Restrictions help administrators manage devices according to their organization's policies.
The Restrictions configuration profile allows you to control certain applications or features of your users' Mac devices. See our Restrictions article for a generic overview of the Restrictions configuration profile.
Create a Restrictions configuration profile for macOS devices
- Navigate to Management > Configuration profiles and select Add.
- Select macOS, then select Next.
- Select Restrictions, then select Next.
- Select the options you want to apply to the devices by their checkboxes, then select Next.
Note: Different restrictions are available under different tabs in the wizard. For more information on each option, see Configuration profile settings. - Enter a name and description for your configuration profile, then select Create.
- Deploy the configuration profile to the managed iOS devices.
You can monitor the progress of the configuration profile deployment either on the Management > Action log page or on the individual device’s Device page available under Management > Devices.
Configuration profile settings
The tables below show the settings available on the specific tabs of the Restrictions configuration profile creation wizard.
Applications
| Setting | Description | Required macOS version |
|---|---|---|
| Deny Camera | The camera is completely disabled. Users are unable to take photos and videos or use, for example, the Photo Booth app with a built-in web camera. | macOS 10.11 or later |
| Deny Game Center | Game Center account configuration is denied. | macOS 10.13 or later |
| Game Center: Deny adding friends | Adding friends to Game Center is denied. | macOS 10.13 or later |
| Game Center: Deny multiplayer gaming | Multiplayer gaming is denied. | macOS 10.13 or later |
| Deny iTunes file sharing | Using iTunes application file-sharing services are denied. | macOS 10.13 or later |
| Deny Safari auto-fill | Using AutoFill for passwords, contact information, and credit card information is disabled in Safari. If enabled, this option also prevents the use of Keychain for autofilling information. Third-party password managers are allowed and other apps can use autofill. | macOS 10.13 or later |
| Deny Siri | Siri is disabled. | macOS 14 or later |
| Siri: Deny external intelligence integrations | The use of external, cloud-based intelligence services with Siri is denied. | macOS 15.2 or later |
| Siri: Deny signing in to external intelligence integrations | External intelligence providers are forced into anonymous mode. If users are already signed in to an external intelligence provider, they are signed out at the next request attempt. | macOS 15.2 or later |
| Siri: Deny Notes transcription summary | Transcription summary in the Notes app is denied. | macOS 15.2 or later |
Device functionality
| Setting | Description | Required macOS version |
|---|---|---|
| Deny AirDrop | Using AirDrop is denied. | macOS 10.13 or later |
| Deny content caching | Content caching is disabled. | macOS 13.1 or later |
| Deny definition lookup | Definition lookup is denied. Users cannot double-click to search for a word’s definition. | macOS 10.11.2 or later |
| Deny Dictation | The use of dictation input is denied. | macOS 10.13 |
| Deny Handoff | Using the Handoff clipboard is denied. | macOS 10.10 or later |
| Deny Internet search results in Spotlight | Spotlight internet search results are disabled in Siri suggestions. | macOS 10.11 or later |
| Deny modification of media sharing settings | The modification of media sharing settings is denied. | macOS 15.1 or later |
| Deny music service | The Music service is disabled and the Music app reverts to classic mode. | macOS 10.12 or later |
| Deny iPhone mirroring | Using iPhone Mirroring with the device is denied. | macOS 15 or later |
| Force bypass screen capture alert | Screen capture alerts are not shown. | macOS 15.1 or later |
| Force no permission prompt to Classroom teacher's requests | Permission is automatically given to the Classroom teacher's request without prompting the student. | macOS 10.14.4 or later |
| Force no prompting when Classroom teacher locks apps or the device | The teacher is allowed to lock apps or the device without prompting the student. | macOS 10.14.4 |
| Force requesting permission to leave Classroom course | Forces students enrolled in unmanaged Classroom courses to get the teacher's approval to leave the course. | macOS 10.14.4 |
| Force unprompted Classroom screen observation | The student's device automatically gives permission to the course teacher's request to observe their screen without prompting the student. | macOS 10.14.4 |
Security and privacy
| Setting | Description | Required macOS version |
|---|---|---|
| Deny auto unlock | Auto-unlock is denied. | macOS 10.12 or later |
| Deny diagnostic data upload | Prevents the device from automatically submitting diagnostic reports to Apple. | macOS 10.13 or later |
| Deny erase all content and settings | The Erase All Content And Settings option in the Reset UI is disabled. Users are unable to erase their device and reset it to factory default settings. | macOS 12 or later |
| Deny fingerprint unlock | Fingerprint unlock is denied. Users must use a passcode to unlock the device. | macOS 10.12.4 or later |
| Deny passcode modification | Adding, changing, or removing the device passcode is denied. | macOS 10.13 or later |
| Deny password auto-fill | The use of the AutoFill Passwords feature using keychain or a third-party password manager is disabled. When denied, the user is not prompted to use a saved password in Safari or other apps. Additionally, strong password suggestion and automatic strong passwords are disabled. | macOS 10.14 or later |
| Deny password proximity requests | The device is prevented from requesting passwords from nearby devices. | macOS 10.14 or later |
| Deny password sharing | Sharing passwords with AirDrop is denied. | macOS 10.14 or later |
| Deny wallpaper modification | Changing the device's wallpaper is denied. | macOS 10.13 |
iCloud
| Setting | Description | Required macOS version |
|---|---|---|
| Deny address book | Using Address Book services is denied. | macOS 10.12 or later |
| Deny bookmarks | Synchronizing Bookmarks using iCloud is denied. | macOS 10.12 or later |
| Deny calendar | Using iCloud Calendar services is denied. | macOS 10.12 or later |
| Deny desktop and documents | Using iCloud Desktop and Document services is denied. | macOS 10.12.4 or later |
| Deny document sync | Document and key-value synchronization to iCloud is denied. | macOS 10.11 or later |
| Deny keychain sync | Keychain synchronization to iCloud is denied. | macOS 10.12 or later |
| Deny mail | Using iCloud Mail services is denied. | macOS 10.12 or later |
| Deny notes | Using iCloud Notes services is denied. | macOS 10.12 or later |
| Deny Photo Library | Using iCloud Photo Library is denied. Any photos not fully downloaded from iCloud Photo Library to the device are removed from local storage. | macOS 10.12 or later |
| Deny reminders | Using iCloud Reminder services are denied. | macOS 10.12 or later |
Update rules
| Setting | Description | Required macOS version |
|---|---|---|
| Force delayed system updates | The visibility of system updates to the user is delayed. If enabled, the following settings become available:
|
macOS 10.13 or later |
| Force delayed major system updates | The visibility of major system updates to the user is delayed. If enabled, the Major system update delay time (1-90 days) option becomes available, which can be used to specify the number of days that must pass after a major system update is released before it appears on the user's device. The number of days can be set from 1 to 90. | macOS 11.3 or later |
| Force delayed application updates | The visibility of application updates to the user is delayed. If enabled, the Application update delay time (1-90 days) option becomes available, which can be used to specify the number of days that must pass after an application update is released before it appears on the user's device. The number of days can be set from 1 to 90. | macOS 11.3 or later |
Apple Intelligence
| Setting | Description | Required macOS version |
|---|---|---|
| Deny Image Playground | Using Image Playground is denied. | macOS 15 or later |
| Deny Mail summary | The manual creation of summaries and email messages is denied. This does not affect automatic summary generation. | macOS 15.1 or later |
| Deny writing tools | Apple Intelligence writing tools are disabled. | macOS 15 or later |
Previous Article:
« Delaying system and application updates on macOS
Next Article:
FileVault disk encryption for macOS »