barscaret-downcaret-leftcaret-rightcaret-upcheckchevron-leftchevron-rightfile-pdfinfosign-in-altsignin text-widthtimesyoutube

iOS > Device Data & Configuration

Restrictions for iOS

Updated on June 17th, 2020

Restriction configuration profiles are described thoroughly in the About restrictions article. It explains how to configure and deploy restrictions for managed devices, and also how the restrictions can be lifted.

This article focuses on introducing what restrictions are supported for Apple iOS devices and whether there are any platform-specific requirements for the use of restrictions.

Requirements

Restriction configuration profiles can be applied to all Apple iOS devices that are managed with Miradore. Some restrictions may require that devices are Supervised. In Miradore’s user interface, these restrictions are marked with the symbol. For more information, see the descriptions below.

Restriction configuration profiles are available in the Miradore Business and Enterprise plans. The restriction configuration profiles are not included in the Miradore Free plan.

Available restrictions

Below you can find a list of all restrictions supported on the Apple iOS platform. Tab names are underlined.

Applications

Deny Camera

Defines if the camera is completely disabled and its icon is removed from the Home screen. Users are unable to take photos.

Deny Dictation

Defines if the user is able to use the dictation input method.

Deny FaceTime

Defines if FaceTime and video conferencing is disabled. This restriction is deprecated on unsupervised devices.

Deny Game Center

Defines if Game Center is disabled and its icon is removed from the Home screen. Available in iOS 6.0 and later. Requires that devices are Supervised.

Game Center: Deny adding friends

Defines if adding friends to Game Center is denied. This restriction is deprecated on unsupervised devices.

Game Center: Deny multiplayer gaming

Defines if multiplayer gaming is denied. This restriction is deprecated on unsupervised devices.

Deny iBookstore

Denies the store functionality of iBooks. The user will not be able to purchase books from iBooks but can read and open the books that he/she already owns. Available in iOS 6.0 and later. Requires that devices are Supervised.

iBookstore: Deny adult content

Defines if the user will not be able to download adult media content from the iBooks. Available in iOS 6.0 and later.

Deny iTunes Store

Defines if the iTunes Music Store is disabled and its icon is removed from the Home screen. Users cannot preview, purchase, or download content. This restriction is deprecated on unsupervised devices.

Deny iTunes Radio

Defines if the iTunes Radio is disabled and its icon is removed from the users. Available in iOS 9.3 and later. Requires that devices are Supervised.

Deny iMessages

Defines if iMessages are denied. Users can’t send or receive messages using iMessage. If the device supports text messaging, the user can still send and receive text messages. If your device doesn’t support text messaging, the Messages icon is removed from the Home screen. Available in iOS 6.0 and later. Requires that devices are Supervised.

Deny News

Defines if Apple News is denied. Available in iOS 9.0 and later. Requires that devices are Supervised.

Deny Safari

Defines if the Safari web browser is disabled and its icon removed from the Home screen. This also prevents users from opening web clips. This restriction is deprecated on unsupervised devices.

Safari: Disable autofill

Defines if Safari auto-fill is disabled.

Safari: Force fraud warning

Defines if Safari fraud warnings are enabled.

Safari: Disable JavaScript

Defines if JavaScript is disabled in Safari.

Safari: Block popups

Defines if popups are blocked in Safari.

Safari: Accept cookies

Controls when Safari accepts cookies. Possible values are:

  • Never
  • From visited sites
  • Always

Deny Siri

Defines if Siri assistant is disabled.

Siri: Deny user generated content

Prevents Siri from querying user-generated content from the web. Available in iOS 7.0 and later. Requires that devices are Supervised.

Siri: Deny while locked

Defines if the user is unable to use Siri when the device is locked. This restriction is ignored if the device does not have a passcode set. Available in iOS 5.1 and later.

Siri: Force profanity filter

Defines if Siri profanity filter is forced. Requires that devices are Supervised.

Deny system app removal

Defines if system apps can be removed from the device. Available in iOS 11.0 and later. Requires that devices are Supervised.

Deny YouTube

Defines if the YouTube application is disabled and its icon is removed from the Home screen. This restriction is ignored in iOS 6.0 and later because there is no built-in YouTube app.

Device functionality

Deny AirDrop

Defines if AirDrop is denied. Available in iOS 7.0 and later. Requires that devices are Supervised.

Deny AirPrint

Defines if AirPrint is denied. Available in iOS 11.0 and later. Requires that devices are Supervised.

AirDrop: Force unmanaged drop target

Defines if AirDrop is forced to be considered an unmanaged drop target. Available in iOS 9.0 and later.

Deny application installation

Defines if the App Store is disabled and its icon is removed from the Home screen. Users are unable to install or update their applications. This restriction is deprecated on unsupervised devices.

Deny application installation from App Store

Defines if the App Store is disabled and its icon is removed from the Home screen. However, users may continue to use Host apps (iTunes, Apple Configurator) to install or update their apps. Available in iOS 9.0 and later. Requires that devices are Supervised.

Deny application removal

Defines if application removal is denied. This restriction is deprecated on unsupervised devices.

Deny automatic app downloads

Prevents automatic downloading of apps purchased on other devices. Does not affect updates to existing apps. Available in iOS 9.0 and later. Requires that devices are Supervised.

Deny automatic sync while roaming

Denies automatic data synchronization and global background fetch activity when an iOS phone is roaming.

Deny cellular data usage changes for apps

Defines if changes to cellular data usage for apps are denied. Available in iOS 7.0 and later. Requires that devices are Supervised.

Deny definition lookup

Defines if definition lookup is denied. Users can’t double-tap to search for a word’s definition. Available in iOS 8.1.3 and later. Requires that devices are Supervised.

Deny Handoff

Defines if users can’t use Handoff with their Apple devices.

Deny host pairing

Defines if host pairing is disabled with the exception of the supervision host. If no supervision host certificate has been configured, all pairing is disabled.  The users can’t pair their iOS device with anything but the Mac with Apple Configurator installed, where the device was first supervised. Available in iOS 7.0 and later. Requires that devices are Supervised.

Deny in-app purchase

Defines if in-app purchases are denied.

Deny installing configuration profiles

Defines if configuration profiles can’t be manually installed by users. Available in iOS 6.0 and later. Requires that devices are Supervised.

Deny Internet search results in Spotlight

Defines if Spotlight won’t return any results from an Internet search. Requires that devices are Supervised.

Deny keyboard auto-correction

Defines if keyboard auto-correction is denied. Available in iOS 8.1.3 and later. Requires that devices are Supervised.

Deny keyboard prediction

Defines if keyboard prediction is denied. Available in iOS 8.1.3 and later. Requires that devices are Supervised.

Deny keyboard shortcuts

Denies keyboard shortcuts. Available in iOS 9.0 and later. Requires that devices are Supervised.

Deny keyboard spellcheck

Defines if keyboard spellcheck is denied. Available in iOS 8.1.3 and later. Requires that devices are Supervised.

Deny lock screen Control Center

Prevents Control Center from appearing on the Lock screen. Users can’t swipe up to view Control Center. Available in iOS 7.0 and later.

Deny lock screen Notification Center

Denies Notifications view in Notification Center. Users can’t receive notifications if the screen is locked. Available in iOS 7.0 and later.

Deny lock screen Passbook notifications

Defines if Passbook notifications will not be shown on the lock screen.  Available in iOS 6.0 and later.

Deny lock screen Today View

Denies Today view in Notification Center. Users can’t swipe down to see Notification Center using the Today View in the Lock screen. Available in iOS 7.0 and later.

Deny paired Apple Watch

Denies pairing with an Apple Watch. Any currently paired Apple Watch is unpaired and erased. Available in iOS 9.0 and later. Requires that devices are Supervised.

Deny podcasts

Defines if podcasts are denied. Users can’t download podcasts. Available in iOS 8.0 and later. Requires that devices are Supervised.

Deny restriction configuration

Defines if the users can’t set their own restrictions on their device. NOTE: This restriction disables the whole “Screen time” -option in iOS 12 and newer devices. Requires that devices are Supervised.

Deny screen capture

Defines if capturing a screen shot is denied. Users are unable to save a screenshot of the display. For iOS 9.0 devices, users are also prevented from capturing a screen recording.

Force delayed software updates

Defines if the user visibility of iOS updates are delayed. Available in iOS 11.3 and later. Requires that devices are Supervised.

Software update delay time

Defines the number of days (1-90) that iOS update visibility is delayed. Available in iOS 11.3 and later. Requires that devices are Supervised.

Deny voice dialing

Denies voice dialing if the device is locked with a passcode.

Security and Privacy

Deny account modification

Defines if account modification is denied. Available in iOS 7.0 and later. Requires that devices are Supervised.

Deny automatic updates to certificate trust settings

Denies automatic updates to certificate trust settings. Over-the-air PKI updates are disabled. Does not disable CRL and OCSP checks. Available in iOS 7.0 and later.

Deny device name modification

Denies changes to the device name. Available in iOS 9.0 and later. Requires that devices are Supervised.

Deny diagnostic data upload

Defines if the device is prevented from automatically submitting diagnostic reports to Apple. Available in iOS 6.0 and later.

Deny documents from managed sources in unmanaged destination

Defines if documents created or downloaded from managed sources (apps and accounts) can’t be opened in unmanaged destinations. Available in iOS 7.0 and later.

Deny documents from unmanaged sources in managed destination

Defines if documents created or downloaded from unmanaged sources (apps and accounts) can’t be opened in managed destinations. Available in iOS 7.0 and later.

Deny enterprise app trust

Denies trusting of enterprise applications. Available in iOS 9.0 and later. Requires that devices are Supervised.

Deny erase all content and settings

Disables the “Erase All Content And Settings” option in the Reset UI. Users can’t erase their device and reset it to factory defaults. Requires that devices are Supervised.

Deny Find My Friends setting modification

Defines if changes to Find My Friends settings are denied. Available in iOS 7.0 and later. Requires that devices are Supervised.

Deny fingerprint unlock

Defines if fingerprint unlock is denied. Users must use a passcode to unlock the device. Available in iOS 7.0 and later.

Deny notification modification

Defines if changes to the notification settings are denied. Available in iOS 9.3 and later. Requires that devices are Supervised.

Deny passcode modification

Denies device passcode from being added, changed, or removed. Available in iOS 9.0 and later. Requires that devices are Supervised.

Deny proximity setup to new device

Defines if the prompt to set up nearby new devices is available. Available in iOS 11.0 and later. Requires that devices are Supervised.

Deny untrusted TLS certificates

Defines if untrusted TLS certificates are denied. The device automatically rejects untrusted HTTPS certificates without prompting the user. Available in iOS 5.0 and later.

Deny VPN creation

Defines if VPN configuration creation is denied. Available in iOS 11.0 and later. Requires that devices are Supervised.

Deny wallpaper modification

Denies changes to the wallpaper. Available in iOS 9.0 and later. Requires that devices are Supervised.

Force AirPlay pairing password

Defines if AirPlay pairing password is forced. Available in iOS 7.1 and later.

Force Apple Watch wrist detection

Defines wrist detection is forced when using Apple Watch. Apple Watch locks automatically when it’s removed from the user’s wrist. It can be unlocked with its passcode or the paired iPhone. Available in iOS 8.2 and later.

Force encrypted backups

Defines if all backups are encrypted.

Force user to enter iTunes Store password for all purchases

Forces user to enter their iTunes Store password for each transaction. Available in iOS 5.0 and later

Force limited ad tracking

Defines if limited ad tracking for apps is forced. Available in iOS 7.0 and later.

Force Wi-Fi whitelisting

Defines if the user is able to add Wi-Fi networks manually. If enabled, the device can only connect to MDM deployed Wi-Fi networks. Available in iOS 10.3 and later. Requires that devices are Supervised.

Allowed Single App Mode apps

Allows apps identified by the bundle identifiers listed in the array to autonomously enter Single App Mode. Type the desired bundle identifier, for example. com.company.app and click Add to insert application to the white list. Available in iOS 7.0 and later. Requires that devices are Supervised.

ICloud

Deny backup

Defines if backing up the device to iCloud is denied. Available in iOS 5.0 and later

Deny document sync

Defines if document and key-value syncing to iCloud is disabled. This restriction is deprecated on unsupervised devices. Available in iOS 5.0 and later.

Deny enterprise book backup

Defines if users can’t back up books distributed by their organization to iCloud or iTunes.

Deny enterprise book metadata sync

Defines if metadata synchronization to iCloud is denied for Enterprise books. Users can’t sync notes or highlights to other devices using iCloud.

Deny keychain sync

Denies keychain synchronization to iCloud. Available in iOS 7.0 and later.

Deny managed apps sync

Defines if users can’t store data from managed apps in iCloud.

Deny Photo Library

Defines if iCloud Photo Library is denied. Any photos not fully downloaded from iCloud Photo Library to the device will be removed from local storage. Available in iOS 9.0 and later.

Deny Photo Stream

Defines if iCloud Photo Stream is disabled. Note that disallowing can cause data loss. Available in iOS 5.0 and later.

Deny shared Photo Stream

Defines if shared Photo Stream is denied. Users can’t subscribe to or publish shared photo streams. Available in iOS 6.0 and later.

Media content

Rating region

Defines rating region for media content restrictions. Possible values are:

  • Australia
  • Canada
  • France
  • Germany
  • Ireland
  • Japan
  • New Zealand
  • United Kingdom
  • United States

Allowed app rating

Defines allowed rating for applications. Possible values are:

  • Don’t allow apps
  • 4+
  • 9+
  • 12+
  • 17+
  • Allow all apps

This applies to all regions.

Allowed movie rating

Defines allowed rating for movies. Possible values depend on the chosen rating region.

Allowed TV show rating

Defines allowed rating for TV shows. Possible values depend on the chosen rating region.

Deny explicit content

Denies explicit music or video content purchased from the iTunes Store. Explicit content is marked as such by content providers, such as record labels, when sold through the iTunes Store. This restriction is deprecated on unsupervised devices.

More information:

About restrictions

About configuration profiles

Creating a configuration profile

Deploying a configuration profile

Removing deployed configuration profiles

Get started with Miradore

Start securing your devices and data today with Miradore. Create a site in just a few minutes and start adding devices immediately. You can get started for free and try out the full features with our 14-day Enterprise trial.

No credit card needed.

SIGN UP FOR MIRADORESEE PLANS AND PRICING