Description
Jamf Pro supports a number of restrictions for iPad, iPhone, and Apple TV that can help you keep your data secure and your users on task.
Understanding Mobile Device Restrictions
Some restrictions require supervising the device; these are indicated with a
icon. To learn more about supervising devices, see Supervision.
Note: If the same restriction is in multiple profiles with differing settings, the more restrictive setting will apply.
Restriction | Description | iPad | iPhone | Apple TV |
Apps |
|
|
|
|
Installing apps using Apple Configurator and iTunes | Users cannot install or update iPad or iPhone apps using any method other than Jamf Pro. The App Store app is disabled and its icon is removed from the Home screen. Supervision required. | X
| X
|
|
Installing apps using App Store (Installing apps using Apple Configurator and iTunes) | Users cannot install or update iPad or iPhone apps except using Apple Configurator, iTunes, and Jamf Pro. The App Store app is disabled and its icon is removed from the Home screen. Supervision required. | X
| X
|
|
Automatic app downloads
(Installing apps using Apple Configurator and iTunes) | Disables automatic app downloads for apps purchased on another device with the same iCloud account. Supervision required. | X
| X
|
|
Removing apps | Disables the ability to remove apps from iPad or iPhone. Supervision required. | X
| X
|
|
Removing system apps | Disables the ability to remove default system apps (Safari, Calendar, Mail, etc.) from iPad or iPhone. Supervision required. | X
| X
|
|
iTunes Store | The iTunes Store app is disabled and its icon is removed from the Home screen. Users cannot preview, purchase, or download content. Supervision required. | X
| X
|
|
Book Store and Audiobooks in the Books app | Disables the Book Store in the Books app. Users cannot preview, purchase, or download books. Supervision required. | X
| X
|
|
Apple Music | Disables the Apple Music streaming service on iPad or iPhone. Supervision required. | X
| X
|
|
Apple Music Radio | Disables the Apple Music Radio service on iPad and iPhone. Supervision required. | X
| X
|
|
News | Disables the News app and removes its icon from the Home screen. Supervision required. | X
| X
|
|
Podcasts | Disables the Podcasts app and removes its icon from the Home screen. Supervision required. | X
| X
|
|
Game Center | Disables the Game Center app and removes its icon from the Home screen. Supervision required. | X
| X
|
|
Multiplayer gaming (Game Center) | Prohibits multiplayer gaming. Supervision required. | X
| X
|
|
Adding Game Center friends
(Game Center) | Prohibits adding friends to Game Center. Supervision required. | X
| X
|
|
In-app purchasing | Prevents In-App purchasing in apps on iPad or iPhone. | X | X |
|
iTunes Store password for all purchases | Forces the user to enter their iTunes password for each transaction. Deprecated in iOS 17 and later. | X
| X
|
|
Use of Safari | Disables the Safari app and removes its icon from the Home screen. This also prevents users from opening web clips that are not in full screen mode. Supervision required. | X
| X
|
|
AutoFill
(Use of Safari) | Disables auto-fill of usernames, passwords, addresses, etc. within Safari. Supervision required. | X
| X
|
|
Fraud Warning
(Use of Safari) | Enables Safari fraud warning. Supervision required. | X
| X
|
|
JavaScript
(Use of Safari) | Disables executing JavaScript within Safari. This will make many websites unusable. Supervision required. | X
| X
|
|
Deprecated WebKit TLS 1.0/1.1 in Safari
(Use of Safari) | If Allowed, the deprecated TLS 1.0/1.1 behavior in Safari is allowed. Available in iOS 13.4 and later. Supervision required. | X
| X
|
|
Pop-ups
(Use of Safari) | If enabled, Safari doesn’t allow pop-up windows. Supervision required. | X
| X
|
|
Cookies
(Use of Safari) | Defines the conditions under which the device accepts cookies. Always Blocked: Enables Prevent Cross-Site Tracking and Block All Cookies, and the user canʼt disable either setting. Only allowed from current website: Enables Prevent Cross-Site Tracking, and the user canʼt disable it. Doesn’t enable Block All Cookies, but the user can enable it. Allowed from websites I visit: Enables Prevent Cross-Site Tracking but doesn’t enable Block All Cookies. The user can toggle either setting. | X
| X
|
|
App usage | When enabled, device only shows or can launch apps with bundle IDs in the array. Include the value Some apps not allowed Only some apps allowed | X
| X
|
|
Autonomous Single App Mode apps | When enabled, allows apps identified by the bundle IDs listed in the array to autonomously enter Single App Mode. Supervision required. | X
| X
|
|
Functionality |
|
|
|
|
Use of camera | Disables the Camera app and removes its icon from the Home screen on iPad or iPhone. This also disables all other camera functionality in all iPad and iPhone apps. Users are unable to take photos or video. Supervision required. | X
| X
|
|
FaceTime (Use of camera) | Disables the FaceTime app and removes its icon from the Home screen. Supervision required. | X
| X
|
|
Screenshots and screen recording | Prevent users from taking screenshots or screen recordings on iPad and iPhone. | X | X |
|
AirPlay, screen observation by Classroom, and screen sharing
(Screenshots and screen recording) | Disables remote screen observation by the Classroom app. Supervision required. | X
| X
|
|
Classroom to perform AirPlay and screen observation without prompting
(Screenshots and screen recording) | If Allowed and if "AirPlay, screen observation by Classroom, and screen sharing" is also Allowed, a student enrolled in a managed course through the Classroom app automatically gives permission to that course teacher’s requests to observe the student’s screen without prompting the student. Supervision required. | X
| X
|
|
AirPlay incoming request | Disables incoming AirPlay requests. Supervision required. | X
| X
|
|
Passcode on incoming AirPlay pairing requests (AirPlay incoming request) | Forces all devices sending AirPlay requests to this device to use a pairing password. | X | X |
|
Pairing TV with Remote app | Disables pairing Apple TV for use with the Remote app or Control Center widget. Supervision required. | X
| X
|
|
AirDrop | Disables AirDrop file sharing on iPad and iPhone. Supervision required. Note: This will also disable the "NameDrop" and "Bringing Devices Together" Features. | X
| X
|
|
Messages | Disables the Messages app and removes its icon from the Home screen. If the device has cellular capabilities, the Messages app will stay installed for SMS accessibility. Supervision required. | X
| X
|
|
Voice dialing while device is locked | Disables voice dialing when iPad and iPhone are locked. | X | X |
|
Siri | Disables the use of Siri on iPad and iPhone. If the restriction is turned off, Siri will remain off until users turn it back on. | X | X |
|
Siri while device is locked | Disables Siri on iPad and iPhone when locked with a passcode. This is ignored if the device does not have a passcode. | X | X |
|
User-generated content in Siri | Disables user-generated content (like Wikipedia.org) from Siri responses on iPad and iPhone. | X
| X
|
|
Connections to Siri servers to help improve Siri and Dictation | Disables connections to Siri servers for the purposes of dictation. | X | X |
|
Connections to Siri servers for the purpose of translation | If Restricted, the device won’t connect to Siri servers for the purposes of translation. | X | X |
|
Profanity filter assistant | Filters profanity from Siri responses on iPad and iPhone. Supervision required. | X
| X
|
|
Siri Suggestions | Disables Spotlight Internet search results in Siri Suggestions. | X
| X
|
|
New devices setup proximity prompt | Disables the prompt to set up new devices that are nearby. | X
| X
|
|
iCloud backup | Disables device backups to iCloud on iPad or iPhone. Supervision required. | X
| X
|
|
iCloud documents & data | Disables syncing document and app data to iCloud on iPad, iPhone, and Mac. Supervision required. | X
| X
|
|
iCloud keychain | Disables syncing the Keychain to iCloud on iPad, iPhone, and Mac. Supervision required. | X
| X
|
|
iCloud Private Relay | Disables iCloud Private Relay. Supervision required. | X
| X
|
|
Managed apps can use iCloud sync | If Restricted, prevents managed apps from using iCloud sync. | X | X |
|
Shared Photo Stream | Disables the iCloud Shared Photo Stream service on iPad and iPhone. | X | X |
|
iCloud Photo Library | Disables the iCloud Photo Library service on iPad and iPhone. | X | X |
|
My Photo Stream | Disables the iCloud Photo Stream service on iPad and iPhone. | X | X |
|
Backup of enterprise books | Disables backup of Enterprise books. | X | X |
|
Notes and highlights sync for enterprise books | Disables sync of Enterprise books, notes, and highlights. | X | X |
|
Encrypted backups | Requires that all backups be encrypted on iPad and iPhone. | X | X |
|
Mail Privacy Protection | Disables Mail Privacy Protection on the device. | X
| X
|
|
Automatic sync while roaming | Disables background fetch activity for email, apps, etc. when roaming on iPad and iPhone. | X | X |
|
Limited ad tracking | Limits ad tracking with Apple’s ad platform on iPad and iPhone. | X | X |
|
Apple personalized advertising | Limits Apple personalized advertising. | X | X |
|
Erase all content and settings | Disables the “Erase All Content and Settings” option in the Settings app on iPad and iPhone. Supervision required. | X
| X
|
|
Users to accept untrusted TLS certificates | Automatically reject untrusted HTTPS certificates on iPad and iPhone without prompting the user. | X | X |
|
Automatic updates to certificate trust settings | Prevents automatic updates to certificate trust settings. | X | X |
|
Trusting new enterprise app authors | When Restricted, users can’t allow new enterprise apps authors to be trusted, which prohibits apps from those authors from opening. | X | X |
|
Adding VPN configurations | Prevents configuring a VPN connection on iPad and iPhone. | X | X |
|
Shared iPad (device) temporary session | Makes temporary sessions unavailable on Shared iPad. | X | X |
|
Let teachers use the Classroom app to lock student devices without prompting | Allows the teacher to lock apps or the device without prompting the student. | X
| X
|
|
Teacher permission to leave Classroom unmanaged classes | Requires that a student enrolled in an unmanaged course through Classroom needs to request permission from the teacher to leave the course. | X
| X
|
|
Automatically join Classroom classes without prompting | Automatically gives permission to the teacher’s requests to join class without prompting the student. | X
| X
|
|
Installing configuration profiles | Prevents installing a configuration profile, such as via a web browser or AirDrop, on iPad and iPhone. Supervision required. | X
| X
|
|
Modifying account settings | Prevents adding, removing, or modifying accounts on iPad or iPhone. This includes email settings, calendar settings, Messages and FaceTime settings, and can prevent signing in or out of the Apple ID currently on the device. This does not affect the account logins for third party apps like Google, Microsoft, or social media. Supervision required. | X
| X
|
|
Modifying Bluetooth settings | Prevents changing Bluetooth settings on iPad and iPhone. Supervision required. | X
| X
|
|
Modifying cellular plan | Prevents users from changing settings related to their cellular plan. Supervision required. | X
| X
|
|
Modifying cellular data app settings | Prevents changing the cellular data access settings for apps on iPad and iPhone. Supervision required. | X
| X
|
|
Modifying eSIM settings | Prevents modifications to carrier plan related settings (only available on select carriers). Supervision required. | X
| X
|
|
Find My Device | Disables the Find My Device app. Requires iOS 13 or later. Supervision required. | X
| X
|
|
Find My Friends | Disables the Find My Friends app. Requires iOS 13 or later. Supervision required. | X
| X
|
|
Modifying Find My Friends settings | Prevents changing the Find My Friends settings on iPad and iPhone. Supervision required. | X
| X
|
|
Modifying notifications settings | Prevents changing notification settings on iPad and iPhone. Supervision required. | X
| X
|
|
Screen Time | For devices with iOS 12 or later, this disables the "Enable Screen Time" option in the Screen Time section in the Setting app, and disables Screen Time if already enabled. Supervision required. For devices with iOS 11 or earlier, this disables the “Enable Restrictions” option in the Settings app. Supervision required. | X
| X
|
|
Modifying wallpaper | Prevents the wallpaper from being changed on iPad and iPhone. Supervision required. | X
| X
|
|
Modifying personal hotspot settings | Prevents changes to Personal Hotspot settings on iPad and iPhone. Requires iOS 12.2 or later. Supervision required. | X
| X
|
|
Pairing with no-supervision configured host | Disables host pairing with the exception of the supervision host. If there’s no configured supervision host certificate, the system disables all pairing. Host pairing lets the administrator control if an iOS device can pair with a host Mac or PC. | X
| X
|
|
Booting into recovery by an unpaired device | Prevents unpaired devices to boot devices into recovery. | X
| X
|
|
Documents from managed sources open in unmanaged destinations | Documents in managed apps and email accounts (deployed by Jamf Pro) only open in other managed apps and email accounts on iPad and iPhone. | X | X |
|
Documents from unmanaged sources open in managed destinations | Documents in unmanaged apps and email accounts will only open in other unmanaged apps and email accounts on iPad and iPhone. | X | X |
|
Pasteboard respects managed/unmanaged document restrictions | Copy and paste functionality conforms to the "Documents from managed sources open in unmanaged destinations" and "Documents from unmanaged sources open in managed destinations" restrictions. | X | X | X |
Managed apps can write contacts to unmanaged contacts accounts | Allows managed apps to write contacts to unmanaged accounts. If "Documents from managed sources open in unmanaged destinations" is Allowed, this restriction has no effect. | X | X | X |
Unmanaged apps to read contacts from managed contacts accounts | Allows unmanaged apps to read from managed contacts accounts. If "Documents from unmanaged sources open in managed destinations" is Allowed, this restriction has no effect. | X | X | X |
AirDrop as unmanaged destination | Airdrop will be treated as an unmanaged destination on iPad and iPhone. | X | X |
|
Handoff | Disables Handoff on iPad and iPhone. | X | X |
|
Near Field Communication (NFC) | Disables Near Field Communication on iPad and iPhone. Supervision required. | X
| X
|
|
Sending diagnostic reports to Apple | Disables iPad and iPhone from automatically sending diagnostic reports to Apple. | X | X |
|
Modifying diagnostics settings | Disables changing the diagnostic submission and app analytics settings in the Diagnostics & Usage UI in Settings. Supervision required. | X
| X
|
|
Touch ID/Face ID to unlock device | Prevents Face ID and Touch ID from being used to unlock iPad and iPhone. | X | X |
|
Modifying passcode | Prevents adding, removing, or changing the passcode on iPad and iPhone. Supervision required. | X
| X
|
|
Modifying Touch ID/Face ID | Prevents the user from modifying Touch ID or Face ID. Supervision required. | X
| X
|
|
Password AutoFill | Prevents the AutoFill Passwords feature on iPad and iPhone. Requires iOS 12 or later. Supervision required. | X
| X
|
|
Touch ID or Face ID authentication before AutoFill | If Required, the user needs to authenticate before the system can autofill passwords or credit card information in Safari and apps. If this restriction isn’t Required, the user can toggle this feature in Settings. Only supported on devices with Face ID or Touch ID. Supervision required. | X
| X
|
|
AirDrop Passwords | Prevents users from sharing their passwords with Airdrop Passwords feature. Requires iOS 12 or later. Supervision required. | X
| X
|
|
Proximity based password sharing requests | Prevents devices from requesting passwords from nearby devices. Requires iOS 12 or later, macOS 10.14 or later, or tvOS 9 or later. Supervision required. | X
| X
| X
|
Passcode on outgoing AirPlay pairing requests | If Required, the system forces all devices receiving AirPlay requests from this device to use a pairing password. Available in iOS 7.1 and later. | X | X |
|
Apple Watch wrist detection | Requires any paired Apple Watch to use wrist detection to lock when the user takes it off. |
| X |
|
Pairing with Apple Watch | Disables pairing an Apple Watch with an iPhone. Supervision required. Warning: This also unpairs and erases any currently paired Apple Watch. |
| X
|
|
Connection to unmanaged Wi-Fi networks | Only allow iPad and iPhone to connect to Wi-Fi networks configured by Jamf Pro. Supervision required. | X
| X
|
|
Wi-Fi power off | Prevents turning off Wi-Fi in Settings or Control Center, even by entering or leaving Airplane Mode. It doesn’t prevent selecting which Wi-Fi network to use. Supervision required. | X
| X
|
|
AirPrint | Disables AirPrint printing on iPad, iPhone, and Mac. Supervision required. | X
| X
|
|
AirPrint to destinations with untrusted certificates | Requires trusted certificates for TLS printing communication. Supervision required. | X
| X
|
|
Discovery of AirPrint printers using iBeacons | If Restricted, the system disables iBeacon discovery of AirPrint printers, which prevents spurious AirPrint Bluetooth beacons from phishing for network traffic. Supervision required. | X
| X
|
|
Storage of AirPrint credentials in Keychain | If Restricted, the system disables keychain storage of user name and password for AirPrint. Supervision required. | X
| X
|
|
Predictive keyboard | If Restricted, the system disables predictive keyboards. Supervision required. | X
| X
|
|
Keyboard shortcuts | If Restricted, the system disables keyboard shortcuts. Supervision required. | X
| X
|
|
QuickPath keyboard | Disables the QuickPath Keyboard. Requires iOS 13 or later. Supervision required. | X
| X
|
|
Auto-correction | If Restricted, the system disables keyboard autocorrection. Supervision required. | X
| X
|
|
Spell-check | If Restricted, the system disables the keyboard spell checker. Supervision required. | X
| X
|
|
Definition lookup | If Restricted, the system disables definition lookup. Supervision required. | X
| X
|
|
Dictation | If Restricted, the system disallows dictation input. Supervision required. | X
| X
|
|
Wallet notifications on the Lock Screen | Disables Apple Wallet notifications from displaying when iPad and iPhone are locked. | X | X |
|
Control Center on the Lock Screen | Disables the Control Center from displaying when iPad and iPhone are locked. | X | X |
|
Notifications history view on the Lock Screen | Disables notifications from displaying in the Notifications history view when an iPad or iPhone is locked. New notifications remain visible when they arrive. | X | X |
|
Today view on the Lock Screen | Disables the Today view in the notification center when iPad and iPhone are locked. | X | X |
|
USB restricted mode | If Restricted, the system prevents iOS devices from connecting to USB accessories while locked. Supervision required. | X
| X
|
|
USB drive access in Files app | Prevents the Files app from accessing files on USB drives. Requires iOS 13 or later. Supervision required. | X
| X
|
|
Network drive access in Files app | Prevents the Files app on iPad and iPhone from accessing files on Network drives. Requires iOS 13.1 or later, or iPadOS 13.1 or later. Supervision required. | X
| X
|
|
Modifying device name | Prevents changing the name of iPad, iPhone, or Apple TV. Supervision required. | X
| X
| X
|
Automatic date and time | Forces iPad, iPhone, and Apple TV to keep up-to-date date and time. Requires iOS 12 or later, and tvOS 9 or later. Supervision required. | X
| X
| X
|
Defer software update | How many days to delay a software update on the device. With this restriction in place, the user doesn’t see a software update until the specified number of days after the software update release date. Supervision required. | X
| X
| X
|
Rapid Security Response install | If Restricted, the system prohibits installation of rapid security responses. | X | X |
|
Rapid Security Response removal | If Restricted, the system prohibits removal of rapid security responses. | X | X |
|
Device sleep | If Restricted, the system prevents the device from automatically sleeping. Available in tvOS 13 and later. Supervision required. |
|
| X
|
Automatic screen saver | If Restricted, the system disables Apple TV’s automatic screen saver. Available in tvOS 15.4 and later. |
|
| X |
App Clips | If Restricted, the system prevents a user from adding any App Clips, and removes any existing App Clips on the device. Available in iOS 14.0 and later. Supervision required. | X
| X
|
|
iPhone widgets on Mac | If Restricted, the system disallows iPhone widgets on a Mac that has signed in the same Apple ID for iCloud. Supervision required. |
| X
|
|
Media Content |
|
|
|
|
Rating region | The region that profile tools use to display the proper ratings for the given region. The client doesn’t recognize or report this data. | X | X | X |
Allowed content rating for movies | The maximum level of movie content allowed on the device. Available in iOS 4 and later, and tvOS 11.3 and later. Supervision required. | X
| X
| X
|
Allowed content rating for TV shows | The maximum level of TV content allowed on the device. Available in iOS 4 and later, and tvOS 11.3 and later. Supervision required. | X
| X
| X
|
Allowed content rating for apps | The maximum level of app content allowed on the device. Preinstalled (first party) apps ignore this restriction. Available in iOS 4 and later, and tvOS 11.3 and later. Supervision required. | X
| X
| X
|
Playback of explicit music, podcasts, and iTunes | Prevents purchasing or previewing explicit content in iTunes Store on iPad, iPhone, or Apple TV. Supervision required. | X
| X
| X
|
Erotica content in Apple Books | If Restricted, the system prevents the user from downloading Apple Books media that’s tagged as erotica. Available in iOS 6 and later, and tvOS 11.3 and later. Supervision required. | X
| X
| X
|
More Resources
Apple's Documentation on Restrictions: