Policies - Apple

Apple policies

Apple policies define management settings that Cerberus Enterprise applies to Apple devices via MDM. These settings are configured from the dashboard in the Apple policy editor.

Before you start

Apple device management requires Apple Management (APNs) to be configured. If needed, read the Apple Management setup (APNs) page.

Open the Apple Policy Editor

In the dashboard, open Policies and click Create new Apple policy. To edit an existing Apple policy, click its row in the policies table.

Editor layout

The Apple Policy Editor is organized as a set of expandable sections. At the top of the page you can always edit:

Policy sections

The sections below match the panels currently available in the Apple Policy Editor. When you open a saved policy, the sections with changed settings are already open and the others stay closed:

Many options in the Apple Policy Editor include a tooltip that documents requirements and supported OS versions.

Save, delete, and associated devices

Use Save policy to apply your changes. The button is disabled when there are no pending edits, or when the license is expired.

When editing an existing policy, the page also shows a Delete policy action. The editor can show an Associated devices list at the bottom, so you can see how many devices are currently using the policy.

Next pages

Apps & profiles

This section documents how to configure managed applications and account payloads for Apple devices.

App management

The App management panel contains both general app-related restrictions and a list of managed apps.

General app restrictions

Managed apps

Use Add application to add an app to the policy. Each managed app is displayed as a card. You can expand the card to edit its settings and remove the app using the delete action.

The app selection list shows the available and total licenses of each app. Free apps show Unlimited: Apple gives them unlimited licenses. An app can be added to a policy only once: an app with the same App Store ID or bundle ID as an app already in the policy is refused, and so is a policy that lists the same app twice when you save it.

The app selection list shows the apps of your Apple Business library. To add an app, in Apple Business open Apps & Services → Apps & Books → App Store, search for the app and click View. For a free app, click Add, select All current and future (or the organizational unit of your Apps and Books token) in Organizational Units, click Add, then Review and confirm. For a paid app, click its price, choose Managed Licenses as License Type (redemption codes can't be used by Cerberus Enterprise), select the Organizational Unit of your Apps and Books token, enter the number of Licenses (up to 1,000 per order), then Review and buy. A payment method must be set up first in Settings → Payments & Billing → Apps & Services → Payment Methods. The apps then appear in the app selection list.

Apps on personal devices (User Enrollment)

Personal iPhones and iPads enrolled with User Enrollment have no serial number, so they get the App Store apps of the policy with a user license of the Managed Apple Account signed in on the device. Cerberus registers the account with Apps and Books and assigns the licenses by itself, free apps included. The Managed Apple Accounts and the Apps and Books token must belong to the same Apple Business organization. A paid app uses one license per account, shared by all the personal devices of that account.

For the details, see Apple account-driven enrollment.

Managed configuration

A managed configuration gives an app its settings (for example a server address or an account name), the way the app's vendor documents them. Open the app in the policy and click Add managed configuration. It's sent to iPhones and iPads with iOS or iPadOS 18.4 or later and to Macs with macOS 27 or later; it isn't sent to Apple Vision Pro yet. The app must support managed configuration: an app that doesn't read it ignores it. The app panel shows the number of keys next to the app name.

App options

Each app of the policy (App Store and custom apps) has these options. Device default leaves the choice to the device. Devices that don't support an option don't get it; the app is still installed.

Mac App Store apps

The app selection list shows the platforms of each app (iPhone/iPad, Mac, Apple TV, Vision); an app that exists only for Mac shows its Mac icon. An app that exists only for Mac applies to Macs when you add it. An App Store app without a Mac version isn't sent to Macs: the policy shows "This app has no Mac version: it isn't sent to Macs" under Applies to. Macs get App Store apps by their App Store ID, so apps with a different bundle ID on Mac are installed correctly.

Cerberus Enterprise app

Cerberus installs its Cerberus Enterprise app on every iPhone and iPad with iOS or iPadOS 18.4 or later, with or without a policy. The app shares the device location and receives notifications and live tracking requests. It's installed as Required, with a device license from Apps and Books (a user license on personal devices), so the user can't delete it.

Custom apps

Custom apps are your own iPhone and iPad apps (.ipa files), distributed without the App Store. In Xcode, export the app for Enterprise distribution (Apple Developer Enterprise Program: it installs on every device) or Ad Hoc distribution (it installs only on the devices registered in its provisioning profile). App Store builds can't be uploaded.

Click Add custom app to open the custom apps of your organization. Upload app adds an .ipa file (up to 2 GB). Select an app and click Add to the policy. The list shows the version, the type of signing, the number of devices in the profile of ad hoc apps and the expiry date of the provisioning profile.

Mac packages

The custom apps also accept Mac installer packages (.pkg files). The package must be a distribution package built with productbuild (a component package made only with pkgbuild is refused) and signed with a Developer ID Installer certificate. Notarizing it and stapling the ticket (notarytool and stapler) is recommended. Unsigned packages, packages changed after signing and packages signed with other certificates are refused.

Upload the .pkg file with Upload app and add it to the policy: it appears under Mac packages. iPhones and iPads ignore it.

Macs with macOS 26 or later (supervised, which includes Macs enrolled manually, but not User Enrollment) get the package as a declaration: the Mac downloads, installs, retries and updates it by itself and reports its state. Older Macs, and packages installed as managed apps, get it with an MDM command, on any macOS version. A Mac that is upgraded to macOS 26 moves to the declaration by itself; it may install each package once more. The same can happen when a Mac moves to another policy that has the same package.

Accounts

The Accounts panel lets you configure accounts that are applied to managed devices. It also includes a restriction toggle for account modification.

Restriction

Add accounts

Use Add Google account or Add mail account to add account payloads to the policy. Each account appears as a card with its configuration fields.

Account credentials from users

Both Google and Mail account cards provide a Account credentials from users toggle. When enabled, the system applies account credentials on a per-user basis. When disabled, you enter the account identity in the policy.

Google account fields

Mail account fields

Mail accounts include identity fields plus incoming/outgoing server configuration. Host names are required.

Incoming server

Outgoing server

S/MIME options

For Mail accounts, you can also configure S/MIME encryption and signing behavior.

Encryption

Signing

Account and restriction options include tooltips in the dashboard that document prerequisites and supported OS versions.

Kiosk and Home Screen

The Kiosk and Home Screen section of the Apple Policy Editor locks devices into one app, chooses which apps can be opened, arranges the Home Screen and adds website icons. Each setting is installed on the devices as a configuration profile.

Apple applies most of these settings only to supervised iPhone and iPad (devices enrolled with Automated Device Enrollment or prepared with Apple Configurator). Other devices don't get them. Web clips also work on unsupervised iPhone and iPad. Macs don't get any of these settings.

Choosing apps

Apps are identified by their bundle ID. Type the name of an app to pick it from the built-in Apple apps and the apps of the policy, or type any bundle ID, for example com.example.app.

Single App Mode

The device runs only the chosen app: users can't go back to the Home Screen or open other apps. Install the app with the policy first. The device leaves Single App Mode when you turn the setting off or remove the app.

Allowed and blocked apps

With Allow only some apps, every app that isn't in the list disappears from the devices, including the apps of the policy. Settings and, on iPhone, Phone always stay.

Home Screen layout

Arrange the Dock and the pages of the Home Screen. Add apps, folders of apps and the web clips of the policy, choosing where with Add to, and drag the icons to move them between the Dock and the pages. Click a folder to change its name and apps.

Users can't move the icons or remove apps from the Home Screen. Apps that aren't in the layout go to the pages after the ones you defined. An iPhone shows four icons in the Dock. Users can still delete apps that aren't Required in the storage screen of Settings. To stop that, turn off Allow app removal in App management.

Web clips

A web clip is an icon on the Home Screen that opens a website. Set the label and the URL, and optionally an image (PNG or JPEG, cropped to a square).

Notification settings

Choose how the devices show the notifications of some apps: whether they are allowed, where they appear (Lock Screen, Notification Center, CarPlay), badges, sounds, critical alerts, banner style, grouping and previews. Users can't change these settings.

Lock Screen message

A message shown at the bottom of the Lock Screen, for example who to call if the device is found, and an asset tag. Both can contain the variables $EMAIL$, $USERNAME$, $FULLNAME$, $SERIAL$ and $UDID$: a variable without a value for the device is left empty.

Passcode

The Passcode settings section controls device passcode requirements and related security rules (for example, minimum length and complexity). On a Mac (macOS 13 or later, not with User Enrollment) the rules apply to the login password of the users.

Options

In the Apple Policy Editor, passcode options are configured using a mix of toggles and numeric fields. Many fields include tooltips that indicate supported OS versions and supervision requirements.

Passcode toggles

Numeric fields

Restrictions

The Restrictions sections control which OS features are allowed on managed Apple devices. In the Apple Policy Editor, these options are exposed as grouped panels with multiple toggles.

The toggles of the App management and Networking panels are described in the Apps & profiles and Networking pages of Apple policies.

Many restrictions are only supported on specific OS versions and may require supervised devices. Use the tooltips in the dashboard for authoritative requirements.

On User Enrollment devices (personal devices enrolled by signing in with a work account), the restrictions that Apple doesn't allow there are not sent. If none of the policy's restrictions applies, these devices get no restrictions profile. The policy editor shows how many restrictions don't apply to User Enrollment devices.

Security

Multimedia

Cellular

Cellular APN

Cellular APN sets the access point name (APN) that your carrier gave you, for example for a private or business mobile network. Set the access point name and, if the carrier asks for them, the authentication (PAP or CHAP), the user name (variables such as $EMAIL$ are allowed), the password, the IP versions (also when roaming), a proxy server with its port and XLAT464. Turn on Attach APN only if the carrier gives you a separate APN for connecting to the network.

A wrong APN leaves the devices without cellular data: try the settings on a test device with a SIM of the carrier first.

System and user interface

Apple apps and services

Siri and Apple Intelligence

iCloud

Accounts (restriction)

The Accounts panel contains both a restriction and (optionally) account configuration. The restriction toggle controls whether the user can modify system accounts.

Networking

The Networking section of the Apple Policy Editor configures Wi-Fi networks and VPNs on the devices, installs certificates and restricts connectivity features such as AirDrop and Bluetooth. Each Wi-Fi network, VPN and certificate is installed as its own configuration profile, which you can see on the device in Settings > General > VPN & Device Management (Mac: System Settings > General > Device Management, or Privacy & Security > Profiles on macOS 13 and 14) and in the Profiles, certificates and security panel of the device page.

Certificates are taken from the Certificates page: import them there first. The policy only refers to them, so a certificate is never copied in the policy.

Restrictions

Wi-Fi networks

Click Add Wi-Fi network and fill in:

Enterprise networks (802.1X)

Turn on Enterprise (802.1X) when users authenticate with their own credentials or a certificate instead of a shared password.

VPN

Click Add VPN to configure an IKEv2 or Cisco IPSec VPN, built into iOS, iPadOS and macOS (no VPN app needed).

Connection

Test an Always On or on-demand VPN on a test device first: if the server can't be reached, the device may have no connection.

Global proxy, encrypted DNS and web content filter

These settings apply to all the traffic of the device. Turn them on with their toggle.

A wrong proxy or DNS server can leave the devices without a connection: try the settings on a test device first.

Certificates

Click Add certificate to install a certificate on its own: a certificate authority that Safari and the apps must trust, or an identity used by apps. The certificates of a Wi-Fi network or a VPN don't need to be added here.

Certificate options

Client certificates (.p12) protected with the old RC2 encryption can't be installed on Apple devices. Export them again with 3DES or AES encryption before importing them.

Security

Profiles that contain passwords or private keys are sent only to the device they were made for: the device must sign its request with its management certificate. Passwords and certificates aren't written in the logs.

Software updates

The Software updates section of the Apple Policy Editor keeps the devices up to date: it can require a specific OS version by a deadline, and control how the devices download and install updates.

Required OS updates

Click Add required update to require an OS version. The device downloads the update, tells the user about the deadline and installs it at the deadline if the user hasn't done it before. Devices that already run that version or a later one ignore it. Requires iOS and iPadOS 17 or macOS 14.

The device reports the progress of the update (download, installation, failures) in the Device status panel of the device page.

Software update settings

Turn on Software update settings for iPhone and iPad or Software update settings for Mac to control the updates on those devices. When a toggle is off, the devices keep their own settings. Requires iOS and iPadOS 18 or macOS 15: older devices ignore these settings.

Installing an update from the device page

The Device status panel of a device lists the updates available for it. Use Check for updates to ask the device for the list and Install to install one now or to download it and let the user install it. This works on supervised iPhones and iPads and on Macs. Apple removes these commands in iOS, iPadOS and macOS 27: on those versions use the required updates of the policy.

macOS

The macOS section of the Apple Policy Editor manages the security, privacy and login settings of the Macs: FileVault, firewall, Gatekeeper, screen saver and lock, external and network storage, Screen Sharing, privacy permissions, login items, and the system and kernel extensions allowed to load. It also installs configuration files of system services and background tasks. The other devices of the policy don't get these settings. Turn on a setting to manage it; while it's off, the users keep their own choices.

Most settings are installed on the Mac as configuration profiles, visible in System Settings > General > Device Management. FileVault, privacy permissions, login items and the extension settings need user-approved MDM: on a Mac enrolled with the enrollment URL or QR code, the user approves the enrollment profile in System Settings. The device page shows it in the User-approved MDM field. When the user approves it later, the Mac gets these settings automatically.

FileVault

FileVault encrypts the disk of the Mac. With this setting on, users are asked to turn on FileVault with their password, and the Mac sends its personal recovery key to Cerberus Enterprise, encrypted with a key that belongs to your organization only. The key is shown and changed from the FileVault field of the device page (see Device commands). The setting needs macOS 13 or later and user-approved MDM; without user-approved MDM the Mac isn't asked to turn on FileVault, but if a user turns it on, its key is stored.

A Mac that was already encrypted when it got the setting keeps its current key, which Cerberus Enterprise doesn't receive: the key is stored only after the user turns FileVault off and on again (with "Prevent turning off FileVault" off). Turning the setting off, or removing the Mac from management, doesn't turn off FileVault, and the stored key keeps working. The setting can't be saved when the server isn't configured to store recovery keys.

Firewall

Gatekeeper

Gatekeeper checks the apps before they open. Choose whether the Macs open only App Store apps, or also the apps of identified developers. With Gatekeeper off, any app can be opened, also unsigned or damaged ones. On macOS 15 or later you can also choose whether users are asked to send blocked malware to Apple.

Screen saver and lock

Start the screen saver after a time of inactivity, and ask for the password when the screen saver starts or the display sleeps, at once or after a delay. A setting left as Not managed stays the user's choice.

External and network storage

Allow, make read only or block the external storage (USB drives, SD cards, external disks) and the network storage (file shares) of the Macs. Needs macOS 15 or later.

Screen Sharing

Limits of the people who connect to these Macs with Screen Sharing: copying files from or to the Mac, high-performance connections and the number of virtual displays. Turning on Screen Sharing stays a choice of the user. Needs macOS 14 or later.

Privacy permissions

Give or deny apps the access that users would otherwise allow in System Settings > Privacy and Security, for example Full Disk Access for a backup app, or deny the camera to an app. For each permission choose:

Login and background items

The login items and background items that match the rules are managed: they run without asking, and users can't turn them off in System Settings > General > Login Items. A rule matches the developer team ID of an app, its bundle ID or the label of a launch daemon or agent (also by their first part). Needs macOS 13 or later.

System extensions

System extensions are the modern way for apps to extend macOS: network filters and VPNs, endpoint security agents and drivers. With this setting on, the system extensions of the listed developer teams load without asking the user. Needs macOS 10.15 or later and user-approved MDM.

On macOS 11.3 and later, removing this setting turns off the system extensions it allowed, for example a security agent or a network filter. This happens when the setting is turned off, when the policy is deleted, and when the Mac moves to a policy without it. The editor asks for confirmation before turning the setting off.

Kernel extensions (legacy)

Kernel extensions are the older, deprecated way to extend macOS: prefer system extensions when the vendor offers them. The kernel extensions of the listed teams (every extension of a team, or only the listed bundle IDs) load without asking the user, after a restart. Needs macOS 10.13.2 or later and user-approved MDM.

On Macs with Apple silicon, a profile alone isn't enough: someone must start the Mac in recoveryOS, choose Reduced Security in Startup Security Utility and allow the user management of kernel extensions from identified developers. The Mac may also need a Bootstrap Token escrowed in Cerberus Enterprise to approve them (see the Bootstrap Token field of the device page).

Mac files

The service configuration files and the background tasks use files that you upload to the Mac files of your organization: zip archives and property lists (.plist) up to 20 MB. Upload, check where they are used or delete them with the Mac files button of the macOS section, or with Choose file in a setting. A file used by a policy can't be deleted. To change a file, upload the new version and choose it in the policy: the Macs download it again.

Service configuration files

Installs the configuration files of a system service from a zip archive. The built-in services are the SSH server (sshd), sudo, PAM, printing (CUPS), the Apache web server, bash, zsh, smart card login and authorization. You can also use your own service, with a reverse DNS identifier like com.example.service: it finds the files with the managed configuration files library of macOS. Each service can have one setting. Needs macOS 14 or later.

A built-in service uses only the files of the archive and ignores its own files, for example /etc/ssh for sshd: put the whole configuration in the archive, in folders that start from the root of the disk (for example etc/ssh/sshd_config). The files are read-only on the Mac, and they are removed with the setting. Test the archive on one Mac first: a wrong sudo or PAM configuration can stop users from signing in or from using administrator rights.

Background tasks

Programs and scripts that run in the background, started by launchd. Users can't turn them off, and they are removed with the setting. Needs macOS 15 or later. For each task choose:

A task needs the programs or at least one property list. When the files change, the Macs restart the task.

Location and geofences

The Location and geofences section of the Apple Policy Editor defines areas, for example a site or a warehouse. iPhones and iPads with the Cerberus Enterprise app report when they enter or leave one of these areas, and event rules can react to it: send an email, lock or disable the device, or enable it again. Macs don't use geofences.

Geofence fields

Use Add geofence to create a new entry. A policy can contain up to 10 geofences, and their names must be unique within the policy. Each geofence contains these fields:

Each geofence has a map preview. The center and radius of a saved geofence are locked: use the lock button on the map to change them. The other buttons center the map on the area or on your current location.

When you save the policy, Cerberus Enterprise asks the iPhones and iPads of the policy to get the new geofences. This usually takes a few minutes, but iOS can delay it, for example in Low Power Mode or without a network connection. The device page shows when the app hasn't applied the latest geofences yet.

Requirements

Geofences work on iPhones and iPads with the Cerberus Enterprise app. Macs ignore them. On the device:

Location and geofences on personal devices, at the top of the section, is off by default. While it's off, Cerberus doesn't collect the location of personal devices (User Enrollment), their geofence events aren't generated, and their device page doesn't offer Locate or live tracking. When you turn it on, personal devices of the policy share their location and geofence events like company devices, but only if the user allows location for the Cerberus Enterprise app; the app explains this to the user before iOS asks. Your organization is responsible for informing users and for following local rules on employee location. Lost Mode and the MDM location request are never available on personal devices (Apple doesn't allow them).

In Low Power Mode geofences keep working, but iOS reports leaving an area later and with a less precise location, and it can delay getting new geofences after a policy change by hours, until the app runs again (for example at the next crossing, or when the user opens it).

How events arrive

iOS watches the areas for the app and wakes it when the device crosses a border, also when the app isn't open. Events can arrive a few minutes after the crossing, and a small area or a short visit can be missed: iOS needs the device to move some distance past the border and to stay there for a while.

If the app can't run, for example after a restart before the device is unlocked, the server also detects the crossing from the locations the app sends, later. Each crossing triggers the event rules once, whether the app or the server detects it.

When the app hasn't contacted the server for several hours, the server asks iOS to wake it so that it can check its geofences again. iOS doesn't guarantee these requests.

Device page

On the device page, the Geofence tab of the Location map panel shows the transitions of the device. When the policy has active geofences, a status line tells whether geofencing works on the device, or why it can't: the app hasn't contacted the server or must be updated, location access isn't Always, Precise Location or Background App Refresh is off, Low Power Mode was on when the app last reported its settings, or the app hasn't applied the latest geofences yet.

Geofence transitions and locations are kept for 90 days and older data is deleted automatically every night. The latest location of each enrolled device is always kept, so it stays on the maps.

Limitations

To react to geofence events, create an event rule for Device enters a geofence or Device exits a geofence. See Event rules.

Accounts

The Accounts section of the Apple Policy Editor adds mail, Exchange, Google, calendar, contacts and directory accounts to iPhone, iPad and Mac. Click Add account and choose the type. The section also contains the Allow account modification restriction (supervised devices).

On a Mac (macOS 13 or later) the accounts are installed in the session of the users enrolled in the management, usually the user who enrolled the Mac, when they're logged in. The device page lists these users under Mac users, with the state of their accounts. Accounts that take the email address from the device user use the user assigned to the Mac in Cerberus Enterprise.

Common settings

Account types

S/MIME

Mail and Exchange accounts can sign and encrypt messages with S/MIME (iOS 17 or later). For each one, choose the certificate: one of the Certificates page, the certificate of the device user, or requested from a SCEP server. You can let the user turn it off, choose another certificate and, for encryption, show a switch for each message.

Security

Passwords and certificates aren't part of the settings sent to the devices: each device downloads its own credentials from Cerberus Enterprise, signing the request with its management certificate. They aren't written in the logs.

Compliance rules

The Compliance rules section of the Apple Policy Editor sets requirements for the devices of the policy. A device that breaks a rule is non-compliant at once: the device page shows why, in Why the device is non-compliant, and the devices list shows it as non-compliant. A device is also non-compliant when a setting of the policy can't be applied on it.

Rules

A rule is checked when the device sends its status, when the policy is saved, and every hour. A device whose status is unknown (for example a Mac that didn't report FileVault yet) doesn't break the rule.

Blocking the device

Turn on Block the device if it's still non-compliant and set after how many days (0 blocks at once). Supervised iPhone and iPad go into lost mode with the message you set. The other devices are locked once; a Mac restarts and asks for a PIN, shown in the details of the command in the command history.

To be notified, or to react in other ways, create an event rule for Device becomes non-compliant: it also gets the reasons.