Managing iOS profiles with the Shared iPad type in the Mobile Security Portal
Last adaptation to the version: 2.6
New:
notemptyThis article refers to a Beta version
Preamble
In a profile permissions, restrictions, password requirements, email settings and security settings are configured.
Several users or user groups (roles) can be assigned to a profile.
Several devices or device groups (devices designated by tags) can be assigned to a profile.
For a large number of devices and users it is recommended to map the assignment via groups.
- Device registration is directly tied to a profile
- A profile must be created first' (and configured) before a device can be registered
In Android Enterprise profiles, numerous security-relevant settings can be made, e.g.
- Disable Kamara
- Disable microphone
- Disable USB file transfer
- Disable outgoing calls
- Disable Bluetooth
- Disable contact sharing
- Disable tethering
- Disable sms
- Enable network only with VPN
- and much more.
Android Enterprise Profiles are used immediately and do not need to be published!
- Outdated Android profiles behave fundamentally different than Android Enterprise Profiles (EMM)
- It is no longer possible to assign a profile to a role, user or tag
Overview of profile management | ||||
| In the profile overview new profiles can be created, existing ones can be edited and deleted. The view of the profiles can be displayed in the list or tile view. You can also view details of existing profiles, update the list of profiles, and publish profiles. |  |
 | ||
General Options | ||||
| Sorts the tiles by profile name | ||||
| Sorts the tiles according to the priority of the profile | ||||
| Sorts the tiles in ascending or descending order according to the selected criterion | ||||
| Filters on profile tiles that contain the search text | ||||
| Add profile | Creates a new profile. The settings in the profile vary depending on the operating system. | |||
| Import profile | Existing profiles that were previously exported from the Securepoint Mobile Security Portal can be imported here | |||
| Hide generated profiles | Hides the generated profiles | |||
| Show details | Show / hide details: For a large number of profiles, it can be useful to hide the most important details for clarity. | |||
| / List view / Grid view | Switch between lists and grid view | |||
| Refresh | Refreshes the display | |||
Profile tile
| ||||
Profile-Options
| ||||
| The button at the top right of each profile tile provides the following options: | ||||
| Edit | Editing the settings (see below) | |||
| Copy | Copying the profile to the clipboard | |||
| Export | Exporting the settings | |||
| Delete | The profile is deleted notempty
New as of: 2.5 | |||
Details displayed in the profile tile: | ||||
| Updated | Changes have been made to the profile that have not yet been published! | |||
| Partially installed | Not all sub profiles were able to be installed | |||
Profile information | ||||
| Type | Profile type (see below) | |||
| Roles | Roles | |||
| Users | User | |||
| Devices | Devices | |||
| tags | Tags | |||
| Parts | Listing of the sub-profiles that make up the complete Mobile Security Profile. | |||
Copy & paste of profiles
| ||||
| Click on the logo of the profile tile to mark one or more profiles In the general options, another field now appears under the filter mask: | ||||
| Action for selected items | Execute the selected action with Ok | |||
| Copies one or more selected profiles to the clipboard | ||||
| Deletes one or more selected profiles notempty
New as of: 2.5 | ||||
| Paste | Inserts a copy of a profile from the clipboard
| |||
General iOS
General
Add profile
| Caption | Values | Description |  |
|---|---|---|---|
| Type | Device profile | Standard device profile | |
| Shared iPad | Profile that allows different users for one iPad | ||
| Apple TV profiles | Profile with limited settings options. Additional settings for Apple TV | ||
| User Enrollmant profile | Profile owned by the user on which managed apps of the company can be installed | ||
| Name | Name | Profile name | |
| Priority | 5 | The higher the number, the higher the priority. This is only used if a device is assigned to multiple profiles. | |
| Roles | Add roles | Click-Box: The profile will be assigned to all devices of all users with these roles | |
| Users | Add users | The profile will be assigned to all devices from these users | |
| Devices | Add devices | The profile will be assigned to these devices | |
| Tags | Add tags | The profile will be assigned to all devices with these tags | |
| Comment | Comment | Comment | |
| Schließen | Schließt den Reiter ohne Änderungen zu übernehmen |
| Speichern | Übernimmt die Änderungen / Neuanlage, speichert und schließt den Reiter |
Restrictions
Restrictions
Configuration by clicking on Activate restrictions
Numerous restrictions can be configured to control the behavior of a device.
List of possible restrictions with default values and explanations:
General restrictions
| 1. | 2. | 3. |
| Abb.1 | Abb.2 | Abb.3 |
| Abbildungen | ||
| Restriction | Default | Explanation |
|---|---|---|
| Demo-Dev-Einschränkung | Sollte nur im devWiki angezeigt werden | |
| Allow automatic unlocking | When deactivated , the automatic unlocking is disabled | |
| Allow cloud address book | When deactivated , the cloud address book will be disabled | |
| Allow cloud bookmarks | When deactivated , cloud bookmarks will be disabled | |
| Allow cloud calendar | When deactivated , the cloud calendar will be disabled | |
| Allow cloud desktop & documents | When deactivated , cloud desktop and documents will be disabled | |
| Allow cloud mail | When deactivated , cloud mail will be disabled | |
| Allow cloud notes | When deactivated , cloud notes will be disabled | |
| Allow cloud reminders | When deactivated , cloud reminders will be disabled | |
| Allow content caching | When deactivated , content caching will be disabled | |
| Allow iTunes file sharing | When deactivated , iTunes file sharing will be disabled | |
| Allow automatic screen saver | When deactivated , automatic screen savers are not permitted | |
| Allow lock screen ControlCenter | When deactivated , the ControlCenter is disabled for the lock screen | |
| Allow lock screen notifications to display | When deactivated , the notification preview of the lock screen will be disabled | |
| Allow lock screen view today | When deactivated , today's lock screen view will be disabled | |
| Allow to write unmanaged contacts | When deactivated , writing unmanaged contacts will be disabled | |
| Allow unmanaged reading of managed contacts | When deactivated , unmanaged apps cannot access contacts of managed accounts and that managed apps do not save contacts in the local Contacts app | |
| Allow OTAPKI updates | When deactivated , OTAPKI updates are disabled | |
| Allow temporary session of the shared device | When deactivated , the temporary session of the shared device is disabled | |
| Force password for outgoing AirPlay requests | When activated , all devices receiving AirPlay requests from this device will be forced to use a pairing password | |
| Force encrypted backups | When activated , encrypted backups are enforced | |
| Limit ad tracking | When activated , ad tracking will be restricted | |
| Dictation only | When activated , connections to Siri servers for dictation are disabled | |
| Force WLAN Allowlist | Join Wi-Fi networks installed by profiles only | |
| Allow QuickPath keyboard | When deactivated , the QuickPath keyboard is disabled | |
| Allow network access for files | When deactivated , the connection to network drives is prevented in the file app | |
| Allow USB drive for files | When deactivated , it prevents the File app from connecting to connected USB devices | |
| Allow Find My Device | When deactivated , Find My Device is disabled in the Find my App | |
| Allow Find My Friends | When deactivated , Find My Friends is disabled in the Find My app | |
| Force WiFi activation | When activated it prevents Wi-Fi from being turned off in settings or control center, even by entering or leaving airplane mode.
It does not prevent selecting which Wi-Fi network to use. | |
| Allow trusting enterprise apps | When deactivated , Enterprise apps are not trusted | |
| Allow screenshots and screen recording | When deactivated , screenshots and screen recordings cannot be created | |
| Allow Apple Music | When deactivated , Apple Music will be disabled in the Music app | |
| Allow iTunes Radio | Allow iTunes Radio | |
| Allow shared stream | When deactivated , the shared stream is disabled | |
| Allow Wallet while locked | When deactivated , wallet notifications will not be shown on the lock screen | |
| Allow use of News | When deactivated no news can be used | |
| Allow modifying bluetooth settings | When deactivated , changes to the Bluetooth settings are not permitted | |
| Allow modifying cellular data usage for app settings | When deactivated , the mobile data uses for app settings cannot be changed | |
| Allow modifying device name | When deactivated , the device name cannot be changed | |
| Allow automatic sync while roaming | When deactivated , automatic synchronisation is deactivated during roaming | |
| Allow iCloud sync for managed apps | When deactivated , iCloud synchronisation is deactivated for managed apps | |
| Allow enterprise books backup | When deactivated , Enterprise books are not saved | |
| Allow enterprise books and highlights to sync | When deactivated , Enterprise books and highlights are not synchronised | |
| Allow email privacy | When activated , Apple's Mail Privacy Protection (AMPP) is activated | |
| Allow In App purchases | When deactivated no in-app purchases can be made | |
| Allow multiplayer gaming | When deactivated , multiplayer gaming is not allowed | |
| Allow voice dialing while device is locked | When deactivated , no voice dialling is allowed, even if the device is locked | |
| Force Apple Watch wrist detection | When activated , Apple Watch wrist detection is enforced | |
| Allow pairing with Apple Watch | When deactivated , pairing with Apple Watch is not permitted | |
| Allow Internet results in Spotlight | When deactivated , search results from the web will not be shown in Spotlight | |
| Allow user to accept untrusted TLS certificates | When deactivated , the user is not allowed to accept untrusted certificates in TLS | |
| Allow Photo Stream | When deactivated , the use of Photo-Stream is not permitted on the device | |
| Allow iCloud Photo Library | When deactivated , the use of the iCloud Photo Library on the device is not permitted | |
| Allow iCloud backup | When deactivated , the backup with the iCloud is not permitted | |
| Allow personalized advertising | When deactivated , restricts Apple's personalized advertising. Available in iOS 14 and later | |
| Requires iTunes password for all purchases | When activated , the user's iTunes password is required for all purchases | |
| Apps ranking number | 1000 | The value entered describes the maximum permitted level of apps relevant to youth protection on the device. |
| Movies ranking number | 1000 | The value entered describes the maximum permitted level of films relevant to youth protection on the device. |
| TV Shows ranking number | 1000 | The value entered describes the maximum permitted level of TV content relevant to youth protection on the device. |
| Region code | Germany | Two-character code for the region used to specify ratings |
| Accept cookies in Safari | Never | Accept cookies: Does not accept cookies |
| From current website only (iOS 8) or visited sites (pre-iOS 8) | Depending on iOS version: from iOS 8: Only from current website from iOS 8: Only from visited pages | |
| From websites I visited | Accepts cookies from all visited websites | |
| Always | Accepts all cookies | |
| Allow JavaScript | When deactivated , JavaScript is not allowed in Safari | |
| Allow Pop-ups | When deactivated , pop-ups are not allowed in Safari | |
| Enable fraud warning | When activated , the fraud warning in Safari is activated | |
| Force translation on the device only | When activated , the device does not connect to Siri servers for translation purposes | |
| Allow unmanaged documents in managed apps | When activated , it allows managed apps to access unmanaged documents | |
| Allow managed documents in unmanaged apps | When activated , allows unmanaged apps to access managed documents | |
| Managed clipboard required | When activated , the copy and paste feature follows the "Allow open from managed to unmanaged" and "Allow open from unmanaged to managed" constraints. | |
| Treat AirDrop as unmanaged destination | When activated , it prevents protected (managed) data from leaving the device without authorisation via Airdrop | |
| Allows Handoff | When deactivated , handoff is deactivated. Handoff allows you to continue an activity started on an iOS-device on another device. | |
| Allow Touch ID/Face ID for unlocking | When deactivated , Touch ID/Face ID is not allowed to unlock the device | |
| Fingerprint timeout | The time after which unlocking the fingerprint requires a password for authentication. Possible values: 1, 6, 12 hours, 1, 2, 3 days or 1 week | |
| Allow modifying notification settings | When deactivated , changing the notification settings is not allowed | |
| Allow incoming AirPlay requests | When deactivated , incoming AirPlay requests are not allowed | |
| Allow pairing with Remote app | When deactivated , pairing with remote app is not permitted | |
| Allow dictation | When deactivated , dictations are not allowed | |
| Allow camera use | When deactivated , the user is not allowed to use the camera | |
| Allow Siri | When deactivated , Siri is not allowed | |
| Allow Siri while locked | When deactivated , Siri is not allowed while the device is locked | |
| Allow Siri user generated content | When deactivated , it prevents Siri from querying requests with user-generated content | |
| Allow modifying Touch ID/Face ID | When deactivated , the user is not permitted to change the Touch ID/Face ID | |
| Allow diagnostic submission | When deactivated , diagnostic and usage data is not sent to Apple | |
| Allow modifying diagnostics settings | When deactivated , the user is not permitted to change the diagnostic settings | |
| notempty New as of: 2.6 |
When deactivated , the system deactivates the Apple Intelligence reports. Available in iOS 18.4 and higher. |
| 1. | 2. | 3. |
| Abb.1 | Abb.2 | Abb.3 |
| Abbildungen | ||
| Restriction | Default | Explanation |
|---|---|---|
| Demo-Dev-Einschränkung | Sollte nur im devWiki angezeigt werden | |
| Allow automatic unlocking | When deactivated , the automatic unlocking is disabled | |
| Allow cloud address book | When deactivated , the cloud address book will be disabled | |
| Allow cloud bookmarks | When deactivated , cloud bookmarks will be disabled | |
| Allow cloud calendar | When deactivated , the cloud calendar will be disabled | |
| Allow cloud desktop & documents | When deactivated , cloud desktop and documents will be disabled | |
| Allow cloud mail | When deactivated , cloud mail will be disabled | |
| Allow cloud notes | When deactivated , cloud notes will be disabled | |
| Allow cloud reminders | When deactivated , cloud reminders will be disabled | |
| Allow content caching | When deactivated , content caching will be disabled | |
| Allow iTunes file sharing | When deactivated , iTunes file sharing will be disabled | |
| Allow automatic screen saver | When deactivated , automatic screen savers are not permitted | |
| Allow lock screen ControlCenter | When deactivated , the ControlCenter is disabled for the lock screen | |
| Allow lock screen notifications to display | When deactivated , the notification preview of the lock screen will be disabled | |
| Allow lock screen view today | When deactivated , today's lock screen view will be disabled | |
| Allow to write unmanaged contacts | When deactivated , writing unmanaged contacts will be disabled | |
| Allow unmanaged reading of managed contacts | When deactivated , unmanaged apps cannot access contacts of managed accounts and that managed apps do not save contacts in the local Contacts app | |
| Allow OTAPKI updates | When deactivated , OTAPKI updates are disabled | |
| Allow temporary session of the shared device | When deactivated , the temporary session of the shared device is disabled | |
| Force password for outgoing AirPlay requests | When activated , all devices receiving AirPlay requests from this device will be forced to use a pairing password | |
| Force encrypted backups | When activated , encrypted backups are enforced | |
| Limit ad tracking | When activated , ad tracking will be restricted | |
| Dictation only | When activated , connections to Siri servers for dictation are disabled | |
| Force WLAN Allowlist | Join Wi-Fi networks installed by profiles only | |
| Allow QuickPath keyboard | When deactivated , the QuickPath keyboard is disabled | |
| Allow network access for files | When deactivated , the connection to network drives is prevented in the file app | |
| Allow USB drive for files | When deactivated , it prevents the File app from connecting to connected USB devices | |
| Allow Find My Device | When deactivated , Find My Device is disabled in the Find my App | |
| Allow Find My Friends | When deactivated , Find My Friends is disabled in the Find My app | |
| Force WiFi activation | When activated it prevents Wi-Fi from being turned off in settings or control center, even by entering or leaving airplane mode.
It does not prevent selecting which Wi-Fi network to use. | |
| Allow trusting enterprise apps | When deactivated , Enterprise apps are not trusted | |
| Allow screenshots and screen recording | When deactivated , screenshots and screen recordings cannot be created | |
| Allow Apple Music | When deactivated , Apple Music will be disabled in the Music app | |
| Allow iTunes Radio | Allow iTunes Radio | |
| Allow shared stream | When deactivated , the shared stream is disabled | |
| Allow Wallet while locked | When deactivated , wallet notifications will not be shown on the lock screen | |
| Allow use of News | When deactivated no news can be used | |
| Allow modifying bluetooth settings | When deactivated , changes to the Bluetooth settings are not permitted | |
| Allow modifying cellular data usage for app settings | When deactivated , the mobile data uses for app settings cannot be changed | |
| Allow modifying device name | When deactivated , the device name cannot be changed | |
| Allow automatic sync while roaming | When deactivated , automatic synchronisation is deactivated during roaming | |
| Allow iCloud sync for managed apps | When deactivated , iCloud synchronisation is deactivated for managed apps | |
| Allow enterprise books backup | When deactivated , Enterprise books are not saved | |
| Allow enterprise books and highlights to sync | When deactivated , Enterprise books and highlights are not synchronised | |
| Allow email privacy | When activated , Apple's Mail Privacy Protection (AMPP) is activated | |
| Allow In App purchases | When deactivated no in-app purchases can be made | |
| Allow multiplayer gaming | When deactivated , multiplayer gaming is not allowed | |
| Allow voice dialing while device is locked | When deactivated , no voice dialling is allowed, even if the device is locked | |
| Force Apple Watch wrist detection | When activated , Apple Watch wrist detection is enforced | |
| Allow pairing with Apple Watch | When deactivated , pairing with Apple Watch is not permitted | |
| Allow Internet results in Spotlight | When deactivated , search results from the web will not be shown in Spotlight | |
| Allow user to accept untrusted TLS certificates | When deactivated , the user is not allowed to accept untrusted certificates in TLS | |
| Allow Photo Stream | When deactivated , the use of Photo-Stream is not permitted on the device | |
| Allow iCloud Photo Library | When deactivated , the use of the iCloud Photo Library on the device is not permitted | |
| Allow iCloud backup | When deactivated , the backup with the iCloud is not permitted | |
| Allow personalized advertising | When deactivated , restricts Apple's personalized advertising. Available in iOS 14 and later | |
| Requires iTunes password for all purchases | When activated , the user's iTunes password is required for all purchases | |
| Apps ranking number | 1000 | The value entered describes the maximum permitted level of apps relevant to youth protection on the device. |
| Movies ranking number | 1000 | The value entered describes the maximum permitted level of films relevant to youth protection on the device. |
| TV Shows ranking number | 1000 | The value entered describes the maximum permitted level of TV content relevant to youth protection on the device. |
| Region code | Germany | Two-character code for the region used to specify ratings |
| Accept cookies in Safari | Never | Accept cookies: Does not accept cookies |
| From current website only (iOS 8) or visited sites (pre-iOS 8) | Depending on iOS version: from iOS 8: Only from current website from iOS 8: Only from visited pages | |
| From websites I visited | Accepts cookies from all visited websites | |
| Always | Accepts all cookies | |
| Allow JavaScript | When deactivated , JavaScript is not allowed in Safari | |
| Allow Pop-ups | When deactivated , pop-ups are not allowed in Safari | |
| Enable fraud warning | When activated , the fraud warning in Safari is activated | |
| Force translation on the device only | When activated , the device does not connect to Siri servers for translation purposes | |
| Allow unmanaged documents in managed apps | When activated , it allows managed apps to access unmanaged documents | |
| Allow managed documents in unmanaged apps | When activated , allows unmanaged apps to access managed documents | |
| Managed clipboard required | When activated , the copy and paste feature follows the "Allow open from managed to unmanaged" and "Allow open from unmanaged to managed" constraints. | |
| Treat AirDrop as unmanaged destination | When activated , it prevents protected (managed) data from leaving the device without authorisation via Airdrop | |
| Allows Handoff | When deactivated , handoff is deactivated. Handoff allows you to continue an activity started on an iOS-device on another device. | |
| Allow Touch ID/Face ID for unlocking | When deactivated , Touch ID/Face ID is not allowed to unlock the device | |
| Fingerprint timeout | The time after which unlocking the fingerprint requires a password for authentication. Possible values: 1, 6, 12 hours, 1, 2, 3 days or 1 week | |
| Allow modifying notification settings | When deactivated , changing the notification settings is not allowed | |
| Allow incoming AirPlay requests | When deactivated , incoming AirPlay requests are not allowed | |
| Allow pairing with Remote app | When deactivated , pairing with remote app is not permitted | |
| Allow dictation | When deactivated , dictations are not allowed | |
| Allow camera use | When deactivated , the user is not allowed to use the camera | |
| Allow Siri | When deactivated , Siri is not allowed | |
| Allow Siri while locked | When deactivated , Siri is not allowed while the device is locked | |
| Allow Siri user generated content | When deactivated , it prevents Siri from querying requests with user-generated content | |
| Allow modifying Touch ID/Face ID | When deactivated , the user is not permitted to change the Touch ID/Face ID | |
| Allow diagnostic submission | When deactivated , diagnostic and usage data is not sent to Apple | |
| Allow modifying diagnostics settings | When deactivated , the user is not permitted to change the diagnostic settings | |
| notempty New as of: 2.6 |
When deactivated , the system deactivates the Apple Intelligence reports. Available in iOS 18.4 and higher. |
| 1. | 2. | 3. |
| Abb.1 | Abb.2 | Abb.3 |
| Abbildungen | ||
| Restriction | Default | Explanation |
|---|---|---|
| Demo-Dev-Einschränkung | Sollte nur im devWiki angezeigt werden | |
| Allow automatic unlocking | When deactivated , the automatic unlocking is disabled | |
| Allow cloud address book | When deactivated , the cloud address book will be disabled | |
| Allow cloud bookmarks | When deactivated , cloud bookmarks will be disabled | |
| Allow cloud calendar | When deactivated , the cloud calendar will be disabled | |
| Allow cloud desktop & documents | When deactivated , cloud desktop and documents will be disabled | |
| Allow cloud mail | When deactivated , cloud mail will be disabled | |
| Allow cloud notes | When deactivated , cloud notes will be disabled | |
| Allow cloud reminders | When deactivated , cloud reminders will be disabled | |
| Allow content caching | When deactivated , content caching will be disabled | |
| Allow iTunes file sharing | When deactivated , iTunes file sharing will be disabled | |
| Allow automatic screen saver | When deactivated , automatic screen savers are not permitted | |
| Allow lock screen ControlCenter | When deactivated , the ControlCenter is disabled for the lock screen | |
| Allow lock screen notifications to display | When deactivated , the notification preview of the lock screen will be disabled | |
| Allow lock screen view today | When deactivated , today's lock screen view will be disabled | |
| Allow to write unmanaged contacts | When deactivated , writing unmanaged contacts will be disabled | |
| Allow unmanaged reading of managed contacts | When deactivated , unmanaged apps cannot access contacts of managed accounts and that managed apps do not save contacts in the local Contacts app | |
| Allow OTAPKI updates | When deactivated , OTAPKI updates are disabled | |
| Allow temporary session of the shared device | When deactivated , the temporary session of the shared device is disabled | |
| Force password for outgoing AirPlay requests | When activated , all devices receiving AirPlay requests from this device will be forced to use a pairing password | |
| Force encrypted backups | When activated , encrypted backups are enforced | |
| Limit ad tracking | When activated , ad tracking will be restricted | |
| Dictation only | When activated , connections to Siri servers for dictation are disabled | |
| Force WLAN Allowlist | Join Wi-Fi networks installed by profiles only | |
| Allow QuickPath keyboard | When deactivated , the QuickPath keyboard is disabled | |
| Allow network access for files | When deactivated , the connection to network drives is prevented in the file app | |
| Allow USB drive for files | When deactivated , it prevents the File app from connecting to connected USB devices | |
| Allow Find My Device | When deactivated , Find My Device is disabled in the Find my App | |
| Allow Find My Friends | When deactivated , Find My Friends is disabled in the Find My app | |
| Force WiFi activation | When activated it prevents Wi-Fi from being turned off in settings or control center, even by entering or leaving airplane mode.
It does not prevent selecting which Wi-Fi network to use. | |
| Allow trusting enterprise apps | When deactivated , Enterprise apps are not trusted | |
| Allow screenshots and screen recording | When deactivated , screenshots and screen recordings cannot be created | |
| Allow Apple Music | When deactivated , Apple Music will be disabled in the Music app | |
| Allow iTunes Radio | Allow iTunes Radio | |
| Allow shared stream | When deactivated , the shared stream is disabled | |
| Allow Wallet while locked | When deactivated , wallet notifications will not be shown on the lock screen | |
| Allow use of News | When deactivated no news can be used | |
| Allow modifying bluetooth settings | When deactivated , changes to the Bluetooth settings are not permitted | |
| Allow modifying cellular data usage for app settings | When deactivated , the mobile data uses for app settings cannot be changed | |
| Allow modifying device name | When deactivated , the device name cannot be changed | |
| Allow automatic sync while roaming | When deactivated , automatic synchronisation is deactivated during roaming | |
| Allow iCloud sync for managed apps | When deactivated , iCloud synchronisation is deactivated for managed apps | |
| Allow enterprise books backup | When deactivated , Enterprise books are not saved | |
| Allow enterprise books and highlights to sync | When deactivated , Enterprise books and highlights are not synchronised | |
| Allow email privacy | When activated , Apple's Mail Privacy Protection (AMPP) is activated | |
| Allow In App purchases | When deactivated no in-app purchases can be made | |
| Allow multiplayer gaming | When deactivated , multiplayer gaming is not allowed | |
| Allow voice dialing while device is locked | When deactivated , no voice dialling is allowed, even if the device is locked | |
| Force Apple Watch wrist detection | When activated , Apple Watch wrist detection is enforced | |
| Allow pairing with Apple Watch | When deactivated , pairing with Apple Watch is not permitted | |
| Allow Internet results in Spotlight | When deactivated , search results from the web will not be shown in Spotlight | |
| Allow user to accept untrusted TLS certificates | When deactivated , the user is not allowed to accept untrusted certificates in TLS | |
| Allow Photo Stream | When deactivated , the use of Photo-Stream is not permitted on the device | |
| Allow iCloud Photo Library | When deactivated , the use of the iCloud Photo Library on the device is not permitted | |
| Allow iCloud backup | When deactivated , the backup with the iCloud is not permitted | |
| Allow personalized advertising | When deactivated , restricts Apple's personalized advertising. Available in iOS 14 and later | |
| Requires iTunes password for all purchases | When activated , the user's iTunes password is required for all purchases | |
| Apps ranking number | 1000 | The value entered describes the maximum permitted level of apps relevant to youth protection on the device. |
| Movies ranking number | 1000 | The value entered describes the maximum permitted level of films relevant to youth protection on the device. |
| TV Shows ranking number | 1000 | The value entered describes the maximum permitted level of TV content relevant to youth protection on the device. |
| Region code | Germany | Two-character code for the region used to specify ratings |
| Accept cookies in Safari | Never | Accept cookies: Does not accept cookies |
| From current website only (iOS 8) or visited sites (pre-iOS 8) | Depending on iOS version: from iOS 8: Only from current website from iOS 8: Only from visited pages | |
| From websites I visited | Accepts cookies from all visited websites | |
| Always | Accepts all cookies | |
| Allow JavaScript | When deactivated , JavaScript is not allowed in Safari | |
| Allow Pop-ups | When deactivated , pop-ups are not allowed in Safari | |
| Enable fraud warning | When activated , the fraud warning in Safari is activated | |
| Force translation on the device only | When activated , the device does not connect to Siri servers for translation purposes | |
| Allow unmanaged documents in managed apps | When activated , it allows managed apps to access unmanaged documents | |
| Allow managed documents in unmanaged apps | When activated , allows unmanaged apps to access managed documents | |
| Managed clipboard required | When activated , the copy and paste feature follows the "Allow open from managed to unmanaged" and "Allow open from unmanaged to managed" constraints. | |
| Treat AirDrop as unmanaged destination | When activated , it prevents protected (managed) data from leaving the device without authorisation via Airdrop | |
| Allows Handoff | When deactivated , handoff is deactivated. Handoff allows you to continue an activity started on an iOS-device on another device. | |
| Allow Touch ID/Face ID for unlocking | When deactivated , Touch ID/Face ID is not allowed to unlock the device | |
| Fingerprint timeout | The time after which unlocking the fingerprint requires a password for authentication. Possible values: 1, 6, 12 hours, 1, 2, 3 days or 1 week | |
| Allow modifying notification settings | When deactivated , changing the notification settings is not allowed | |
| Allow incoming AirPlay requests | When deactivated , incoming AirPlay requests are not allowed | |
| Allow pairing with Remote app | When deactivated , pairing with remote app is not permitted | |
| Allow dictation | When deactivated , dictations are not allowed | |
| Allow camera use | When deactivated , the user is not allowed to use the camera | |
| Allow Siri | When deactivated , Siri is not allowed | |
| Allow Siri while locked | When deactivated , Siri is not allowed while the device is locked | |
| Allow Siri user generated content | When deactivated , it prevents Siri from querying requests with user-generated content | |
| Allow modifying Touch ID/Face ID | When deactivated , the user is not permitted to change the Touch ID/Face ID | |
| Allow diagnostic submission | When deactivated , diagnostic and usage data is not sent to Apple | |
| Allow modifying diagnostics settings | When deactivated , the user is not permitted to change the diagnostic settings | |
| notempty New as of: 2.6 |
When deactivated , the system deactivates the Apple Intelligence reports. Available in iOS 18.4 and higher. |
Classroom-App
The Classroom App is available free of charge in the App-Store and offers possibilities for use in school classes.
Important restrictions can be configured here.
| 1. | 2. | 3. |
| Abb.1 | Abb.2 | Abb.3 |
| Abbildungen | ||
| Restrictions | Default | Explanation |
|---|---|---|
| Allow remote screen monitoring | If not allowed, remote screen monitoring is disabled by the Classroom app. When screenshots are disabled, the Classroom app does not observe remote screens. | |
| Force courses to be joined automatically | If enforced, the instructor's requests are automatically accepted without prompting the student. | |
| Force permission to leave classes | If enforced, a student enrolled in an unmanaged course through Classroom must ask the instructor for permission to leave the course. | |
| Force app and device lock | If enforced, the teacher can lock apps or the device without prompting the student. | |
| Force screen monitoring | When enforced and remote screen monitoring is allowed, a student enrolled in a managed course through the classroom app automatically grants permission to watch the screen without being prompted. |
Restrictions for supervised devices
A range of restrictions is only available for devices in the Supervised embedding mode.
| 1. | 2. | 3. |
| Abb.1 | Abb.2 | Abb.3 |
| Abbildungen | ||
| Restrictions | Default | Explanation |
|---|---|---|
| Restrict app use | Allow all apps Do not allow certain apps Allow only certain apps |
Configures whether no restriction, a blocklist or a allowlist is used for apps. supervised devices only |
|
Click box for app selection | Depending on the selection in the line above: Blocklisted Apps / Allowlisted Apps Searches the entire App Store for possible apps. supervised devices only |
| Add system apps | If the selection is limited to Allowed apps, all system apps can be added to the click box. The system apps can then be removed individually. supervised devices only | |
| Allow AirDrop | If set to false, AirDrop will be disabled supervised devices only | |
| Allow AirPrint | If set to false, AirPrint will be disabled supervised devices only | |
| Allow saving AirPrint credentials | If set to false, the storage of AirPrint credentials is disabled supervised devices only | |
| Allow AirPrint iBeacon detection | If set to false, AirPrint iBeacon detection will be disabled supervised devices only | |
| Allow change of mobile tariff | If set to false, the change of the mobile tariff will be disabled supervised devices only
non | |
| Allow cloud keychain synchronization | If set to false, cloud keychain synchronization is disabled supervised devices only | |
| Allow private cloud relay | If set to disabled, iCloud Private Relay will be disabled Devicesupervised devices only | |
| Allow eSIM changes | If set to false, the eSIM change will be disabled | |
| Allow access to files on USB drive | If set to false, access to the files USB drive is disabled supervised devices only | |
| Allow change to find my friends | If set to false, the modification will be disabled for find my friends supervised devices only | |
| Allow host pairing |
||
| Allow NFC | If set to false, NFC will be disabled supervised devices only | |
| Allow auto-complete password | If set to false, the auto-completion of the password will be disabled supervised devices only | |
| Allow device to enter sleep mode | If set to false, the hibernation of the device is disabled supervised devices only | |
| Allow requests for password proximity | If set to false, password proximity requests are disabled supervised devices only | |
| Allow password sharing | If set to false, password sharing will be disabled supervised devices only | |
| Allow change of personal hotspot | If set to false, the change of the personal hotspot will be disabled supervised devices only | |
| Allow Podcasts | If set to false, podcasts will be disabled supervised devices only | |
| Allow proximity settings for new device | If set to false, the proximity set-up for the new device will be disabled supervised devices only | |
| Allow removal of system apps | If set to false, the removal of system apps is disabled supervised devices only | |
| Allow non-paired external boot for recovery | If set to false, unpaired external booting for recovery is disabled supervised devices only | |
| Allow restricted USB mode | If set to false, the restricted USB mode will be disabled supervised devices only | |
| Allow VPN creation | If set to false, VPN creation will be disabled supervised devices only | |
| Allowed apps in single app mode | Choose application | Allowed apps in single app mode supervised devices only |
| Force AirPrint Trusted TLS Requirement | If set to true, AirPrint enforces the trusted TLS request supervised devices only | |
| Enforce authentication before autofill | If set to true, authentication is enforced before autofilling supervised devices only | |
| Force automatic date and time | If set to true, the date and time are automatically enforced supervised devices only | |
| Force WLAN to approved networks only | If set to true, WLAN is forced only on allowed networks supervised devices only | |
| Allow account modification | If inactive, account modification will be disabled. notempty This option prevents, for example, the creation of another Apple account, which could then be used to install additional apps. notempty iOS can only activate this restriction for all accounts. This also means that changing a password for an Exchange account is no longer possible. | |
| Allow app removal | Allows the user to remove apps supervised devices only | |
| Allow explicit content | Allows the user to access explicit content. When activated, the SafeSearch function is switched off by Safari. supervised devices only | |
| Allow use of iMessage | Allow use of iMessage supervised devices only | |
| Allow iBookstore | Supervised only. If disabled, iBookstore will be disabled supervised devices only | |
| Allow erotica in the iBookstore | Supervised only. If disabled, the user will not be able to download media from the iBookstore marked as erotica supervised devices only | |
| Allow use of iTunes | Allow the user to access and use iTunes supervised devices only | |
| Allow use of Safari | Allows the user to use Safari supervised devices only | |
| Allow Game Center | Allow Game Center | |
| Allow adding Game Center friends | Allow the user to add friends to the Game Center supervised devices only | |
| Allow modifying wallpaper | Allow changing the background image supervised devices only</smMS/deployment/profile.langall> | |
| Permit configuration of the screen time | Allow configuration restrictions supervised devices only | |
| Allow iCloud document sync | Allow document synchronization with iCloud supervised devices only | |
| Allow auto-fill in Safari | Automatisches Ausfüllen in Safari zulassen supervised devices only | |
| Allow predictive keyboard. | Allow predictive keyboard. supervised devices only | |
| Allow keyboard shortcuts. | Allow keyboard shortcuts. supervised devices only | |
| Allow autocorrect. | Allow autocorrect. supervised devices only | |
| Allow correction help. | Allow correction help. supervised devices only | |
| Allow definition. | Allow definition. supervised devices only | |
| Allow video conferencing | Allow video conferencing supervised devices only | |
| Enable Siri profanity filter | Enables Siri profanity filter. supervised devices only | |
| Allow app installation from Apple Configurator and iTunes | Allow only a connected Mac host to install applications supervised devices only | |
| Allow automatic app downloads | Allows automatic app downloads supervised devices only | |
| Allow app installation from the app store | Allow the user to install applications supervised devices only | |
| Allow modifying passcode | Allow changing the passcode supervised devices only | |
| Allow UI configuration profile installation | If set to false, the user is prohibited from installing configuration profiles and certificates interactively supervised devices only | |
| Allow erase all content and settings | If disabled, the user cannot select the "Clear all content and settings" option in Settings > General > Reset supervised devices only | |
| Allow app clips | When this option is disabled, a user cannot add app clips and remove existing app clips on the device. Available in iOS 14.0 and later. supervised devices only | |
| Force delayed app updates | If set to true, delayed app updates are forced supervised devices only | |
| Force delayed software updates | When active, user visibility of software updates is delayed. supervised devices only | |
| Software Update Delay in days | 30 | With this restriction, the administrator can specify by how many days a software or app update is delayed on the device. With this restriction, the user will not see a software update until the specified number of days after the software update release date. supervised devices only |
| 1. | 2. | 3. |
| Abb.1 | Abb.2 | Abb.3 |
| Abbildungen | ||
| Restrictions | Default | Explanation |
|---|---|---|
| Restrict app use | Allow all apps Do not allow certain apps Allow only certain apps |
Configures whether no restriction, a blocklist or a allowlist is used for apps. supervised devices only |
|
Click box for app selection | Depending on the selection in the line above: Blocklisted Apps / Allowlisted Apps Searches the entire App Store for possible apps. supervised devices only |
| Add system apps | If the selection is limited to Allowed apps, all system apps can be added to the click box. The system apps can then be removed individually. supervised devices only | |
| Allow AirDrop | If set to false, AirDrop will be disabled supervised devices only | |
| Allow AirPrint | If set to false, AirPrint will be disabled supervised devices only | |
| Allow saving AirPrint credentials | If set to false, the storage of AirPrint credentials is disabled supervised devices only | |
| Allow AirPrint iBeacon detection | If set to false, AirPrint iBeacon detection will be disabled supervised devices only | |
| Allow change of mobile tariff | If set to false, the change of the mobile tariff will be disabled supervised devices only
non | |
| Allow cloud keychain synchronization | If set to false, cloud keychain synchronization is disabled supervised devices only | |
| Allow private cloud relay | If set to disabled, iCloud Private Relay will be disabled Devicesupervised devices only | |
| Allow eSIM changes | If set to false, the eSIM change will be disabled | |
| Allow access to files on USB drive | If set to false, access to the files USB drive is disabled supervised devices only | |
| Allow change to find my friends | If set to false, the modification will be disabled for find my friends supervised devices only | |
| Allow host pairing |
||
| Allow NFC | If set to false, NFC will be disabled supervised devices only | |
| Allow auto-complete password | If set to false, the auto-completion of the password will be disabled supervised devices only | |
| Allow device to enter sleep mode | If set to false, the hibernation of the device is disabled supervised devices only | |
| Allow requests for password proximity | If set to false, password proximity requests are disabled supervised devices only | |
| Allow password sharing | If set to false, password sharing will be disabled supervised devices only | |
| Allow change of personal hotspot | If set to false, the change of the personal hotspot will be disabled supervised devices only | |
| Allow Podcasts | If set to false, podcasts will be disabled supervised devices only | |
| Allow proximity settings for new device | If set to false, the proximity set-up for the new device will be disabled supervised devices only | |
| Allow removal of system apps | If set to false, the removal of system apps is disabled supervised devices only | |
| Allow non-paired external boot for recovery | If set to false, unpaired external booting for recovery is disabled supervised devices only | |
| Allow restricted USB mode | If set to false, the restricted USB mode will be disabled supervised devices only | |
| Allow VPN creation | If set to false, VPN creation will be disabled supervised devices only | |
| Allowed apps in single app mode | Choose application | Allowed apps in single app mode supervised devices only |
| Force AirPrint Trusted TLS Requirement | If set to true, AirPrint enforces the trusted TLS request supervised devices only | |
| Enforce authentication before autofill | If set to true, authentication is enforced before autofilling supervised devices only | |
| Force automatic date and time | If set to true, the date and time are automatically enforced supervised devices only | |
| Force WLAN to approved networks only | If set to true, WLAN is forced only on allowed networks supervised devices only | |
| Allow account modification | If inactive, account modification will be disabled. notempty This option prevents, for example, the creation of another Apple account, which could then be used to install additional apps. notempty iOS can only activate this restriction for all accounts. This also means that changing a password for an Exchange account is no longer possible. | |
| Allow app removal | Allows the user to remove apps supervised devices only | |
| Allow explicit content | Allows the user to access explicit content. When activated, the SafeSearch function is switched off by Safari. supervised devices only | |
| Allow use of iMessage | Allow use of iMessage supervised devices only | |
| Allow iBookstore | Supervised only. If disabled, iBookstore will be disabled supervised devices only | |
| Allow erotica in the iBookstore | Supervised only. If disabled, the user will not be able to download media from the iBookstore marked as erotica supervised devices only | |
| Allow use of iTunes | Allow the user to access and use iTunes supervised devices only | |
| Allow use of Safari | Allows the user to use Safari supervised devices only | |
| Allow Game Center | Allow Game Center | |
| Allow adding Game Center friends | Allow the user to add friends to the Game Center supervised devices only | |
| Allow modifying wallpaper | Allow changing the background image supervised devices only</smMS/deployment/profile.langall> | |
| Permit configuration of the screen time | Allow configuration restrictions supervised devices only | |
| Allow iCloud document sync | Allow document synchronization with iCloud supervised devices only | |
| Allow auto-fill in Safari | Automatisches Ausfüllen in Safari zulassen supervised devices only | |
| Allow predictive keyboard. | Allow predictive keyboard. supervised devices only | |
| Allow keyboard shortcuts. | Allow keyboard shortcuts. supervised devices only | |
| Allow autocorrect. | Allow autocorrect. supervised devices only | |
| Allow correction help. | Allow correction help. supervised devices only | |
| Allow definition. | Allow definition. supervised devices only | |
| Allow video conferencing | Allow video conferencing supervised devices only | |
| Enable Siri profanity filter | Enables Siri profanity filter. supervised devices only | |
| Allow app installation from Apple Configurator and iTunes | Allow only a connected Mac host to install applications supervised devices only | |
| Allow automatic app downloads | Allows automatic app downloads supervised devices only | |
| Allow app installation from the app store | Allow the user to install applications supervised devices only | |
| Allow modifying passcode | Allow changing the passcode supervised devices only | |
| Allow UI configuration profile installation | If set to false, the user is prohibited from installing configuration profiles and certificates interactively supervised devices only | |
| Allow erase all content and settings | If disabled, the user cannot select the "Clear all content and settings" option in Settings > General > Reset supervised devices only | |
| Allow app clips | When this option is disabled, a user cannot add app clips and remove existing app clips on the device. Available in iOS 14.0 and later. supervised devices only | |
| Force delayed app updates | If set to true, delayed app updates are forced supervised devices only | |
| Force delayed software updates | When active, user visibility of software updates is delayed. supervised devices only | |
| Software Update Delay in days | 30 | With this restriction, the administrator can specify by how many days a software or app update is delayed on the device. With this restriction, the user will not see a software update until the specified number of days after the software update release date. supervised devices only |
| Schließen | Schließt den Reiter ohne Änderungen zu übernehmen |
| Speichern | Übernimmt die Änderungen / Neuanlage, speichert und schließt den Reiter |
Notification settings
Notification settings
Add settings The settings are made separately for each app
| Caption | Value | Description |  |
|---|---|---|---|
| Application | Enter id | The bundle ID of the application. WARNING: Entering an unknown bundle ID can cause problems | |
| Enable notifications | Enables, respectively disables notifications for this app. | ||
| Alert type | Temporary banner | The notification type for notifications for this app: None/Banner/Warning | |
| Permanent banner | |||
| None | |||
| Badges enabled | Allow or disallow for this app. | ||
| Enable critical alerts | When active , critical alerts are enabled that can ignore "Do Not Disturb" and ringer settings for this app. | ||
| Grouping type | Automatic | The notification grouping type | |
| by App | |||
| Off | |||
| Preview type | Always | The notification type preview | |
| When unlocked | Displays the notification only when the device is unlocked | ||
| Never | Never displays the notifications | ||
| Show in CarPlay | When active, notifications are displayed in CarPlay | ||
| Show in lock screen | Determines whether notifications can be displayed in the lock screen | ||
| Show in notification center | Determines whether notifications are displayed in the notification center | ||
| Sounds enabled | Determines if sounds are allowed for this app |
| Schließen | Schließt den Reiter ohne Änderungen zu übernehmen |
| Speichern | Übernimmt die Änderungen / Neuanlage, speichert und schließt den Reiter |
AppsApps | |||
Profile created from portal version 1.31 onwardsnotemptyProfile created from portal version 1.31 onwards New as of 1.31 | |||
| Managing apps and web clips via profiles is outdated and no longer available. Reassigning applications to devices is now done via the menu item . Further information can be found in the Wiki article on iOS apps |
 | ||
Profile created before portal version 1.31notemptyProfile created before portal version 1.31 | |||
| notempty This function is deprecated. In profiles before version 1.31, apps can be removed but not newly added. Reassigning applications to devices is now handled via the menu item in the side menu. This also allows for later uninstallation of the application. Further information can be found in the Wiki article on iOS apps | |||
| Caption | Value | Description |  |
|---|---|---|---|
| Apps |
Securepoint VPN Client | The created apps can only be deleted. New apps cannot be added, Apps are added and removed from an iOS profile via the portal page | |
| Web clips | Securepoint Wiki [Label: SP Wiki] (https://wiki.securepoint.de) | The created Web clips can only be deleted. New Web clips cannot be added, Web clips are added and removed from an iOS profile via the portal page | |
App-Lock (Kiosk mode)
App-Lock (Kiosk mode)The app lock activates the guided mode which limits the device to a single app. In this state - also called kiosk mode - you can control which app functions are available.
Activate configuration
| 1. | 2. | 3. |
| Abb.1 | Abb.2 | Abb.3 |
| Abbildungen | ||
| Caption | Default | Description |  |
|---|---|---|---|
| Bundle ID | Enter ID | The bundle ID of the application. WARNING: Entering an unknown bundle ID can cause problems | |
Options | |||
| Disable touch | If true, the touch screen is disabled | ||
| Disable device rotation | If active, device rotation detection is disabled | ||
| Disabling the volume keys | When active, the volume keys are disabled | ||
| Deactivating bell switch | When active, the ringtone switch is disabled | ||
| Disable sleep wake button | When active, the sleep / wake button is disabled | ||
| Disable auto lock | |||
| Activate Voice-Over | If active, voice over is enabled | ||
| Activate zoom | When active, zoom is enabled | ||
| Enable inverting colors | If active, invert colors is enabled | ||
| Enable AssistiveTouch | When active, AssistiveTouch is enabled | ||
| Enable language selection | If active, the language selection is enabled. | ||
| Enable mono audio | When active, mono audio is enabled | ||
User Enabled Options | |||
| Voice-Over | If active, VoiceOver customization is allowed | ||
| Zoom | If active, the zoom setting is allowed | ||
| Invert colors | If active, the colors invert setting is allowed | ||
| AssistiveTouch | If active, AssistiveTouch customization is allowed | ||
| Schließen | Schließt den Reiter ohne Änderungen zu übernehmen |
| Speichern | Übernimmt die Änderungen / Neuanlage, speichert und schließt den Reiter |
Email & Exchange Active Sync
Email & Exchange Active Sync
Multiple mail accounts can be set up in the Email settings section.
These settings affect IMAP or POP3 accounts. Settings for Exchange ActiveSync must be made in the corresponding menu item!
| Email accounts | Add account | ||||||||||||||||||||||||||||||||||||||
| Operation | Default | Description |  | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Account description | Account description | The display name of the account (e.g. "Company Mail Account") | |||||||||||||||||||||||||||||||||||||
| Account name | Account name | The display name of the user (e.g. "John Appleseed") Variables can be used as well. The values are taken from the user settings of the user to whom the respective device is assigned
The display name can be combined with the variable %device_user_name%. The variable reads from the user settings of the user to whom the respective device is assigned the fields first name and last name. e.g.: %device_user_name% | ttt-Point AG → Martin Müller | ttt-Point AG | |||||||||||||||||||||||||||||||||||||
| Email address | Email address | The address of the account (e.g. "john@company.com") The entry $emailaddress$ reads the email address from the user settings of the user to whom the device is assigned. Variables can be used as well. The entries $variable1$, $variable2$ and $variable3$ can be defined individually. The values are taken from the user settings of the user to whom the respective device is assigned
| |||||||||||||||||||||||||||||||||||||
| Prevent move | If set to true, messages may not be moved out of this email account into another account | ||||||||||||||||||||||||||||||||||||||
| Disable email recipient synchronization | If set to true, this account is excluded from address "recent" syncing | ||||||||||||||||||||||||||||||||||||||
| Allow Mail drop | If set to true, this account is allowed to use Mail drop | ||||||||||||||||||||||||||||||||||||||
| Prevent App Sheet | If set to true, this account will not be available for sending mail in third party applications | ||||||||||||||||||||||||||||||||||||||
| S/MIME Enabled | If set to true, this account will support S/MIME | ||||||||||||||||||||||||||||||||||||||
| S/MIME signing enabled | S/MIME signing enabled | ||||||||||||||||||||||||||||||||||||||
| S/MIME encryption enabled | S/MIME encryption enabled | ||||||||||||||||||||||||||||||||||||||
| S/MIME enable Per-Message Switch | If set to true, enables the per-message encryption switch | ||||||||||||||||||||||||||||||||||||||
| Incoming mails | |||||||||||||||||||||||||||||||||||||||
| Operation | Default | Description | |||||||||||||||||||||||||||||||||||||
| Mail server | Mail server | Hostname or IP address | |||||||||||||||||||||||||||||||||||||
| Port | 993 | Port number for incoming mail | |||||||||||||||||||||||||||||||||||||
| Account type | IMAP |
The protocol for accessing the email account | |||||||||||||||||||||||||||||||||||||
| Username | Select user | The username used to connect to the server for incoming emails Variables can be used as well. $emailaddress$, $username$, $variable1$, $variable2$, $variable3$ The values are taken from the user settings of the user to whom the respective device is assigned
Examples:
| |||||||||||||||||||||||||||||||||||||
| Path prefix | Path prefix | Path prefix for IMAP mail server | |||||||||||||||||||||||||||||||||||||
| Incoming Mail Server authentication | authentication method | The authentication method for the incoming mail server None Password CrammD5 NTLM HTTPMD5 | |||||||||||||||||||||||||||||||||||||
| Password | Password | The password for the incoming mail server | |||||||||||||||||||||||||||||||||||||
| Use SSL | Incoming email retrieval via Secure Socket Layer | ||||||||||||||||||||||||||||||||||||||
| Outgoing mails | |||||||||||||||||||||||||||||||||||||||
| Operation | Default | Description | |||||||||||||||||||||||||||||||||||||
| Mail server | Mail server | Hostname or IP address for outgoing email | |||||||||||||||||||||||||||||||||||||
| Port | 587 | The port number for outgoing email | |||||||||||||||||||||||||||||||||||||
| Username | Select user | The username used to connect to the server for outgoing mail Variables can be used as well. $emailaddress$, $username$, $variable1$, $variable2$, $variable3$ The values are taken from the user settings of the user to whom the respective device is assigned
Examples:
| |||||||||||||||||||||||||||||||||||||
| authentication type | authentication method | The authentication method for the outgoing mail server Password CrammD5 NTLM HTTPMD5 | |||||||||||||||||||||||||||||||||||||
| Outgoing Password: Same as incoming | SMTP authentication uses the same password as POP/IMAP server for incoming emails
| ||||||||||||||||||||||||||||||||||||||
| Use SSL | Send outgoing email through Secure Socket Layer | ||||||||||||||||||||||||||||||||||||||
Exchange accounts
Exchange accounts Add account
Configuration for Exchange mails retrieved via https connections
Configuration by clicking on Activate Exchange ActiveSync
| Operation | Default | Description |  | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Account name | The display name of the user (e.g. "John Appleseed"). Different variables can be used. The values are taken from the user settings of the user to whom the respective device is assigned
| ||||||||||||||||||||||||||||||||||||||
| Exchange ActiveSync Host | Enter host | Host name or IP address of the Exchange server | |||||||||||||||||||||||||||||||||||||
| Past days of mail to sync | Synchronization period | ||||||||||||||||||||||||||||||||||||||
| Use SSL | Encrypts all messages with SSL (Secure Socket layer) | ||||||||||||||||||||||||||||||||||||||
| Email address | Select email address | The address of the account to be synchronized (e.g. "john@company.com") Variables can be used as well. The entries $variable1$, $variable2$ and $variable3$ can be defined individually. The values are taken from the user settings of the user to whom the respective device is assigned
| |||||||||||||||||||||||||||||||||||||
| Domain\User | Username | Mail domain and mail user
| |||||||||||||||||||||||||||||||||||||
| Password | Password | The password for the account | |||||||||||||||||||||||||||||||||||||
| Use OAuth | Specifies whether the connection should use OAuth for authentication. notempty If OAuth is specified, the password field should remain blank | ||||||||||||||||||||||||||||||||||||||
| Payload certificate UUID |
Select certificate | UUID of the certificate that is used for authentication notempty New as of: 2.7 | |||||||||||||||||||||||||||||||||||||
| Prevent move | If set to true, messages may not be moved out of this email account into another account | ||||||||||||||||||||||||||||||||||||||
| Prevent App sheet | If set to true, this account will not be available for sending mail in third party applications | ||||||||||||||||||||||||||||||||||||||
| Allow Mail Drop | If set to true, this account is allowed to use Mail Drop | ||||||||||||||||||||||||||||||||||||||
| S/MIME enabled |
If set to true, this account will support S/MIME | ||||||||||||||||||||||||||||||||||||||
|
If set to true, this account will support message encryption | ||||||||||||||||||||||||||||||||||||||
|
Allow users to enable or disable S/MIME encryption | ||||||||||||||||||||||||||||||||||||||
|
If set to true, this account will enable message signing | ||||||||||||||||||||||||||||||||||||||
|
Allow users to enable or disable S/MIME signing | ||||||||||||||||||||||||||||||||||||||
|
None | The UUID of the certificate used to sign messages sent by this user notempty New as of: 2.7 | |||||||||||||||||||||||||||||||||||||
|
Allow users to change the S/MIME signing certificate | ||||||||||||||||||||||||||||||||||||||
|
None | The UUID of the certificate used to decrypt received messages notempty New as of: 2.7 | |||||||||||||||||||||||||||||||||||||
|
Allow users to change the S/MIME encryption certificate | ||||||||||||||||||||||||||||||||||||||
|
If set to true, enables the per-message encryption switch | ||||||||||||||||||||||||||||||||||||||
| Disable email recipient synchronization | If this value is set to true, this account will be excluded from the synchronization of the "Recent" addresses | ||||||||||||||||||||||||||||||||||||||
| Activate calendar | Activate calendar | ||||||||||||||||||||||||||||||||||||||
| Calendar overwritable | Allow account to enable/disable calendar | ||||||||||||||||||||||||||||||||||||||
| Enable/disable contacts | Enable contacts | ||||||||||||||||||||||||||||||||||||||
| Contacts overwritable | Allow account to enable/disable contacts | ||||||||||||||||||||||||||||||||||||||
| Enable email | Enable email | ||||||||||||||||||||||||||||||||||||||
| Mail overwritable | Allow account to enable/disable mail | ||||||||||||||||||||||||||||||||||||||
| Enable notes | Enable notes | ||||||||||||||||||||||||||||||||||||||
| Allow account to enable/disable notes | |||||||||||||||||||||||||||||||||||||||
| Enable reminders | Enable reminders | ||||||||||||||||||||||||||||||||||||||
| Reminders overwritable | Allow the account to enable/disable reminders | ||||||||||||||||||||||||||||||||||||||
| Overwrite previous password | Overwrite previous password | ||||||||||||||||||||||||||||||||||||||
| Audio calls | Enter ID | The bundle ID of the application that processes audio calls made to contacts from this account | |||||||||||||||||||||||||||||||||||||
Example: Office365 accounts
Example: Office365 accountsExample: Integration of an Office 365 account with OAuth
Configuration in the Email & Exchange Active Sync tab when adding an Exchange Account
| Operation | Value | Description |
|---|---|---|
| Account name | Account name | Name of the user to be displayed |
| Exchange ActiveSync Host | outlook.office365.com | Example for Office365 |
| Number of days in which the emails from the past are synchronized | Forever | Possible values: 1 day, 3 days, 1 week, 2 weeks, 1 month, forever |
| Use SSL | Sends all communications via Secure Socket Layer.
notempty Securepoint recommends to activate the option | |
| Email address | alice@ttt-point.onmicrosoft.de | Possible addresses are selectable from the dropdown menu incl. variables that take the information from the user data |
| Domain\User | alice@ttt-point.onmicrosoft.de | The previously selected e-mail address of the user |
| Password | The password for the email account on the mail server notempty If OAuth is specified, the password field should remain blank | |
| Use OAuth | Specifies whether the connection should use OAuth for authentication.
| |
| OAuth login URL | https://login.microsoftonline.com/common/oauth2/v2.0/authorize | Login URL Here shown for Office365 accounts (example) |
| OAuth token request URL | https://login.microsoftonline.com/common/oauth2/v2.0/token | OAuth token request URL Here shown for Office365 accounts (example) |
| Payload certificate UUID: | None | If the authentication on the Exchange server is to be done with a certificate, this can be selected here. notempty Additionally, in the Certificates tab, the desired certificate must be added in the click box to be transferred to the device. |
| Schließen | Schließt den Reiter ohne Änderungen zu übernehmen |
| Speichern | Übernimmt die Änderungen / Neuanlage, speichert und schließt den Reiter |
Calendar
Calendar
Calendar with user account
Calendar with user account Variables can be used as well.The values are taken from the user settings of the user to whom the respective device is assigned
| Variable name in profiles | Description | Example |  |
|---|---|---|---|
| $username$ alternative names: %device_user% %device_user_username% |
Username | jdoe | |
| $emailaddress$ alternative name: %device_email% |
Email address | jdoe@ttt-point.de | |
| $firstname$ alternative name: %device_user_firstname% |
First name | John | |
| $lastname$ alternative name: %device_user_lastname% |
Last name | Doe | |
| $name$ alternative name: %device_user_name% |
First name and surname | John Doe | |
| $variable1$ alternative name: %variable1% |
custom value | jdoe/ttt-point.local | |
| $variable2$ alternative name: %variable2% |
custom value | ||
| $variable3$ alternative name: %variable3% |
custom value | ||
| $device_name$ alternative name: %device_name% |
Only for iOS: The name assigned on the phone (see: Settings → General → Info → Name) |
Cell phone from Markus Müller | |
| $device_alias$ alternative name: %device_alias% |
Only for iOS: The alias assigned in the portal. If the alias is not assigned, the device_name is displayed. |
Tablet Storage1 | |
| Defining the values in the user administration in the portal under: or for the device alias in the device tile. To avoid input errors, different variable names are possible for compatibility reasons. A distinction between Android and iOS is no longer necessary. | |||
| User | Add account | ||
| Caption | Value | Description |  |
|---|---|---|---|
| Hostname | Hostname | Server address of the calendar | |
| Username | Username | The username for the login The entries $emailaddress$, $username$, $variable1$, $variable2$ and $variable3$ are also possible. | |
| Password | Password | Optional. The password of the user | |
| Use SSL | Enable Secure Socket Layer communication with the CalDAV server | ||
| Port | Port | Optional. The port of the server to which the connection is made. | |
| Main URL | Main URL | The URL to the user's calendar. | |
| Account description | Account description | Optional. The description of the account. | |
Add subscription
Subscribed calendar Variables can be used as well.The values are taken from the user settings of the user to whom the respective device is assigned
| Variable name in profiles | Description | Example | |
|---|---|---|---|
| $username$ alternative names: %device_user% %device_user_username% |
Username | jdoe | |
| $emailaddress$ alternative name: %device_email% |
Email address | jdoe@ttt-point.de | |
| $firstname$ alternative name: %device_user_firstname% |
First name | John | |
| $lastname$ alternative name: %device_user_lastname% |
Last name | Doe | |
| $name$ alternative name: %device_user_name% |
First name and surname | John Doe | |
| $variable1$ alternative name: %variable1% |
custom value | jdoe/ttt-point.local | |
| $variable2$ alternative name: %variable2% |
custom value | ||
| $variable3$ alternative name: %variable3% |
custom value | ||
| $device_name$ alternative name: %device_name% |
Only for iOS: The name assigned on the phone (see: Settings → General → Info → Name) |
Cell phone from Markus Müller | |
| $device_alias$ alternative name: %device_alias% |
Only for iOS: The alias assigned in the portal. If the alias is not assigned, the device_name is displayed. |
Tablet Storage1 | |
| Defining the values in the user administration in the portal under: or for the device alias in the device tile. To avoid input errors, different variable names are possible for compatibility reasons. A distinction between Android and iOS is no longer necessary. | |||
| Subscriptions | Add subscription | ||
| Caption | Value | Description |  |
|---|---|---|---|
| Hostname | Hostname | Server address of the calendar | |
| Username | Username | The username for the login The entries $emailaddress$, $username$, $variable1$, $variable2$ and $variable3$ are also possible. | |
| Password | Password | Optional. The password of the user | |
| Use SSL | Enable Secure Socket Layer communication with the CalDAV server | ||
| Account description | Account description | Optional. The description of the account. | |
| Schließen | Schließt den Reiter ohne Änderungen zu übernehmen |
| Speichern | Übernimmt die Änderungen / Neuanlage, speichert und schließt den Reiter |
CardDav
CardDav
Variables can be used as well.
The values are taken from the user settings of the user to whom the respective device is assigned
| Variable name in profiles | Description | Example | |
|---|---|---|---|
| $username$ alternative names: %device_user% %device_user_username% |
Username | jdoe | |
| $emailaddress$ alternative name: %device_email% |
Email address | jdoe@ttt-point.de | |
| $firstname$ alternative name: %device_user_firstname% |
First name | John | |
| $lastname$ alternative name: %device_user_lastname% |
Last name | Doe | |
| $name$ alternative name: %device_user_name% |
First name and surname | John Doe | |
| $variable1$ alternative name: %variable1% |
custom value | jdoe/ttt-point.local | |
| $variable2$ alternative name: %variable2% |
custom value | ||
| $variable3$ alternative name: %variable3% |
custom value | ||
| $device_name$ alternative name: %device_name% |
Only for iOS: The name assigned on the phone (see: Settings → General → Info → Name) |
Cell phone from Markus Müller | |
| $device_alias$ alternative name: %device_alias% |
Only for iOS: The alias assigned in the portal. If the alias is not assigned, the device_name is displayed. |
Tablet Storage1 | |
| Defining the values in the user administration in the portal under: or for the device alias in the device tile. To avoid input errors, different variable names are possible for compatibility reasons. A distinction between Android and iOS is no longer necessary. | |||
| User | Add account | ||
| Caption | Value | Description |  |
|---|---|---|---|
| Hostname | Hostname | The CardDAV server hostname or IP address | |
| Username | Username | The CardDAV username The entries $emailaddress$, $username$, $variable1$, $variable2$ and $variable3$ are also possible. | |
| Password | Password | The CardDAV password | |
| Use SSL | When enabled , the Secure Socket Layer communicates with the CardDAV server. | ||
| Port | Port | The port number to connect to the CardDAV server | |
| Main URL | Main URL | The main URL for the CardDAV account | |
| Account description | Account description | The display name of the account (e.g. "Company CardDAV Account"). | |
| Schließen | Schließt den Reiter ohne Änderungen zu übernehmen |
| Speichern | Übernimmt die Änderungen / Neuanlage, speichert und schließt den Reiter |
Google account
Google account
| Caption | Value | Description |  |
|---|---|---|---|
| User | Add account | Adds a Google account. This also makes, for example, the history of Google searches or individual Google Maps configurations, such as special points, available on the device. | |
| Account description | Account description | The displayed name of the account (e.g. "Company Server Account"). | |
| Account name | Account name | Full user name of the Google account | |
| Email address | Email address | The address of the account (e.g. "mdm.ttt-point@gmailcom") Addresses of created users (from ) can be selected or freely entered. | |
| Audio calls | Enter ID | The bundle ID of the application that processes audio calls made to contacts from this account | |
| Schließen | Schließt den Reiter ohne Änderungen zu übernehmen |
| Speichern | Übernimmt die Änderungen / Neuanlage, speichert und schließt den Reiter |
Shared Device Configuration
| notempty The profile used with these settings can only be installed on an iPad if no users have been previously registered on this iPad. The iPad must therefore be reset to the factory settings. | |||
| Caption | Value | Description |  |
|---|---|---|---|
| Activate configuration | The shared device configuration can be set by activating . | ||
| Managed Apple ID default domains | Enter domains | A list of domains displayed on the login screen of the Shared iPad. When logging into the device, the user can select a domain from the list to complete their Managed Apple ID. The corresponding domain is added to their login. | |
| Online authentication grace period | 0 | ||
| Quota size | 0 | The quota size (in megabytes MB) for each user on the shared device or, if the quota size is too small, the minimum quota size. | |
| Resident users | 0 | The expected number of users. If this entered number is greater than the value for the maximum possible number of users that the device supports, the MDM server uses the maximum possible number instead. | |
| Skip language setup | When is activated, the system automatically selects the system language and regional scheme for the new Shared iPad user. | ||
| Temporary session only | If is activated, the user sees the welcome screen for guests and can only log in as a guest user. | ||
| Time limit for temporary session | 30 | The temporary session is automatically logged off after the specified period (in seconds) of inactivity. | |
| User session timeout | 30 | The user session is automatically logged off after the specified period (in seconds) of inactivity. | |
| Schließen | Schließt den Reiter ohne Änderungen zu übernehmen |
| Speichern | Übernimmt die Änderungen / Neuanlage, speichert und schließt den Reiter |
Shared iPad User
| Caption | Value | Description |  |
|---|---|---|---|
| Apple IDs | admin@ttt-point.de | This profile will be available on all General selected Devices for these Apple IDs. | |
| Schließen | Schließt den Reiter ohne Änderungen zu übernehmen |
| Speichern | Übernimmt die Änderungen / Neuanlage, speichert und schließt den Reiter |