari	Only from current website (iOS 8) or visited sites (pre-iOS 8)	Options for setting cookie acceptance in Safari Show options for accepted cookies in Safari hide Klicken für dauerhafte Anzeige Only from current website (iOS 8) or visited sites (pre-iOS 8) Never Websites I visited Always
Allow JavaScript		When activated , it enables the execution of JavaScript in Safari. This is essential for modern web apps; deactivation increases security but breaks interactive functions
Allow Pop-ups		When activated , it allows pop-up windows in Safari. This is sometimes necessary for authentication flows, downloads, or print dialogs of older portals but increases the risk of ads/phishing
Enable Fraud Warning		When activated , it activates the Safari fraud warning
System & Miscellaneous System & Miscellaneous
Allow OTAPKI Updates
Allow Temporary Sessions (Shared iPad)		When activated , it allows temporary sessions on "Shared iPad" devices. This supports spontaneous use without permanent accounts (e.g., training/kiosk). Local data is deleted after logout
Force AirPlay Pairing Password (Outgoing)		When activated , a pairing password is required for all devices receiving AirPlay requests from this device; prevents unauthorized screen sharing
Allow Changing Device Name		When activated , it allows changing the device name
Allow Voice Dialing When Device is Locked		When activated , it allows voice dialing when the device is locked
Force Apple Watch Wrist Detection		When activated , it enforces wrist detection on paired Apple Watches. Automatically locks the watch when removed (e.g., for Apple Pay/unlocking) and prevents access by unauthorized users
Allow Pairing with Apple Watch		When activated , it allows pairing with an Apple Watch
Allow Web Results in Spotlight		When activated , it allows web search results in Spotlight and Siri suggestions. This improves research and quick access but may display uncurated web content and potentially sensitive search terms
Allow Personalized Advertising		When activated , it enables personalized advertising features. Increases relevance in Apple ads but reduces privacy through profiling and may conflict with compliance requirements
Allow Camera Usage		When activated , it allows the user to use the camera. Deactivating locks the camera for all applications
Allow Changing Notification Settings		When activated , it allows changing notification settings
Data Flow Data Flow
Allow Managed Apps to Write to Unmanaged Contacts		When activated , it allows managed apps to write contacts to unmanaged accounts. This facilitates caller identification in private apps but may lead to data flow from the managed area to personal address books
Allow Unmanaged Apps to Read Managed Contacts		When activated , it allows unmanaged apps to access contacts stored in managed accounts. This increases convenience in private apps (e.g., caller identification) but may expose managed contacts to unmanaged apps
Allow iCloud Synchronization for Managed Apps		When activated , it allows managed apps to synchronize data via iCloud
Allow Opening from Unmanaged Sources in Managed Apps		When activated , it allows opening documents from unmanaged apps in managed apps. This facilitates collecting external files (e.g., from system apps like Camera, Contacts, etc.) into the protected container but may import potentially harmful or private content
Allow Opening from Managed Sources in Unmanaged Apps		When activated , it allows opening documents from managed apps in unmanaged apps. This reduces friction in mixed workflows but poses a high compliance risk
Managed Clipboard		When activated , it enforces that the clipboard distinguishes between managed and unmanaged sources
Treat AirDrop as Unmanaged Destination		When activated , it enforces that AirDrop transfers are treated as 'unmanaged'. In combination with Allow opening from managed sources in unmanaged apps deactivated, sharing via AirDrop from managed apps is prevented

Classroom-App

The Classroom App is available free of charge in the App-Store and offers possibilities for use in school classes.
Important restrictions can be configured here.

Show restrictions

Hide restrictions


1.	2.	3.


Abb.1	Abb.2	Abb.3


Abbildungen

Restrictions	Default	Explanation
Allow remote screen monitoring		When activated , remote screen monitoring via the Classroom app is enabled. If screenshots are disabled, remote screen monitoring is also disabled
Force automatic course enrollment		When activated , it automatically approves requests from instructors
Leaving classes only with permission		When activated , it requires students in unmanaged courses to obtain instructor permission before leaving the course
Enforce app and device locking without prompting		When activated , it allows instructors to lock apps or the device without student confirmation
Force screen monitoring without prompting		When activated , it automatically grants instructors in managed courses permission to monitor students' screens. Only works if remote screen monitoring is allowed

Restrictions for supervised devices

Restriction	Default	Explanation
App Usage & Installation
Restrict App Usage	Allow all apps	Allow all apps, blocklist, or allowlist Show options for restricting app usage hide Klicken für dauerhafte Anzeige Allow all apps Do not allow certain apps Allow only certain apps Show additional configurations when selecting "Do not allow certain apps" Show additional configurations when selecting "Allow only certain apps"
Blocked apps	Select application	Select the apps to be blocked Multiple apps can be selected
Blocked apps	Add system apps	All system apps are added. System apps can then be removed individually.
Erlaubte Apps	Select application	Select the apps to be allowed Multiple apps can be selected
Erlaubte Apps	Add system apps	All system apps are added. System apps can then be removed individually.
Single App Mode: Allowed Apps	Select application	List of apps allowed to run in single app mode
Allow removing apps		Allows the user to remove apps
Allow app installation via Configurator/iTunes		When deactivated , the system disables the App Store, Configurator, marketplace, etc. This prevents manual/sideloading installation methods and reduces shadow IT
Allow automatic app downloads		When deactivated , the system prevents automatic downloading of apps purchased on other devices. This prevents private Apple ID purchases from appearing on corporate devices; useful for BYOD/COBO
Allow app installation from the App Store		When activated , it allows the user to install applications from the App Store
Allow App Clips		When activated , App Clips are enabled. When deactivated , all App Clips are removed
Communication
Allow AirDrop		When activated , AirDrop is enabled
Allow AirPrint		When activated , AirPrint is enabled
Allow saving AirPrint credentials		When activated , it allows saving AirPrint login credentials in the iCloud keychain
Allow AirPrint iBeacon detection		When activated , it allows detection of AirPrint printers via iBeacon
Require trusted TLS for AirPrint		When activated , it requires trusted TLS certificates for secure AirPrint communication. Protects against man-in-the-middle attacks but requires correctly issued certificates on the printers
Allow change of mobile tariff		When activated , it allows changing mobile tariff settings
Allow iCloud keychain synchronization		When activated , it allows iCloud keychain synchronization
Allow private iCloud relay		When activated , iCloud Private Relay is enabled. This obscures IP/DNS requests for more privacy but may bypass web filter/proxy policies
Allow eSIM changes		When activated , it allows changes to settings related to the mobile tariff
Allow Files app access to USB drives		When activated , it allows the Files app to connect to USB drives. Facilitates offline data exchange but increases compliance risks
Allow host pairing		When activated , it allows pairing with a computer notempty If pairing is disabled , the end device can no longer be connected to a computer via USB. Please ensure that the end device always has a functioning internet connection even without pairing
Allow NFC		When activated , NFC is enabled
Allow changing hotspot settings		When activated , it allows changing personal hotspot settings
Allow VPN creation		When activated , it allows creating VPN configurations
Allow configuration of nearby devices		When activated , it enables the prompt to configure new nearby devices upon proximity. This accelerates rollouts/transfers but may allow unintended account/settings takeovers from unmanaged devices
Data Sharing
Allow automatic password filling		When activated , the "AutoFill Passwords" feature is enabled. This speeds up logins and reduces typing errors; due to domain reference and user confirmation, AutoFill usually does not apply to phishing sites
Enforce authentication before automatic filling		When activated , it requires authentication before passwords or credit card information are autofilled
Allow password requests to nearby devices		When activated , it allows the system to request passwords from nearby devices. Applies only to Wi-Fi passwords; may allow sharing of network credentials with foreign devices
Allow password sharing		When activated , it allows sharing passwords via AirDrop
Allow account modification		When activated , it allows users to add, remove, or modify accounts (e.g., Apple IDs, internet-based accounts) in settings. notempty This option prevents, for example, the creation of another Apple account, which could then be used to install additional apps. notempty iOS can only activate this restriction for all accounts. This also means that changing a password for an Exchange account is no longer possible.
Allow modification of Find My Friends		When activated , it allows modifications to the settings for "Find My Friends" (within the "Find My" app)
Media & Entertainment
Allow Podcasts		When activated , the Podcasts app is enabled
Allow explicit content		When activated , it allows access to explicit content. When activated, the SafeSearch function is switched off by Safari.
Allow iMessage		When activated , iMessage is enabled. For Wi-Fi-only devices, the "Messages" app is hidden; for cellular devices, the app remains but uses only SMS/MMS
Allow Apple Books Store		When activated , the Apple Books Store is enabled. Supervised only. If disabled, iBookstore will be disabled
Allow erotica in Apple Books		When activated , it allows downloading books marked as erotica. Supervised only. If disabled, the user will not be able to download media from the iBookstore marked as erotica
Allow iTunes Store		When activated , the iTunes Music Store is enabled
Allow Safari		When activated , the Safari browser is enabled. Web Clips cannot be opened with Safari browser disabled
Allow Game Center		When activated , Game Center is enabled
Allow adding Game Center friends		When activated , it allows users to add friends in Game Center
Allow FaceTime		When activated , the FaceTime app is allowed. Camera usage must also be enabled
Enable Siri profanity filter		When activated , the Siri profanity filter is enabled
Allow AutoFill in Safari		When activated , AutoFill in Safari is enabled
Allow changing wallpaper		When activated , it allows changing the wallpaper
Allow shared albums		When activated , it allows shared photo albums. This simplifies team-wide sharing. Shared photo albums are limited, stored in reduced resolution, and do not count against iCloud storage
System and Device Control
Allow removal of system apps		When activated , it allows users to remove system apps. If set to false, the removal of system apps is disabled
Allow unpaired devices to start in recovery mode		When activated , it allows unpaired devices to start the device in recovery mode. This can simplify service/repair workflows but reduces protection against unauthorized deletion attempts via USB. If set to false, unpaired external booting for recovery is disabled
Enforce USB restricted mode		When activated , it enforces USB restricted mode, requiring authorization for USB accessories when the device is locked. If set to false, the restricted USB mode will be disabled
Enforce automatic date and time		When activated , it enforces the "Set Automatically" setting for date and time. Prevents time manipulation (e.g., to bypass certificate/token checks). If set to true, the date and time are automatically enforced
Enforce Wi-Fi		When activated , it prevents disabling the Wi-Fi function. Useful for always-on management. If set to true, WLAN is forced only on allowed networks
Allow joining only Wi-Fi networks from profiles		When activated , it allows joining only Wi-Fi networks set up via a configuration profile. Hardens against insecure/open networks. However, it reduces flexibility for mobile work and similar scenarios. Only works if at least one Wi-Fi profile is distributed. If set to true, WLAN is forced only on allowed networks
Allow changing device passcode		When activated , it allows changing the device passcode
Allow user installation of configuration profiles		When activated , it allows users to install configuration profiles and certificates via the user interface. Deactivating reduces the risk of unwanted profiles (e.g., unwanted VPN/Root CA) and enforces MDM-controlled changes. If set to false, the user is prohibited from installing configuration profiles and certificates interactively
Allow reset to factory settings		When activated , the "Erase All Content and Settings" option in Settings is enabled. Deactivating protects corporate devices from user-initiated wipes. If disabled, the user cannot select the "Clear all content and settings" option in Settings > General > Reset. notempty A user-initiated "Find My" deletion can still take effect unless separately prevented
Allow changing Screen Time settings		When activated , it allows changing Screen Time settings. Deactivating prevents local bypassing of restrictions/age ratings. Allow configuration restrictions
Allow iCloud document synchronization		When activated , it allows document synchronization with iCloud. Deactivating disables document and key-value sync via iCloud; affected apps lose iCloud sync functionality. Allow document synchronization with iCloud
Enforce delayed software updates		When activated , it delays the visibility of software updates for the user. Suitable for staggered rollouts. When active, user visibility of software updates is delayed.
Delay software updates (in days)	30	Sets the number of days by which the visibility of software updates is delayed. Valid values are 1 - 90 days. With this restriction, the administrator can specify by how many days a software or app update is delayed on the device. With this restriction, the user will not see a software update until the specified number of days after the software update release date.
Keyboard
Enable predictions		When activated , text predictions on the keyboard are enabled. Allow predictive keyboard.
Enable keyboard shortcuts		When activated , it allows the use of keyboard shortcuts. Allow keyboard shortcuts.
Enable autocorrect		When activated , autocorrect during input is enabled. Allow autocorrect.
Enable spell check		When activated , spell check is enabled to underline misspelled words. Allow correction help.
Enable Look Up		When activated , quick lookup of word definitions is enabled. Allow correction help.

Enable automatic sleep mode		When activated , it allows the device to automatically switch to sleep mode when inactive. If set to false, the hibernation of the device is disabled
Enable automatic screensaver		When activated , the automatic screensaver is enabled
Enable pairing with Remote App		When activated , it allows pairing Apple TV with the Remote App or the widget in the Control Center

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Notification settings

Add settings	This button allows you to configure how specific apps are allowed to display notifications (e.g., location of display, sounds, alerts, grouping, preview). Settings are made separately for each app.
Caption	Value	Description	Menu item Notification settings
Application	Enter id	The bundle ID of the application notempty Entering an unknown bundle ID can cause problems
Enable notifications		Enables, respectively disables notifications for this app.
Alert type	Temporary banner	The notification type for notifications for this app: None/Banner/Warning
	Permanent banner
	None
Badges enabled		Allow or disallow for this app.
Enable critical alerts		When active , critical alerts are enabled that can ignore "Do Not Disturb" and ringer settings for this app.
Grouping type	Automatic	The notification grouping type
	by App
	Off
Preview type	Always	The notification type preview
	When unlocked	Displays the notification only when the device is unlocked
	Never	Never displays the notifications
Show in CarPlay		When active, notifications are displayed in CarPlay
Show in lock screen		Determines whether notifications can be displayed in the lock screen
Show in notification center		Determines whether notifications are displayed in the notification center
Sounds enabled		Determines if sounds are allowed for this app

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Firmware Updates

Caption

Value

Description

Update-Einstellungen aktivieren

Nach der Aktivierung können die Update-Einstellungen verwalten

notempty

Diese Funktion ist nur für Geräte mit iOS 18 oder höher verfügbar

Automatische Aktionen

Automatische Downloads

Benutzerdefiniert

Steuert, ob Updates automatisch heruntergeladen werden

Benutzerdefininiert	Benutzer kann automatische Downloads aktivieren/deaktivieren
Immer aktiviert	Automatische Downloads sind immer aktiviert
Immer deaktiviert	Automatische Downloads sind immer deaktiviert

Automatische Installationen

Benutzerdefiniert

Steuert, ob heruntergeladene Updates automatisch installiert werden

Benutzerdefininiert	Benutzer kann automatische Installation aktivieren/deaktivieren
Immer aktiviert	Automatische Installation sind immer aktiviert
Immer deaktiviert	Automatische Installation sind immer deaktiviert

Security-Updates (RSR)

Benutzerdefiniert

Rapid Security Responses (RSR) sind kritische Sicherheitsupdates, die schnell bereitgestellt werden

Benutzerdefininiert	Benutzer kann Security-Updates selbst verwalten
Immer aktiviert	Security-Updates werden immer automatisch installiert
Immer deaktiviert	Security-Updates werden nie automatisch installiert

Beta-Updates

Beta-Updates erlauben

Benutzerdefiniert

Steuert den Zugang zu Beta-Update-Programmen von Apple. Immer aktiviert erfordert, dass AppleSeed for IT für Ihre Organisation aktiviert ist

Benutzerdefininiert	Benutzer kann Beta-Updates aktivieren
Immer aktiviert	Beta-Programm erzwungen. Diese Funktion erfordert, dass AppleSeed for IT für Ihre Organisation aktiviert ist
Immer deaktiviert	Beta-Programm komplett deaktiviert

Beta-Update-Typ
Eingeblendet bei Beta-Updates erlauben Immer aktiviert

Steuert die Art der Beta-Updates, die dem Benutzer zur Verfügung stehen

Angeboten	Die verfügbaren Beta-Updates werden dem Benutzer vorgeschlagen
Benötigt	Das Gerät wird automatisch in das Beta-Programm aufgenommen

Angebotene Beta-Programme
Eingeblendet bei Beta-Update-Typ Angeboten

Auswahl der Beta-Programme, die dem Benutzer zur Verfügung stehen sollen

Erforderliches Beta-Programm
Eingeblendet bei Beta-Update-Typ Benötigt

Auswahl der Beta-Programme, das für den Benutzer erforderlich ist. Das Gerät wird automatisch in dieses Beta-Programm aufgenommen.

Aufschieben (Deferrals)

Aufschieben (Deferrals) aktivieren

Nach der Aktivierung können die Aufschiebe-Einstellungen verwaltet werden

Verzögerung

14

Definiert die Anzahl der Tage, die nach der Veröffentlichung eines neuen Software-Updates durch Apple vergehen müssen, bevor es auf dem Gerät erscheint

Benachrichtigungen

Benachrichtigungen für erzwungene Updates

Ist diese Option aktiviert , erhalten Benutzer umfassende Update-Benachrichtigungen, einschließlich eines Countdowns bis zur Frist und mehreren Erinnerungen vor der Installation
Ist diese Option deaktiviert , werden die Benutzer so wenig wie möglich gestört und nur eine Stunde vor Ablauf der Frist benachrichtigt
Benachrichtigungen über kritische Updates erscheinen immer, unabhängig von der Einstellung

RSR-Einschränkungen

RSR-Updates dem Nutzer anzeigen

Steuert, ob RSR-Updates für den Nutzer sichtbar sind

Rollback erlauben

Benutzer erlauben, installierte RSR-Updates rückgängig zu machen

Update-Empfehlungen

Alle

Steuert, welche Updates dem Benutzer zur Installation empfohlen werden

Alle	Alle verfügbaren Updates werden angezeigt
Älteste	Nur die ältesten ausstehenden Updates werden angezeigt
Neueste	Nur die neuesten Updates werden angezeigt

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Passcode

Configuration by clicking on Activate Passcode

Operation

Default

Description

Settings passcode

Request passcode on the device

Enforces the use of a passcode before using the device

Set maximum number of failed attempts

Number of passcode entry attempts allowed before all data on device will be erased

Maximum number of failed attempts 11

Set auto-lock

The number of minutes for which the device can be idle (without being unlocked by the user) before it gets locked by the system

Automatic lock after 15 minutes

Set maximum passcode age

The number of days for which the passcode can remain unchanged 730

Restrict password complexity

Allows restricting password complexity


Allow simple value		Permits the use of repeating, ascending, and descending character sequences
Require alphabetic value		Passcodes must contain at least one letter
Minimum number of complex characters	0	Smallest number of non-alphanumeric characters allowed
Minimum passcode length	0	Smallest allowed number of characters in passcode

Use passcode history

Allows defining the number of different passcodes required between the reuse of passcodes


Passcode history	1	Number of unique passcodes required between passcode reuse

Use grace period for device lock

Allows defining the maximum time in minutes to unlock the phone


Grace period for device lock	-1	The maximum grace period, in minutes, to unlock the phone without entering a passcode. The default value -1 predetermines iOS to not apply a time limit

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Apps
Profile created from portal version 1.31 onwards notempty Profile created from portal version 1.31 onwards
Managing apps and web clips via profiles is outdated and no longer available. Reassigning applications to devices is now done via the menu item Mobile Security iOS/iPadOS Apps . Further information can be found in the Wiki article on iOS apps			Apps & Web clips
			Apps & Web clips
Profile created before portal version 1.31 notempty Profile created before portal version 1.31
notempty This function is deprecated. In profiles before version 1.31, apps can be removed but not newly added. Reassigning applications to devices is now handled via the menu item Mobile Security iOS/iPadOS Apps in the side menu. This also allows for later uninstallation of the application. Further information can be found in the Wiki article on iOS apps
Caption	Value	Description	Apps & Web clips
Apps	Securepoint VPN Client	The created apps can only be deleted. New apps cannot be added, Apps are added and removed from an iOS profile via the portal page Apps
Web clips	Securepoint Wiki [Label: SP Wiki] (https://wiki.securepoint.de)	The created Web clips can only be deleted. New Web clips cannot be added, Web clips are added and removed from an iOS profile via the portal page Apps

App-Lock (Kiosk mode)

The app lock activates the guided mode which limits the device to a single app. In this state - also called kiosk mode - you can control which app functions are available.
Activate configuration

Show restrictions

Hide restrictions


1.	2.	3.


Abb.1	Abb.2	Abb.3


Abbildungen

Caption	Value	Description
App-Lock (Kiosk mode)
Bundle ID	Enter ID	The bundle ID of the application notempty Entering an unknown bundle ID can cause problems
Options
Disable Touch Input		If active , the touch screen is disabled
Disable Auto-Rotation		If active , it prevents the screen orientation from changing when the device is rotated
Disable Volume Buttons		If active , the physical volume buttons are disabled
Disable Ringer (Mute) Switch		If active , the physical mute switch is disabled
Disable Sleep/Wake Button		If active , the physical sleep/wake button is disabled
Disable Auto-Lock		If active , it prevents the device from automatically locking after a period of inactivity
Force Enable VoiceOver		If active , the VoiceOver feature is forced enabled
Enable Zoom		If active , the Zoom feature is forced enabled
Enable Inverted Colors		If active , the Invert Colors feature is forced enabled
Enable AssistiveTouch		If active , the AssistiveTouch feature is forced enabled
Force Enable Speak Selection		If active , the Speak Selection feature is forced enabled
Force Enable Mono Audio		If active , mono audio is forced on the device
Force Enable Voice Control		If active , the voice control is forced.
User Enabled Options
Allow VoiceOver		If active , user control for the VoiceOver customization is allowed
Allow Zoom		If active , user control for the zoom setting is allowed
Allow Inverted Colors		If active , user control for inverted colors is enabled
Allow AssistiveTouch		If active , user control for AssistiveTouch is permitted
Allow Voice Control		If active , user control for voice control is enabled

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Home screen layout

Caption	Value	Description	Menu item Home Screen Layout: Select template
Enable home screen layout		After activation, changes can be made to the home screen layout
Select type	Use a predefined layout	Uses an already existing home screen layout
Select type	Create an individual home screen layout	Creates a profile specific layout
Select layout Only for Use predefined layout	Test layout	Displays a selection of predefined layouts under Home screen layouts.

Only for Create an individual home screen layout:			Menu item Home Screen Layout: Profile-specific layout
Type	Application	Applications from the Apple Appstore'
	System application	Provides a list of Apple system applications on the device as a selection
	Web clip	Provides a list of apps created as Web clips as a selection
	Folder	Adds a folder. Apps can then be moved into it via drag'n drop. Once the maximum number of apps that can be added to a page is reached, the folder can be configured by clicking the gear icon in the upper left corner and adding another page with +.
Choose app Only for the type Application and System application	Choose app	For System apps, an app can be selected from the drop-down menu For Applications at least 2 characters must be entered to perform a search in the app store
Web clip Only for the type Web clip	Choose a web clip	List of Web Clips
Name Only for the type Folder	Name	Name of the folder on the home screen
Add	Adds the selected element to the last page of the home screen The elements can be subsequently moved to other areas
Add all system applications Only for the type System application	Adds the selected element to the last page of the home screen The elements can be subsequently moved to other areas
Add all apps Only for the type Application	Adds all apps from the Apps menu or apps with VPP licenses to the last page of the homescreen The elements can be subsequently moved to other areas

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Wallpaper

Caption	Value	Wallpaper menu item
Activate wallpaper	Activates the settings for wallpaper configuration notempty Wallpapers are not reverted to the original one after disabling the option.
Select wallpaper	Opens a dialog where an image can be uploaded in .jpg or .png format. Subsequently, the image can be marked and selected.
Use wallpaper also for lock screen	Uses the same image for the lock screen as well
Select lock screen	Opens a dialog where an image can be uploaded in .jpg or .png format. Subsequently, the image can be marked and selected.

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Networks

In this section, access profiles for WiFi networks can be configured and pushed to the device.

Network configuration

Caption

Value

Description

Network configurations

Add configuration

Network configuration

Name

Name of the configuration

Type

WiFi

Configuration type (WiFi predefined)

Wifi

SSID

The SSID of the network

Security

Security level of the network key

None

No security

WEP-PSK

Insecure

WPA-PSK

Secure

Password

Password of the account for the server

Hidden SSID

When activated , the network's SSID is hidden

Autoconnect

When activated , the device automatically connects to the network

Deactivate MAC randomisation

When activated , the devices always identify themselves with the same MAC address in a network. Cannot be changed by the user.

This function also displays a data protection warning in the settings that the network has limited data protection.
This value is only locked if the profile is installed via an MDM.
If the value is set with the Apple Configurator, for example, it can be changed by the user.

EAP-Client / WPA2 Enterprise

Use EAP Client

When activated , the EAP client, the WPA2 Enterprise, can be used

Available options for the EAP type EAP-AKA. Additional options will be available for other EAP types

EAP Types

Select EAP Types

The EAP type is selected. Several types can be selected.
The choices are:

EAP-AKA
EAP-FAST
EAP-SIM
LEAP
PEAP
TLS
TTLS

Payload Certificate Anchor UUID

The certificate that is handed to the server by the client as authentication when logging on to the WLAN.

Apple: An array of the UUID of a certificate payload to trust for authentication

The user certificate $user_cert$ can be used

System Mode Credentials Source

The server for the system mode credentials

Use Open Directory credentials

When activated logging in through Open Directory is possible

Allow two-factor authentication

When activated , two-factor authentication is possible

Trusted certificates

The certificates that are to be trusted are entered.
These certificates must first be stored in the
The user certificate $user_cert$ can be used

Trusted server names

The names of the servers that are to be trusted are entered

Show additional options with EAP-FAST

Hide EAP-FAST

Klicken für dauerhafte Anzeige

Provision PAC		When activated PAC will be provided
Provision anonymously Displayed when Provision PAC is activated.		When activated PAC will be provided anonymously
Use existing PAC		When activated existing PAC will be used
One time user password		If activated , the user will be prompted to enter the password each time they connect
Outer Identity		A name that hides the user's true name
Max. TLS Version	1.2 default	The maximum TLS version is selected. The choice is: 1.0 1.1 1.2
Min. TLS Version	1.0 default	The minimum TLS version is selected. The choice is: 1.0 1.1 1.2
Username		Username of the account for the server
Password		Password of the account for the server

Show additional options with EAP-SIM

Hide EAP-SIM

Klicken für dauerhafte Anzeige

EAP SIM Number Of RANDs	3 default	The number of EAP SIMs of the RANDs is selected

Show additional options with LEAP

Hide LEAP

Klicken für dauerhafte Anzeige

One time user password		If activated , the user will be prompted to enter the password each time they connect
Username		Username of the account for the server
Password		Password of the account for the server

Show additional options PEAP

Hide PEAP

Klicken für dauerhafte Anzeige

One time user password		If activated , the user will be prompted to enter the password each time they connect
Outer Identity		A name that hides the user's true name
Max. TLS Version	1.2 default	The maximum TLS version is selected. The choice is: 1.0 1.1 1.2
Min. TLS Version	1.0 default	The minimum TLS version is selected. The choice is: 1.0 1.1 1.2
Username		Username of the account for the server
Password		Password of the account for the server

Show additional with TLS

Hide TLS

Klicken für dauerhafte Anzeige

Max. TLS Version	1.2 default	The maximum TLS version is selected. The choice is: 1.0 1.1 1.2
Min. TLS Version	1.0 default	The minimum TLS version is selected. The choice is: 1.0 1.1 1.2

Show additional with TTLS

Hide TTLS

Klicken für dauerhafte Anzeige

One time user password		If activated , the user will be prompted to enter the password each time they connect
Outer Identity		A name that hides the user's true name
Max. TLS Version	1.2 default	The maximum TLS version is selected. The choice is: 1.0 1.1 1.2
Min. TLS Version	1.0 default	The minimum TLS version is selected. The choice is: 1.0 1.1 1.2
TTLS Inner Authentication	MSCHAPv2 default	The inner authentication of TTLS is selected. The choices are: PAP EAP CHAP MSCHAP MSCHAPv2
Username		Username of the account for the server
Password		Password of the account for the server

Global HTTP proxy

A Global HTTP proxy can be configured, for example, if devices are permanently on the same network and a local proxy is to be used on the device.
Especially recommended for devices that only have an MDM license. These can then use, for example, the protection functions of a Securepoint UTM with web filter, etc.

Global HTTP proxy configuration

Use global HTTP proxy

When activated the global HTTP proxy is used

Type

Manual
Automatic

For a manual proxy type, the profile contains the proxy server address, including the port, and optionally a user name and password. For an auto proxy type, you can enter a PAC URL.

Allow captive login

Username

The username used to authenticate to the proxy server

Password

The password used for authentication to the proxy server

Server

The network address of the proxy server

Server port

8080

The port used to connect to the proxy server

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Email & Exchange Active Sync

Email accounts

Add account

Multiple mail accounts can be set up in the Email settings section.
These settings affect IMAP or POP3 accounts. Settings for Exchange ActiveSync must be made in the corresponding menu item!

Caption

Value

Description

Email settings

Account description

The display name of the account (e.g. "Company Mail Account")

Account name

Name of the user to be displayed
Variables can be used as well.

Show variables overview

hide

Klicken für dauerhafte Anzeige

The values are taken from the user settings of the user to whom the respective device is assigned

Variable name in profiles	Description	Example
$username$ alternative names: %device_user% %device_user_username%	Username	jdoe
$emailaddress$ alternative name: %device_email%	Email address	jdoe@ttt-point.de
$firstname$ alternative name: %device_user_firstname%	First name	John
$lastname$ alternative name: %device_user_lastname%	Last name	Doe
$name$ alternative name: %device_user_name%	First name and surname	John Doe
$variable1$ alternative name: %variable1%	custom value	jdoe/ttt-point.local
$variable2$ alternative name: %variable2%	custom value
$variable3$ alternative name: %variable3%	custom value
$device_name$ alternative name: %device_name%	Only for iOS: The name assigned on the phone (see: Settings → General → Info → Name) This variable can also be used in iOS profiles in the Shared device section	Cell phone from Markus Müller
$device_alias$ alternative name: %device_alias%	Only for iOS: The alias assigned in the portal. If the alias is not assigned, the device_name is displayed. This variable can also be used in iOS profiles in the Shared device section	Tablet Storage1
Defining the values in the user administration in the portal under: General Users or for the device alias in the device tile. To avoid input errors, different variable names are possible for compatibility reasons. A distinction between Android and iOS is no longer necessary.

The display name can be combined with the variable %device_user_name%. The variable reads from the user settings of the user to whom the respective device is assigned the fields first name and last name. e.g.: %device_user_name% | ttt-Point AG → Martin Müller | ttt-Point AG

Email address

The address of the account (e.g. "john@company.com")
The entry $emailaddress$ reads the email address from the user settings of the user to whom the device is assigned.
Variables can be used as well.

The entries $variable1$, $variable2$ and $variable3$ can be defined individually.

Show variables overview

hide

Klicken für dauerhafte Anzeige

The values are taken from the user settings of the user to whom the respective device is assigned

Variable name in profiles	Description	Example
$username$ alternative names: %device_user% %device_user_username%	Username	jdoe
$emailaddress$ alternative name: %device_email%	Email address	jdoe@ttt-point.de
$firstname$ alternative name: %device_user_firstname%	First name	John
$lastname$ alternative name: %device_user_lastname%	Last name	Doe
$name$ alternative name: %device_user_name%	First name and surname	John Doe
$variable1$ alternative name: %variable1%	custom value	jdoe/ttt-point.local
$variable2$ alternative name: %variable2%	custom value
$variable3$ alternative name: %variable3%	custom value
$device_name$ alternative name: %device_name%	Only for iOS: The name assigned on the phone (see: Settings → General → Info → Name) This variable can also be used in iOS profiles in the Shared device section	Cell phone from Markus Müller
$device_alias$ alternative name: %device_alias%	Only for iOS: The alias assigned in the portal. If the alias is not assigned, the device_name is displayed. This variable can also be used in iOS profiles in the Shared device section	Tablet Storage1
Defining the values in the user administration in the portal under: General Users or for the device alias in the device tile. To avoid input errors, different variable names are possible for compatibility reasons. A distinction between Android and iOS is no longer necessary.

Prevent move

If set to true, messages may not be moved out of this email account into another account. Additionally, replies/forwards via an account other than the original account are blocked. This prevents the mixing of corporate and private mailboxes and supports compliance requirements.

Disable email recipient synchronization

If set to true, this account is excluded from address "recent" syncing

Allow Mail drop

If set to true, it allows the use of "Mail Drop"
Enables large attachments via iCloud link (up to 5 GB, usually available for 30 days)

Prevent App Sheet

If set to true, this account will not be available for sending mail in third party applications

S/MIME Enabled

If set to true, this account will support S/MIME Show further configurations when S/MIME Enabled is active

S/MIME signing enabled		If set to true, this account will enable message signing Show further configurations when S/MIME signing enabled is active
S/MIME signing certificate	None	The UUID of the certificate used to sign messages sent by this user
S/MIME encryption enabled		If activated , this account supports message encryption Show further configurations when S/MIME encryption enabled is active
S/MIME encryption certificate	None	The UUID of the certificate used to decrypt received messages
S/MIME enable Per-Message Switch		If set to true, enables the per-message encryption switch

Incoming mails

Mail server

Hostname or IP address

Port

993

Port number for incoming mail

Account type

IMAP

POP

The protocol for accessing the email account

Username

None

The username used to connect to the server for incoming emails
Variables can be used as well.
$emailaddress$, $username$, $variable1$, $variable2$, $variable3$

Show variables overview

hide

Klicken für dauerhafte Anzeige

The values are taken from the user settings of the user to whom the respective device is assigned

Variable name in profiles	Description	Example
$username$ alternative names: %device_user% %device_user_username%	Username	jdoe
$emailaddress$ alternative name: %device_email%	Email address	jdoe@ttt-point.de
$firstname$ alternative name: %device_user_firstname%	First name	John
$lastname$ alternative name: %device_user_lastname%	Last name	Doe
$name$ alternative name: %device_user_name%	First name and surname	John Doe
$variable1$ alternative name: %variable1%	custom value	jdoe/ttt-point.local
$variable2$ alternative name: %variable2%	custom value
$variable3$ alternative name: %variable3%	custom value
$device_name$ alternative name: %device_name%	Only for iOS: The name assigned on the phone (see: Settings → General → Info → Name) This variable can also be used in iOS profiles in the Shared device section	Cell phone from Markus Müller
$device_alias$ alternative name: %device_alias%	Only for iOS: The alias assigned in the portal. If the alias is not assigned, the device_name is displayed. This variable can also be used in iOS profiles in the Shared device section	Tablet Storage1
Defining the values in the user administration in the portal under: General Users or for the device alias in the device tile. To avoid input errors, different variable names are possible for compatibility reasons. A distinction between Android and iOS is no longer necessary.

Path prefix

Path prefix for IMAP mail server

Incoming Mail Server authentication

Password

The authentication method for the incoming mail server
None
Password
CrammD5
NTLM
HTTPMD5

Password

The password for the incoming mail server

Use SSL

Incoming email retrieval via Secure Socket Layer

Outgoing mails

Mail server

Hostname or IP address for outgoing email

Port

587

The port number for outgoing email

Username

The username used to connect to the server for outgoing mail
Variables can be used as well. $emailaddress$, $username$, $variable1$, $variable2$, $variable3$

Show variables overview

hide

Klicken für dauerhafte Anzeige

The values are taken from the user settings of the user to whom the respective device is assigned

Variable name in profiles	Description	Example
$username$ alternative names: %device_user% %device_user_username%	Username	jdoe
$emailaddress$ alternative name: %device_email%	Email address	jdoe@ttt-point.de
$firstname$ alternative name: %device_user_firstname%	First name	John
$lastname$ alternative name: %device_user_lastname%	Last name	Doe
$name$ alternative name: %device_user_name%	First name and surname	John Doe
$variable1$ alternative name: %variable1%	custom value	jdoe/ttt-point.local
$variable2$ alternative name: %variable2%	custom value
$variable3$ alternative name: %variable3%	custom value
$device_name$ alternative name: %device_name%	Only for iOS: The name assigned on the phone (see: Settings → General → Info → Name) This variable can also be used in iOS profiles in the Shared device section	Cell phone from Markus Müller
$device_alias$ alternative name: %device_alias%	Only for iOS: The alias assigned in the portal. If the alias is not assigned, the device_name is displayed. This variable can also be used in iOS profiles in the Shared device section	Tablet Storage1
Defining the values in the user administration in the portal under: General Users or for the device alias in the device tile. To avoid input errors, different variable names are possible for compatibility reasons. A distinction between Android and iOS is no longer necessary.

authentication type

Password

The authentication method for the outgoing mail server
None
CrammD5
NTLM
HTTPMD5

Outgoing Password: Same as incoming

SMTP authentication uses the same password as POP/IMAP server for incoming emails Show further configurations when Outgoing Password is deactivated

Password

The password for the outgoing mail server

Use SSL

Send outgoing email through Secure Socket Layer

Exchange accounts

Add account

Configuration for Exchange mails retrieved via https connections

Caption

Value

Description

Settings Exchange ActiveSync

Account name

The display name of the user (e.g. "John Appleseed"). Different variables can be used.

Show variables overview

hide

Klicken für dauerhafte Anzeige

The values are taken from the user settings of the user to whom the respective device is assigned

Variable name in profiles	Description	Example
$username$ alternative names: %device_user% %device_user_username%	Username	jdoe
$emailaddress$ alternative name: %device_email%	Email address	jdoe@ttt-point.de
$firstname$ alternative name: %device_user_firstname%	First name	John
$lastname$ alternative name: %device_user_lastname%	Last name	Doe
$name$ alternative name: %device_user_name%	First name and surname	John Doe
$variable1$ alternative name: %variable1%	custom value	jdoe/ttt-point.local
$variable2$ alternative name: %variable2%	custom value
$variable3$ alternative name: %variable3%	custom value
$device_name$ alternative name: %device_name%	Only for iOS: The name assigned on the phone (see: Settings → General → Info → Name) This variable can also be used in iOS profiles in the Shared device section	Cell phone from Markus Müller
$device_alias$ alternative name: %device_alias%	Only for iOS: The alias assigned in the portal. If the alias is not assigned, the device_name is displayed. This variable can also be used in iOS profiles in the Shared device section	Tablet Storage1
Defining the values in the user administration in the portal under: General Users or for the device alias in the device tile. To avoid input errors, different variable names are possible for compatibility reasons. A distinction between Android and iOS is no longer necessary.

Exchange ActiveSync Host

Enter host

Host name or IP address of the Exchange server

Number of days in which emails from the past are synchronized

For ever

Synchronization period

Use SSL

If activated , all communication is sent via Secure Socket Layer

Email address

None

The address of the account to be synchronized (e.g. "john@company.com") Variables can be used as well.

The entries $variable1$, $variable2$ and $variable3$ can be defined individually.

Show variables overview

hide

Klicken für dauerhafte Anzeige

The values are taken from the user settings of the user to whom the respective device is assigned

Variable name in profiles	Description	Example
$username$ alternative names: %device_user% %device_user_username%	Username	jdoe
$emailaddress$ alternative name: %device_email%	Email address	jdoe@ttt-point.de
$firstname$ alternative name: %device_user_firstname%	First name	John
$lastname$ alternative name: %device_user_lastname%	Last name	Doe
$name$ alternative name: %device_user_name%	First name and surname	John Doe
$variable1$ alternative name: %variable1%	custom value	jdoe/ttt-point.local
$variable2$ alternative name: %variable2%	custom value
$variable3$ alternative name: %variable3%	custom value
$device_name$ alternative name: %device_name%	Only for iOS: The name assigned on the phone (see: Settings → General → Info → Name) This variable can also be used in iOS profiles in the Shared device section	Cell phone from Markus Müller
$device_alias$ alternative name: %device_alias%	Only for iOS: The alias assigned in the portal. If the alias is not assigned, the device_name is displayed. This variable can also be used in iOS profiles in the Shared device section	Tablet Storage1
Defining the values in the user administration in the portal under: General Users or for the device alias in the device tile. To avoid input errors, different variable names are possible for compatibility reasons. A distinction between Android and iOS is no longer necessary.

Domain\User

Mail domain and mail user

The field must remain empty if the device should ask.
If the domain should be entered automatically, this can be configured on the server.

Variables can be used as well.
$emailaddress$, $username$, $variable1$, $variable2$, $variable3$

Show variables overview

hide

Klicken für dauerhafte Anzeige

The values are taken from the user settings of the user to whom the respective device is assigned

Variable name in profiles	Description	Example
$username$ alternative names: %device_user% %device_user_username%	Username	jdoe
$emailaddress$ alternative name: %device_email%	Email address	jdoe@ttt-point.de
$firstname$ alternative name: %device_user_firstname%	First name	John
$lastname$ alternative name: %device_user_lastname%	Last name	Doe
$name$ alternative name: %device_user_name%	First name and surname	John Doe
$variable1$ alternative name: %variable1%	custom value	jdoe/ttt-point.local
$variable2$ alternative name: %variable2%	custom value
$variable3$ alternative name: %variable3%	custom value
$device_name$ alternative name: %device_name%	Only for iOS: The name assigned on the phone (see: Settings → General → Info → Name) This variable can also be used in iOS profiles in the Shared device section	Cell phone from Markus Müller
$device_alias$ alternative name: %device_alias%	Only for iOS: The alias assigned in the portal. If the alias is not assigned, the device_name is displayed. This variable can also be used in iOS profiles in the Shared device section	Tablet Storage1
Defining the values in the user administration in the portal under: General Users or for the device alias in the device tile. To avoid input errors, different variable names are possible for compatibility reasons. A distinction between Android and iOS is no longer necessary.

Password

The password for the account

Use OAuth

Specifies whether the connection should use OAuth for authentication.

notempty

If OAuth is specified, the password field should remain blank

Show additional configurations if Use OAuth is activated

OAuth login URL	URL	The OAuth login URL
OAuth token request URL	URL	OAuth token request URL

Payload certificate UUID

None

UUID of the certificate that is used for authentication

notempty

New as of: 2.7

The user certificate usercertuser_certusercert can be used

Prevent move

If set to true, messages may not be moved out of this email account into another account

Prevent App Sheet

If set to true, this account will not be available for sending mail in third party applications

Allow Mail drop

If set to true, this account is allowed to use Mail Drop

S/MIME Enabled

If set to true, this account will support S/MIME Show further configurations when S/MIME Enabled is active

S/MIME encryption enabled		If activated , this account supports message encryption
S/MIME encryption overridable		Allow users to enable or disable S/MIME encryption
S/MIME signing enabled		If set to true, this account will enable message signing
S/MIME signing overridable		Allow users to enable or disable S/MIME signing
S/MIME signing certificate	None	The UUID of the certificate used to sign messages sent by this user The user certificate usercertuser_certusercert can be used
S/MIME signing certificate overridable		Allow users to change the S/MIME signing certificate
S/MIME encryption certificate	None	The UUID of the certificate used to decrypt received messages The user certificate usercertuser_certusercert can be used
S/MIME encryption certificate overridable		Allow users to change the S/MIME encryption certificate
S/MIME enable Per-Message Switch		If set to true, enables the per-message encryption switch

Disable email recipient synchronization

If this value is set to true, this account will be excluded from the synchronization of the "Recent" addresses

Activate calendar

Calendar synchronization can be disabled

If activated , the user can disable calendar synchronization

Enable/disable contacts

If activated , contacts will be enabled

Contact synchronization can be disabled

If activated , the user can disable contact synchronization

Enable email

If activated , email will be enabled

Mail synchronization deactivatable

If activated , the user can disable mail synchronization

Enable notes

If activated , notes will be enabled

Notes synchronization deactivatable

If activated , the user can disable notes synchronization

Enable reminders

If activated , reminders will be enabled

Reminders synchronization deactivatable

If activated , the user can disable reminders synchronization

Overwrite previous password

If activated , the previous password can be overwritten

Audio calls

Enter ID

The bundle ID of the application that processes audio calls made to contacts from this account

Example: Office365 accounts

Example: Integration of an Office 365 account with OAuth

OAuth only works with ActiveSync
Configuration in the Email & Exchange Active Sync tab when adding an Exchange Account

The OAuth data of other providers can be obtained exclusively and directly from these providers

Caption	Value	Description
Account name	Account name	Name of the user to be displayed
Exchange ActiveSync Host	outlook.office365.com	Example for Office365
Number of days in which emails from the past are synchronized	For ever	Possible values: 1 day, 3 days, 1 week, 2 weeks, 1 month, forever
Use SSL		Incoming email retrieval via Secure Socket Layer notempty Securepoint recommends to activate the option
Email address	alice@ttt-point.onmicrosoft.de	Possible addresses are selectable from the dropdown menu incl. variables that take the information from the user data
Domain\User	alice@ttt-point.onmicrosoft.de	The previously selected e-mail address of the user
Password		The password for the email account on the mail server notempty If OAuth is specified, the password field should remain blank
Use OAuth		Specifies whether the connection should use OAuth for authentication. Must be activated on the mail server! If OAuth is specified, the password field should remain blank
OAuth login URL	https://login.microsoftonline.com/common/oauth2/v2.0/authorize	Login URL Here shown for Office365 accounts (example)
OAuth token request URL	https://login.microsoftonline.com/common/oauth2/v2.0/token	OAuth token request URL Here shown for Office365 accounts (example)
Payload certificate UUID:	None	If the authentication on the Exchange server is to be done with a certificate, this can be selected here. Show important notes about this option hide Klicken für dauerhafte Anzeige notempty The certificate must be added under Mobile Security Certificate beforehand. Detailed information on this can be found in the wiki for certificates Additionally, in the Certificates tab, the desired certificate must be added in the click box to be transferred to the device.

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Calendar

Calendar with user account

Calendar with user account Variables can be used as well.

The values are taken from the user settings of the user to whom the respective device is assigned

Variable name in profiles	Description	Example
$username$ alternative names: %device_user% %device_user_username%	Username	jdoe
$emailaddress$ alternative name: %device_email%	Email address	jdoe@ttt-point.de
$firstname$ alternative name: %device_user_firstname%	First name	John
$lastname$ alternative name: %device_user_lastname%	Last name	Doe
$name$ alternative name: %device_user_name%	First name and surname	John Doe
$variable1$ alternative name: %variable1%	custom value	jdoe/ttt-point.local
$variable2$ alternative name: %variable2%	custom value
$variable3$ alternative name: %variable3%	custom value
$device_name$ alternative name: %device_name%	Only for iOS: The name assigned on the phone (see: Settings → General → Info → Name) This variable can also be used in iOS profiles in the Shared device section	Cell phone from Markus Müller
$device_alias$ alternative name: %device_alias%	Only for iOS: The alias assigned in the portal. If the alias is not assigned, the device_name is displayed. This variable can also be used in iOS profiles in the Shared device section	Tablet Storage1
Defining the values in the user administration in the portal under: General Users or for the device alias in the device tile. To avoid input errors, different variable names are possible for compatibility reasons. A distinction between Android and iOS is no longer necessary.

User	Add account
Caption	Value	Description	Calendar with user account
Hostname	Hostname	Server address of the calendar
Username	Username	The username for the login The entries $emailaddress$, $username$, $variable1$, $variable2$ and $variable3$ are also possible.
Password	Password	Optional. The password of the user
Use SSL		Enable Secure Socket Layer communication with the CalDAV server
Port	Port	Optional. The port of the server to which the connection is made.
Main URL	Main URL	The URL to the user's calendar. In iOS/iPadOS, this URL is required when the user does not provide a password, because the service auto-detection fails and the account is not created. Optional.
Account description	Account description	Optional. The description of the account.

Add subscription

Subscribed calendar Variables can be used as well.

The values are taken from the user settings of the user to whom the respective device is assigned

Variable name in profiles	Description	Example
$username$ alternative names: %device_user% %device_user_username%	Username	jdoe
$emailaddress$ alternative name: %device_email%	Email address	jdoe@ttt-point.de
$firstname$ alternative name: %device_user_firstname%	First name	John
$lastname$ alternative name: %device_user_lastname%	Last name	Doe
$name$ alternative name: %device_user_name%	First name and surname	John Doe
$variable1$ alternative name: %variable1%	custom value	jdoe/ttt-point.local
$variable2$ alternative name: %variable2%	custom value
$variable3$ alternative name: %variable3%	custom value
$device_name$ alternative name: %device_name%	Only for iOS: The name assigned on the phone (see: Settings → General → Info → Name) This variable can also be used in iOS profiles in the Shared device section	Cell phone from Markus Müller
$device_alias$ alternative name: %device_alias%	Only for iOS: The alias assigned in the portal. If the alias is not assigned, the device_name is displayed. This variable can also be used in iOS profiles in the Shared device section	Tablet Storage1
Defining the values in the user administration in the portal under: General Users or for the device alias in the device tile. To avoid input errors, different variable names are possible for compatibility reasons. A distinction between Android and iOS is no longer necessary.

Subscriptions	Add subscription
Caption	Value	Description	Subscribed calendar
Hostname	Hostname	Server address of the calendar
Username	Username	The username for the login The entries $emailaddress$, $username$, $variable1$, $variable2$ and $variable3$ are also possible.
Password	Password	Optional. The password of the user
Use SSL		Enable Secure Socket Layer communication with the CalDAV server
Account description	Account description	Optional. The description of the account.

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

CardDav

Variables can be used as well.

The values are taken from the user settings of the user to whom the respective device is assigned

Variable name in profiles	Description	Example
$username$ alternative names: %device_user% %device_user_username%	Username	jdoe
$emailaddress$ alternative name: %device_email%	Email address	jdoe@ttt-point.de
$firstname$ alternative name: %device_user_firstname%	First name	John
$lastname$ alternative name: %device_user_lastname%	Last name	Doe
$name$ alternative name: %device_user_name%	First name and surname	John Doe
$variable1$ alternative name: %variable1%	custom value	jdoe/ttt-point.local
$variable2$ alternative name: %variable2%	custom value
$variable3$ alternative name: %variable3%	custom value
$device_name$ alternative name: %device_name%	Only for iOS: The name assigned on the phone (see: Settings → General → Info → Name) This variable can also be used in iOS profiles in the Shared device section	Cell phone from Markus Müller
$device_alias$ alternative name: %device_alias%	Only for iOS: The alias assigned in the portal. If the alias is not assigned, the device_name is displayed. This variable can also be used in iOS profiles in the Shared device section	Tablet Storage1
Defining the values in the user administration in the portal under: General Users or for the device alias in the device tile. To avoid input errors, different variable names are possible for compatibility reasons. A distinction between Android and iOS is no longer necessary.

User	Add account
Caption	Value	Description	Include address books
Hostname	Hostname	The CardDAV server hostname or IP address
Username	Username	The CardDAV username The entries $emailaddress$, $username$, $variable1$, $variable2$ and $variable3$ are also possible.
Password	Password	The CardDAV password
Use SSL		When enabled , the Secure Socket Layer communicates with the CardDAV server.
Port	Port	The port number to connect to the CardDAV server
Main URL	Main URL	The main URL for the CardDAV account
Account description	Account description	The display name of the account (e.g. "Company CardDAV Account").

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Google account

Caption	Value	Description	Google Accounts menu item
User	Add account	Adds a Google account. This also makes, for example, the history of Google searches or individual Google Maps configurations, such as special points, available on the device.
Account description	Account description	The displayed name of the account (e.g. "Company Server Account").
Account name	Account name	Full user name of the Google account
Email address	Email address	The address of the account (e.g. "mdm.ttt-point@gmailcom") Addresses of created users (from General Users ) can be selected or freely entered.
Audio calls	Enter ID	The bundle ID of the application that processes audio calls made to contacts from this account

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

AirPrint

Caption	Value	Description	AirPrint menu item
Printer	Add printer	Adds a printer configuration that should always be displayed
IP address	IP address	The IP address of the AirPrint destination
Resource path	ipp/print	The resource path associated with the printer. This corresponds to the rp parameter of the _ipps.tcp Bonjour record. For example: printers/Canon_MG5300_series, printers/Xerox_Phaser_7600 or ipp/print
Port	Port	The port through which to connect to the printer
Force TLS		Secures active AirPrint connections through Transport Layer Security (TLS) when it is enabled.

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Certificates

Certificates are required, for example, to retrieve emails from an Exchange server with https or to confirm the authenticity of self-signed apps.

Caption	Values	Description	Certificates
Activate certificates		After activation , certificates can be added
Certificates	Select certificates	Selection of certificates, Base-64-encoded X.509 or PKCS#12, imported in the Mobile Security Certificate menu. Further information can be found in the Wiki article Certificates. notempty New as of: 2.7 The user certificate $user_cert$ can be used

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Security / VPN

Caption

Value

Description

Allow Suspend Always-On-VPN

Allows the user to temporary disable the VPN-Connection
If not activated manually, the VPN will resume at a time chosen by the user

Allow other VPN profiles

Allows adding other VPN profiles in addition to the security profile

Authentication required after app start

notempty

New as of 2.1

Requirement for this feature: App version 3.1

If activated, authentication (PIN or biometric) is required when starting the app
This must be set by the user

Activate security

To be able to use Mobile Security, the Securepoint VPN Client app is first installed automatically
This requires either a VPP license from the Apple Business Manager or an Apple ID on the device
- A corresponding message will be displayed if no VPP license is available: To use the Security / VPN feature, you need a VPP license for the Securepoint VPn Client app from Apple Business Manager
If Cloud Shield is active, security cannot be enabled at the same time
notempty
New as of: 2.3
If Activate security is active , Cloud Shield can be activated at Cloud Shield (Link to wiki article) until not activated
If ‘'Cloud Shield’' is activated at Cloud Shield, ‘'Activate security’' is automatically deactivated and cannot be activated until ‘’'not'‘’' activated
- notempty
  New as of: 2.22
  A message appears stating that Enable security cannot be enabled whilst Cloud Shield is active at Cloud Shield
For profiles that were created before version 2.3 and where Activate security and Cloud Shield are active, these buttons are displayed as inactive
Can be solved if one of the two apps is removed under Applications

Protocol

TCP

Protocol used for VPN tunnel: TCP or UDP

Portfilter Type

Open

Filter network traffic based on network ports:

all ports are open

Closed

Only port 80 (http) and 443 (https) are enabled

Selection

Port filter rule selection: Specify which port collections are open for network traffic:

Show Port Collections

Hide Port-Collections

Klicken für dauerhafte Anzeige

Port-Collection	Port	Protocol	Application
Administrative Tools	21	TCP	ftp
	3389	TCP	ms-rdp
	23	TCP	telnet
	5900	TCP	vnc
	22	TCP	ssh
	5938	TCP/UDP	teamviewer
Communication	3478-3481	UDP	Skype
	49152-65535	UDP
	49152-65535	TCP
	5222	TCP	Google Push-Notifications
	5223	UDP
	5228	TCP
VOIP	5060	UDP	SIP/RTP
VOIP	7070-7089	UDP	SIP/RTP
VPN	1194	TCP	OpenVPN
	1194	UDP	OpenVPN
	500	UDP	IPSec
	4500	UDP & ESP	IPSec
	1701	UDP	L2TP
Mail	25	TCP	smtp
	587	TCP	smtp
	465	TCP	smtps
	110	TCP	pop3
	995	TCP	pop3
	143	TCP	imap
	993	TCP	imap

SSL interception

Default

Defines whether or not to intercept SSL traffic
The default value is to intercept traffic based on content filter response

Content-Filter Allowlist

Add entries

Click box: Web pages that are to be added to a allowlist
Possible entries: Contentfilter

Content-Filter Blocklist

Add entries

Click box: Websites that are to be added to a blocklist

Disable for SSIDs

Add SSIDs

Enter WLAN SSIDs for which the security features shall be disabled

Disable for IP addresses

Add IPs

IP addresses or networks can be entered for which the security functions are to be deactivated, i.e. the individual host 192.0.2.192/32 or the entire subnet 192.0.2.0/24
For address blocks with less than three digits, a dot must be entered or navigated within the mask using the cursor keys

Exclude local WLAN from VPN

If enabled, a route is added that excludes the local WLAN IP range from the tunnel

Security settings

VPN-Configurations

notempty

New as of: 1.32

Shows a list of all Roadwarrior connections that are connected to this profile.
New connections can be created via .
For more information, see the following wiki article.

Roadwarrior:

Alias name of the roadwarrior connection, the transfer network, the core UTM and the IPs used.
Clicking on the alias name redirects to the corresponding VPN configuration.

VPN on Demand:

If is activated, this connection is started immediately if it is selected as the active connection.
If the connection is interrupted, it is automatically restarted.
This setting can be changed on the device by the user afterwards.

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Personalization

notempty

New as of: 2.21

Information that can be displayed on the login screen and lock screen.
Devices used by different people

Shared device in Apple terminology

can thus display accessible information for everyone (e.g. an inventory number).

notempty

Supervised devices only.

Show variables overview

hide

Klicken für dauerhafte Anzeige

The values are taken from the user settings of the user to whom the respective device is assigned

Variable name in profiles	Description	Example
$username$ alternative names: %device_user% %device_user_username%	Username	jdoe
$emailaddress$ alternative name: %device_email%	Email address	jdoe@ttt-point.de
$firstname$ alternative name: %device_user_firstname%	First name	John
$lastname$ alternative name: %device_user_lastname%	Last name	Doe
$name$ alternative name: %device_user_name%	First name and surname	John Doe
$variable1$ alternative name: %variable1%	custom value	jdoe/ttt-point.local
$variable2$ alternative name: %variable2%	custom value
$variable3$ alternative name: %variable3%	custom value
$device_name$ alternative name: %device_name%	Only for iOS: The name assigned on the phone (see: Settings → General → Info → Name) This variable can also be used in iOS profiles in the Shared device section	Cell phone from Markus Müller
$device_alias$ alternative name: %device_alias%	Only for iOS: The alias assigned in the portal. If the alias is not assigned, the device_name is displayed. This variable can also be used in iOS profiles in the Shared device section	Tablet Storage1
Defining the values in the user administration in the portal under: General Users or for the device alias in the device tile. To avoid input errors, different variable names are possible for compatibility reasons. A distinction between Android and iOS is no longer necessary.

Caption	Value	Description	Reiter Personalisierung für iOS-Profile	Reiter Personalisierung für shared iPad- und AppleTV-Profile	Reiter Personalisierung für shared iPad- und AppleTV-Profile
Shared device configuration
Activate configuration		After setting this, you can set the shared device configuration. Shared device configuration options allow you to specify optional text to be displayed in the login window and lock screen (i.e. a ”If lost, return to” message and Asset Tag information). It is supported on iOS 9.3 and later.
Lock screen footnote	Enter display text	Optional. A footnote displayed on the login window and lock screen.
Asset Tag Information	Enter display text	Optional. Asset tag information for the device, displayed on the login window and lock screen. Example: This device belongs to the company TTT-Point AG. The device is called %device_name% and is managed under %device_alias%.
Synchronization
Sync the device alias with the device name		When enabled , the device alias configured in the portal is automatically transferred to the iOS device as the device name.

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Status reporting

Apple devices have various system information that (according to Apple's conception at least) can theoretically change.
With Apple's declarative management, device information can be kept up to date in the portal via status reports.

Here you can configure which of these values are automatically transmitted to the MDM portal when changes are made.
The display in the device dashboard then does not need to be updated manually.

The Changes are logged in the Operations Log menu item in the device details.

notempty

For privacy reasons, the options can be enabled or disabled individually.

For full functionality the iOS iPadOS tvOS version 16.1 is required

Caption	Default	Description	Available as of version	Menu option Status message
Activate configuration		When activated , the details of the status information can be specified.
Model family		A string that describes the hardware family of the device, such as Mac, iPhone, or iPad.	iOS 15.0 iPadOS 15.0
Model identifier		A status report of the device’s hardware identifier.	iOS 15.0 iPadOS 15.0
Model name		A string that identifies the device’s marketing name, such as iPhone 12.	iOS 15.0 iPadOS 15.0
OS build version		A string that identifies the operating system’s build version on the device, such as 18F132.	iOS 15.0 iPadOS 15.0
OS family		A string that identifies the operating system family in use on the device, such as macOS or iOS.	iOS 15.0 iPadOS 15.0
OS version		A string that identifies the operating system’s version in use on the device, such as 15.0.	iOS 15.0 iPadOS 15.0
OS name		A string that identifies the operating system’s marketing name in use on the device, such as Catalina.	iOS 15.0 iPadOS 15.0
OS supplemental build version		Identifies the operating system’s build and rapid security response versions in use on the device (for example, 20A123a, or 20B27c).	iOS 16.1 iPadOS 16.1
OS supplemental extra version		Identifies the operating system’s rapid security response version in use on the device (for example, a).	iOS 16.1 iPadOS 16.1
Passcode compliance		If true, the passcode is in compliance with all passcode policies set on the device. If false, the passcode isn’t in compliance with one or more passcode policies set on the device. When there are no passcode policies on the device, this value true.	iOS 16.0 iPadOS 16.0
Passcode presence		If true, a passcode is present on the device. If false, a passcode isn’t present on the device. When a passcode is present, the specific attributes of the passcode (length, number of complex characters, etc), isn’t reported.	iOS 16.0 iPadOS 16.0
MDM installed apps		Ein Statusbericht über die auf dem Gerät, vom MDM, installierten Anwendungen. Dauerhaft aktiviert, um die deklarative Verwaltung vollständig zu unterstützen (ab iOS 17) Dauerhaft aktiv für alle Declarative Device Management (DDM)-fähigen Apple-Geräte .	iOS 16.0 iPadOS 16.0

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Cloud Shield

Caption

Value

Description

Cloud Shield settings

Activate Cloud Shield

Activate Cloud Shield with this profile. This allows the profile to be linked with a Cloud Shield profile

If Cloud Shield is active , enable Security under Security / VPN (link to the wiki article) cannot be activated at the same time
If enable Security under Security / VPN is activated, Cloud Shield will automatically be deactivated and cannot be reactivated
- notempty
  New as of: 2.22
  A message appears stating that Cloud Shield cannot be enabled whilst Enable Security under Security / VPN is active
For profiles created before version 2.3, where both Enable Security and Cloud Shield are active, these buttons will be displayed as inactive
This can be resolved by removing one of the two apps under Applications
If the iOS/iPad device is integrated into a VPN configuration (ASC), Cloud Shield can still be used if

split DNS is used in the VPN configuration (ASC).

notempty

New as of: 2.12

A corresponding message will be displayed if no VPP license is available: To use the Cloud Shield feature, you need a VPP license for the Securepoint Cloud Shield app from Apple Business Manager

Profile

TTT-Point DNS

Select Cloud Shield profile whose Cloud Shield configuration should be used.

The profile must be created in advance in the Cloud Shield Profile menu item, see the following Wiki article.

Name

Device Custom name

Choose which attribute should be used as the device name to identify the devices in Cloud Shield statistics and logs

Not specified	Do not set a device name. This means the device cannot be identified in the statistics and logs.
Device Custom name	Uses the default device name as device name
Device alias	Uses the device alias as the device name
Device ID	Uses the device ID as the device name
Username	Uses the assigned username as devicename

Install CA for block page

When enabled the CA certificate for the block page is installed on the device, so that no certificate warnings are shown when a page is blocked.

Allow Cloud Shield deactivation

notempty

New as of: 2.13

Allows the user to temporarily disable Cloud Shield in the app
Even if this option is disabled, Cloud Shield can still be manually turned off in the device settings
When the switch is disabled, all SSIDs excluded by the user in the app will be deleted, and only the settings defined in the portal will remain effective

Exclude SSIDs

notempty

New as of: 2.13

Add SSIDs

Enter the Wi-Fi SSIDs where the Cloud Shield service should be disabled

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Mobileconfig

Caption	Value	Description	Mobileconfig menu item
Mobileconfig	Upload	Enables the uploading of .mobileconfig configuration profiles to automatically distribute settings, accounts, restrictions, or certificates Ideal for custom configurations or those created using external tools (e.g., Apple Configurator)
All values are purely for information. They are defined by the .mobileconfig and cannot be changed
Name	Securepoint MDM	Name of the configuration
Type	Configuration	File type
Version	1	Version of the file
Identifier	com.apple.mgmt.Externa…	Can be set manually in the Apple Configurator (composed of the device name and a string)
UUID	cd222e1d-38ca-…	Clear identification
Replace		Opens the dialog for importing a configuration that replaces an existing configuration
Delete		Deletes configuration from the devices

Close	Closes the tab without applying changes
Save	Applies the changes / new creation, saves and closes the tab

Preamble

Overview of profile management

General Options

Profile tile

Profile-Options

Details displayed in the profile tile:

Profile information

Copy & paste of profiles

Configuration iOS profile Device

General

Restrictions

Device Security & Data Privacy

Network & Connectivity

Cloud & Synchronization

App & Purchase Restrictions

Siri & Dictation

Content & Entertainment

Safari Browser Settings

System & Miscellaneous

Data Flow

Classroom-App

Restrictions for supervised devices

App Usage & Installation

Communication

Data Sharing

Media & Entertainment

System and Device Control

Keyboard

Notification settings

Firmware Updates

Au­to­ma­ti­sche Aktionen

Beta-Updates

Aufschieben (Deferrals)

Benachrichtigungen

RSR-Einschränkungen

Update-Empfehlungen

Passcode

Apps

Profile created from portal version 1.31 onwards

Profile created before portal version 1.31

App-Lock (Kiosk mode)

App-Lock (Kiosk mode)

Options

User Enabled Options

Home screen layout

Wallpaper

Networks

Network configuration

Wifi

EAP-Client / WPA2 Enterprise

Global HTTP proxy

Email & Exchange Active Sync

Email accounts

Incoming mails

Outgoing mails

Exchange accounts

Example: Office365 accounts

Calendar

Calendar with user account

Add subscription

CardDav

Google account

AirPrint

Certificates

Security / VPN

VPN-Configurations

Personalization

Shared device configuration

Synchronization

Status reporting

Cloud Shield

Mobileconfig

Automatische Aktionen