Skip to main content

Restrictions

The Restrictions sections control which OS features are allowed on managed Apple devices. In the Apple Policy Editor, these options are exposed as grouped panels with multiple toggles.

The toggles of the App management and Networking panels are described in the Apple policy: Apps & profiles and Apple policy: Networking pages.

Many restrictions are only supported on specific OS versions and may require supervised devices. Use the tooltips in the dashboard for authoritative requirements.

On User Enrollment devices (personal devices enrolled by signing in with a work account), the restrictions that Apple doesn't allow there are not sent. If none of the policy's restrictions applies, these devices get no restrictions profile. The policy editor shows how many restrictions don't apply to User Enrollment devices.

Security

  • Allow auto unlock
  • Allow Fingerprint for Unlock
  • Allow Fingerprint Modification
  • Allow erase content and settings
  • Allow enabling restrictions
  • Allow profile installation by users
  • Allow host pairing
  • Allow diagnostic submission
  • Allow diagnostic submission modification
  • Allow Apple personalized advertising
  • Allow Remote Management modification

Multimedia

  • Allow camera
  • Allow File Sharing Modification
  • Allow Files USB Drive Access
  • Allow call recording
  • Allow AirPrint
  • Allow AirPrint credentials storage
  • Allow AirPrint iBeacon discovery

Cellular

  • Allow app cellular data modification
  • Allow cellular plan modification
  • Allow eSIM modification
  • Allow eSIM outgoing transfers
  • Keep the eSIM when the device is erased
  • Allow background fetch when roaming

Cellular APN

Cellular APN sets the access point name (APN) that your carrier gave you, for example for a private or business mobile network. Set the access point name and, if the carrier asks for them, the authentication (PAP or CHAP), the user name (variables such as $EMAIL$ are allowed), the password, the IP versions (also when roaming), a proxy server with its port and XLAT464. Turn on Attach APN only if the carrier gives you a separate APN for connecting to the network.

  • Only iPhone and cellular iPad get it, also without supervision. Devices enrolled with User Enrollment (personal devices) don't get it.
  • It applies to the SIM used for cellular data only. A device that already has an APN profile installed in another way doesn't install it.
  • The password is protected like the other network passwords: the profile is sent only to the device it was made for and the password isn't written in the logs.

A wrong APN leaves the devices without cellular data: try the settings on a test device with a SIM of the carrier first.

System and user interface

  • Allow Handoff
  • Allow autocorrection
  • Allow auto-dim
  • Allow automatic screen saver
  • Allow QuickPath keyboard
  • Allow definition lookup
  • Allow device name modification
  • Allow device sleep
  • Allow iPhone Mirroring
  • Allow iPhone widgets on Mac
  • Allow keyboard shortcuts

Apple apps and services

  • Allow iMessage
  • Allow Game Center
  • Allow Adding Game Center Friends
  • Allow Find My device
  • Allow Find My friends
  • Allow Find My friends modification
  • Allow Book Store
  • Allow Book Store erotica
  • Allow enterprise book backup
  • Allow enterprise book metadata sync
  • Allow iTunes Store
  • Allow explicit content

Siri and Apple Intelligence

  • Allow Siri
  • Allow Siri user-generated content
  • Allow Siri while locked
  • Allow dictation
  • Allow external intelligence integrations
  • Allow external intelligence sign-in
  • Allow Genmoji
  • Allow Image Playground
  • Allow Image Wand

iCloud

  • Allow iCloud address book
  • Allow iCloud backup
  • Allow iCloud bookmarks
  • Allow iCloud calendar
  • Allow iCloud desktop and documents
  • Allow iCloud document sync
  • Allow iCloud Freeform
  • Allow iCloud keychain sync
  • Allow iCloud Mail
  • Allow iCloud Notes
  • Allow iCloud Photo Library
  • Allow iCloud Private Relay
  • Allow iCloud Reminders

Accounts (restriction)

The Accounts panel contains both a restriction and (optionally) account configuration. The restriction toggle controls whether the user can modify system accounts.

  • Allow account modification