macOS: User functionality rules
As of macOS 26.2, Apple has made changes to how restriction payloads are handled. As a result, using a combination of device functionality rules and user functionality rules can result in unpredictable behavior (see developer.apple.com: Device Management Restrictions).
For devices with a version of macOS earlier than 26.2, it is a best practice to use either device functionality rules or user functionality rules. If you use a combination of both and create a rule conflict, the configuration of the device functionality rule takes precedence.
For devices with macOS version 26.2 or later, use device functionality rules only.
|
Name |
Description |
Activation types |
Default |
Possible values |
|---|---|---|---|---|
|
Allow Account Modification |
If false, the system disables modification of accounts, such as Apple Accounts, and internet-based accounts, such as Mail, Contacts, and Calendar. |
MDM controls |
Selected | |
|
Allow Handoff |
If false, the system disables activity continuation. Support for this restriction on unsupervised devices and with Managed Apple Accounts is deprecated. In a future release, this restriction will begin requiring supervision and will apply to personal Apple Accounts only. Minimum OS version: 15.0 |
MDM controls |
Selected | |
|
Allow Adding Game Center Friends |
If false, the system prohibits adding friends to Game Center. Minimum OS version: 10.13 |
MDM controls |
Selected | |
|
Allow Air Drop |
If false, the system disables AirDrop. Minimum OS version: 10.13 |
MDM controls |
Selected | |
|
Allow incoming AirPlay requests |
If false, the system disables incoming AirPlay requests. Minimum OS version: 12.3 |
MDM controls |
Selected | |
|
Allow Apple Intelligence Report |
If false, the system disables Apple Intelligence reports. Minimum OS version: 15.4 |
MDM controls |
Selected | |
|
Allow Apple Personalized Advertising |
If false, the system limits Apple personalized advertising. Minimum OS version: 12.0 |
MDM controls |
Selected | |
|
Allow modifying Remote Management Sharing setting |
If false, the system prevents modifying the Remote Management Sharing setting in System Settings. Minimum OS version: 14.0 |
MDM controls |
Selected | |
|
Allow Siri |
If false, the system disables Siri. Minimum OS version: 14.0 |
MDM controls |
Selected | |
|
Allow Auto Unlock |
If false, the system disallows auto unlock. Support for this restriction on unsupervised devices is deprecated. Minimum OS version: 10.12 |
MDM controls |
Selected | |
|
Allow modifying Bluetooth settings |
If false, the system prevents modification of Bluetooth settings. Minimum OS version: 13.0 |
MDM controls |
Selected | |
|
Allow modifying Bluetooth Sharing setting |
If false, the system prevents modifying Bluetooth settings in System Settings. Minimum OS version: 14.0 |
MDM controls |
Selected | |
|
Allow Bookstore |
If false, the system removes the Book Store tab from the Books app. Minimum OS version: 15.0 |
MDM controls |
Selected | |
|
Allow Bookstore Erotica |
If false, the system prevents the user from downloading Apple Books media that's tagged as erotica. Support for this restriction on unsupervised devices is deprecated. Minimum OS version: 15.0 |
MDM controls |
Selected | |
|
Allow Call Recording |
If false, disables call recording. Minimum OS version: 26.0 |
MDM controls |
Selected | |
|
Allow Camera Use |
If false, the system disables the camera and removes its icon from the Home Screen, and users are unable to take photographs. Support for this restriction on unsupervised devices is deprecated. Minimum OS version: 10.11 |
MDM controls |
Selected | |
|
Allow Cloud Address Book |
If false, the system disables iCloud Contacts services. Minimum OS version: 10.12 |
MDM controls |
Selected | |
|
Allow Cloud Bookmarks |
If false, the system disables iCloud Bookmark sync. Minimum OS version: 10.12 |
MDM controls |
Selected | |
|
Allow Cloud Calendar |
If false, the system disables iCloud Calendar services. Minimum OS version: 10.12 |
MDM controls |
Selected | |
|
Allow Cloud Desktop And Documents |
If false, the system disables iCloud Desktop and Document services. Minimum OS version: 10.12.4 |
MDM controls |
Selected | |
|
Allow iCloud Document Sync |
If false, the system disables document and key-value syncing to iCloud. Minimum OS version: 10.11 |
MDM controls |
Selected | |
|
Allow Cloud Freeform |
If false, the system disallows iCloud Freeform services. Minimum OS version: 14.0 |
MDM controls |
Selected | |
|
Allow Cloud Keychain Sync |
If false, the system disables iCloud Keychain synchronization. Support for this restriction on unsupervised devices and with Managed Apple Accounts is deprecated. Minimum OS version: 10.12 |
MDM controls |
Selected | |
|
Allow Cloud Mail |
If false, the system disables iCloud Mail services. Minimum OS version: 10.12 |
MDM controls |
Selected | |
|
Allow Cloud Notes |
If false, the system disables iCloud Notes services. Minimum OS version: 10.12 |
MDM controls |
Selected | |
|
Allow iCloud Photo Library |
If false, the system disables iCloud Photo Library. The system removes any photos from local storage that aren't fully downloaded from iCloud Photo Library to the device. Support for this restriction on unsupervised devices and with Managed Apple Accounts is deprecated. Minimum OS version: 10.12 |
MDM controls |
Selected | |
|
Enable Bluetooth |
Specify whether Bluetooth is enabled or disabled when the policy is sent to the device. Regardless of the setting of this rule, users can change the Bluetooth setting on their device at any time. Minimum OS version: 10.13.4 |
MDM controls |
Selected | |
|
Allow Cloud Private Relay |
If false, the system disables iCloud Private Relay. Support for this restriction on unsupervised devices and with Managed Apple Accounts is deprecated. Minimum OS version: 12.0 |
MDM controls |
Selected | |
|
Allow Cloud Reminders |
If false, the system disables iCloud Reminder services. Minimum OS version: 10.12 |
MDM controls |
Selected | |
|
Allow Define |
If false, the system disables definition lookup. Minimum OS version: 10.11 |
MDM controls |
Selected | |
|
Allow Modifying Device Name |
If false, the system prevents the user from changing the device name. Minimum OS version: 14.0 |
MDM controls |
Selected | |
|
Allow diagnostic submission |
If false, the system prevents the device from automatically submitting diagnostic reports to Apple. Minimum OS version: 10.13 |
MDM controls |
Selected | |
|
Allow dictation |
If false, the system disallows dictation input. Minimum OS version: 10.13 |
MDM controls |
Selected | |
|
Allow Erase All Content and Settings |
If false, the system disables the Erase All Content and Settings option in the Reset UI. Minimum OS version: 12.0 |
MDM controls |
Selected | |
|
Allow Explicit Content |
If false, the system hides explicit music or video content purchased from the iTunes Store. The system marks explicit content as such by content providers, such as record labels, when sold through the iTunes Store. Explicit content in the News and Podcast apps is also hidden. Minimum OS version: 15.0 |
MDM controls |
Selected | |
|
Allow external intelligence integrations |
If false, disables the use of external, cloud-based intelligence services with Siri. In a future release, this restriction will require supervision, and will be ignored on unsupervised devices. Minimum OS version: 15.2 |
MDM controls |
Selected | |
|
Allow external intelligence integrations sign-in |
If false, forces external intelligence providers into anonymous mode. Minimum OS version: 15.2 |
MDM controls |
Selected | |
|
Allowed External Intelligence Workspace IDs |
An array of strings, but currently restricted to a single element. If present, Apple Intelligence allows use of only the given external integration workspace ID, and requires a sign-in to make requests. The user is required to sign in to integrations that support signing in. Multiple payloads combine using an intersect operation. This means the allowed set of workspace IDs can become the empty set if multiple payloads specify conflicting values. Minimum OS version: 15.3 |
MDM controls | ||
|
Allow modifying File Sharing setting |
If false, the system prevents modifying File Sharing setting in System Settings. Minimum OS version: 14.0 |
MDM controls |
Selected | |
|
Allow Find My Device |
If false, the system disables Find My Device in the Find My app. Minimum OS version: 10.15 |
MDM controls |
Selected | |
|
Allow Find My Friends |
If false, the system disables Find My Friends in the Find My app. Minimum OS version: 10.15 |
MDM controls |
Selected | |
|
Allow Touch ID to Unlock Device |
If false, the system prevents Touch ID, Face ID, or Optic ID from unlocking a device. Support for this restriction on unsupervised devices is deprecated. Minimum OS version: 10.12.4 |
MDM controls |
Selected | |
|
Allow Modifying Touch ID Fingerprints |
If false, the system prevents the user from modifying Touch ID or Face ID. Minimum OS version: 14.0 |
MDM controls |
Selected | |
|
Allow Game Center |
If false, the system disables Game Center, and the system removes its icon from the Home Screen. Minimum OS version: 10.13 |
MDM controls |
Selected | |
|
Allow Genmoji |
If false, prohibits creating new Genmoji. Minimum OS version: 15.0 |
MDM controls |
Selected | |
|
Allow Image Playground |
If false, prohibits the use of image generation. Minimum OS version: 15.0 |
MDM controls |
Selected | |
|
Allow modifying Internet Sharing setting |
If false, the system prevents modifying the Internet Sharing setting in System Settings. Minimum OS version: 14.0 |
MDM controls |
Selected | |
|
Allow iPhone mirroring |
If false, prohibits the use of iPhone Mirroring. In macOS, this prevents the Mac from mirroring any iPhone. Minimum OS version: 15.0 |
MDM controls |
Selected | |
|
Allow iTunes File Sharing |
If false, the system disables iTunes file sharing services. Minimum OS version: 10.13 |
MDM controls |
Selected | |
|
Allow Live Voicemail |
If false, the system disables live voicemail on the device. Minimum OS version: 26.0 |
MDM controls |
Selected | |
|
Allow creating users in System Settings |
If false, the system prevents creating users in System Settings. Minimum OS version: 14.0 |
MDM controls |
Selected | |
|
Allow Mail Smart Replies |
If false, disables smart replies in Mail. Minimum OS version: 15.4 |
MDM controls |
Selected | |
|
Allow Mail Summary |
If false, disables the ability to create summaries of email messages manually. This doesn't affect automatic summary generation. Minimum OS version: 15.1 |
MDM controls |
Selected | |
|
Allow modifying Media Sharing setting |
If false, prevents modification of Media Sharing settings. Minimum OS version: 15.1 |
MDM controls |
Selected | |
|
Allow Multiplayer Gaming |
If false, the system prohibits multiplayer gaming. Minimum OS version: 10.13 |
MDM controls |
Selected | |
|
Allow Apple Music |
If false, the system disables the Music service, and the Music app reverts to classic mode. Minimum OS version: 10.12 |
MDM controls |
Selected | |
|
Allow Notes Transcription |
If false, disables transcription in Notes. Minimum OS version: 15.4 |
MDM controls |
Selected | |
|
Allow Notes Transcription Summary |
If false, disables transcription summarization in Notes. Minimum OS version: 15.3 |
MDM controls |
Selected | |
|
Allow Modifying Passcode |
If false, the system prevents adding, changing, or removing the passcode. Minimum OS version: 10.13 |
MDM controls |
Selected | |
|
Allow Password Auto Fill |
If false, the system disables:
However, if false, the system doesn't prevent AutoFill for contact info and credit cards in Safari. Minimum OS version: 10.14 |
MDM controls |
Selected | |
|
Allow Password Proximity Requests |
If false, the system disables requesting passwords from nearby devices. Minimum OS version: 10.14 |
MDM controls |
Selected | |
|
Allow Password Sharing |
If false, the system disables sharing passwords with the AirDrop passwords feature, or with the Passwords app. Minimum OS version: 10.14 |
MDM controls |
Selected | |
|
Allow modifying Printer Sharing setting |
If false, the system prevents modifying Printer Sharing settings in System Settings. Minimum OS version: 14.0 |
MDM controls |
Selected | |
|
Allow Background Security Improvement Installation |
If false, the system prohibits installation of rapid security responses. Minimum OS version: 26.0 |
MDM controls |
Selected | |
|
Allow Background Security Improvement Removal |
If false, the system prohibits removal of rapid security responses. Minimum OS version: 13.0 to 15.x |
MDM controls |
Selected | |
|
Allow modifying Remote Apple Events Sharing setting |
If false, the system prevents modifying Remote Apple Events Sharing settings in System Settings. Minimum OS version: 14.0 |
MDM controls |
Selected | |
|
Allow Safari History Clearing |
If false, the system disables the ability to clear browsing history in Safari. Minimum OS version: 26.0 |
MDM controls |
Selected | |
|
Allow Safari Private Browsing |
If false, the system disables the ability to use private browsing in Safari. Minimum OS version: 26.0 |
MDM controls |
Selected | |
|
Allow Safari Summary |
If false, the system disables the ability to summarize content in Safari. Minimum OS version: 15.4 |
MDM controls |
Selected | |
|
Allow Screenshots and Screen Recording |
If false, the system disables saving a screenshot of the display and capturing a screen recording. Minimum OS version: 10.14.4 |
MDM controls |
Selected | |
|
Allow Remote Screen Observation |
If false, the system disables remote screen observation by the Classroom app. Minimum OS version: 10.14.4 |
MDM controls |
Selected | |
|
Allow Siri Suggestions |
If false, the system disables Spotlight Internet search results in Siri. Minimum OS version: 10.11 |
MDM controls |
Selected | |
|
Allow modifying Startup Disk settings |
If false, the system prevents modification of Startup Disk settings in System Settings. Minimum OS version: 14.0 |
MDM controls |
Selected | |
|
Allow UI Configuration Profile Installation |
If false, the system prohibits the user from installing configuration profiles and certificates interactively. Minimum OS version: 13.0 |
MDM controls |
Selected | |
|
Allow Universal Control |
If false, the system disables Universal Control. Minimum OS version: 13.0 |
MDM controls |
Selected | |
|
Allow Modifying Wallpaper |
If false, the system prevents changing the wallpaper. Minimum OS version: 10.13 |
MDM controls |
Selected | |
|
Allow writing tools |
If false, disables Apple Intelligence writing tools. Minimum OS version: 15.0 |
MDM controls |
Selected | |
|
Enforced fingerprint timeout |
The value, in seconds, after which the fingerprint unlock requires a password to authenticate. The default value is 48 hours. |
MDM controls |
172800 | |
|
Enforced Software update delay |
How many days to delay a software update on the device. With this restriction in place, the user doesn't see a software update until the specified number of days after the software update release date. The rules "Force Delayed App Software Updates" and "Force Delayed Software Updates" use this value. Minimum OS version: 10.13.4 to 15.x |
MDM controls |
30 | |
|
Enforced Software update major os deferred install delay |
This restriction allows the administrator to set the number of days to delay a major software upgrade on the device. When this restriction is in place, the user sees a software upgrade only after the specified delay after the release of the software upgrade. This value controls the delay for "Force Delayed Major Software Updates". Minimum OS version: 11.3 to 15.x |
MDM controls |
30 | |
|
Enforced Software update minor os deferred install delay |
This restriction allows the administrator to set the number of days to delay a minor OS software update on the device. When this restriction is in place, the user sees a software update only after the specified delay after the release of the software update. This value controls the delay for "Force Delayed Software Updates". Minimum OS version: 11.3 to 15.x |
MDM controls |
30 | |
|
Enforced Software update non os deferred install delay |
This restriction allows the administrator to set the number of days to delay an app software update on the device. When this restriction is in place, the user sees a non-OS software update only after the specified delay after the release of the software. This value controls the delay for "Force Delayed App Software Updates". Minimum OS version: 11.3 to 15.x |
MDM controls |
30 | |
|
Enable Siri Profanity Filter |
If true, the system forces the use of the profanity filter for Siri and dictation. Minimum OS version: 10.13 |
MDM controls |
Not selected | |
|
Force Bypass Screen Capture Alert |
If true, then the system bypasses the presentation of a screen capture alert. Minimum OS version: 15.1 |
MDM controls |
Not selected | |
|
Force Classroom Automatically Join Classes |
If true, the system automatically gives permission to the teacher's requests without prompting the student. Minimum OS version: 10.14.4 |
MDM controls |
Not selected | |
|
Force Classroom Request Permission To Leave Classes |
If true, a student enrolled in an unmanaged course through Classroom needs to request permission from the teacher to leave the course. Minimum OS version: 10.14.4 |
MDM controls |
Not selected | |
|
Force Classroom Unprompted App And Device Lock |
If true, the system allows the teacher to lock apps or the device without prompting the student. Minimum OS version: 10.14.4 |
MDM controls |
Not selected | |
|
Force Classroom Unprompted Screen Observation |
If true and ScreenObservationPermissionModificationAllowed is also true in the Education payload, a student enrolled in a managed course through the Classroom app automatically gives permission to that course teacher's requests to observe the student's screen without prompting the student. Minimum OS version: 10.14.4 |
MDM controls |
Not selected | |
|
Force Delayed App Software Updates |
If true, the system delays user visibility of non-OS software updates. Minimum OS version: 11.0 to 15.x |
MDM controls |
Not selected | |
|
Force Delayed Major Software Updates |
If true, the system delays user visibility of major OS updates. Minimum OS version: 11.3 to 15.x |
MDM controls |
Not selected | |
|
Force Delayed Software Updates |
If true, the system delays user visibility of software updates. In macOS, the system allows seed build updates without delay. Minimum OS version: 10.13 to 15.x |
MDM controls |
Not selected | |
|
Force On Device Only Dictation |
If true, the system disables connections to Siri servers for the purposes of dictation. Minimum OS version: 14.0 |
MDM controls |
Not selected | |
|
Ratings region |
Specify the region that a macOS device uses for content ratings. The options that are available in the "Allowed content ratings" rules that follow are dependant on the region that you select. |
MDM controls |
United States |
|
|
Allowed content ratings for movies |
Specify the maximum allowed rating for movies that users can download from the app store. Use this rule to block access to new and existing movies that exceed a maximum rating. If set to "Don't allow movies," all movies purchased from the app store are hidden and users can't preview, purchase, or download movies. If set to something other than "Don't allow movies," the "Allow use of iTunes Store" rule must also be selected to allow users to download content. The "Ratings region" rule determines which ratings system is used. Depends on: Ratings region |
MDM controls |
Allow all movies |
Differ by region. |
|
Allowed content ratings for TV shows |
Specify the maximum allowed rating for TV shows that users can download from the app store. Use this rule to block access to new and existing TV shows that exceed a maximum rating. If set to "Don't allow TV shows," all TV shows purchased from the app store are hidden and users can't preview, purchase, or download TV shows. If set to something other than "Don't allow TV shows," the "Allow use of iTunes Store" rule must also be selected to allow users to download content. The "Ratings region" rule determines which ratings system is used. Depends on: Ratings region |
MDM controls |
Allow all TV shows |
Differ by region. |
|
Allowed content ratings for apps |
The maximum level of app content allowed on the device. Preinstalled (first-party) apps ignore this restriction. Age bands and the number of discrete age values vary by region, but the values are consistent across regions. For example, in a region that defines rating level 14+, its value is guaranteed to be larger than 300 (12+) and smaller than 600 (17+). Also, the value of rating level 15+ is guaranteed to be larger than the assigned value of rating level 14+. For more information about age ratings, see App Store: Age ratings values and definitions. The tool tip for the rule provides several example values for other regions. Depends on: Ratings region |
MDM controls |
Allow all apps |
Differ by region. |
|
Allow AutoFill in Safari |
If false, the system disables Safari AutoFill for passwords, contact info, and credit cards, and also prevents using the Keychain for AutoFill. Note: The system still allows third-party password managers, and apps can use AutoFill. |
MDM controls |
Selected |