Description
Apple provides a minimal web content filter for both iOS/iPadOS and macOS which can be enabled through a configuration profile in Jamf School.
Blocking and Permitting URLs Resources
Apple's complete documentation on the payload can be found here. The most relevant behavior is summarized below:
When Automatic Filtering is enabled the Permitted URLs field does not operate as a safelist (only allowing sites in the list), it exists only to allow websites that are categorized as "Adult" but need to be allowed.
The system matches URLs using string-based matching. A URL matches an allow list, deny list, or permitted list pattern if the exact characters of the pattern appear as a substring of the URL requested in the web browser.
For example, if the system doesn’t allow
test.com/a, it blockstest.com/a,test.com/apple, andtest.com/a/b
The system matches list entries that terminate with a
/character explicitly;if the system blocks or allows
test.com/a/, it blocks or allowstest.com/aandtest.com/a/b
Matching discards a
wwwsubdomain prefix if present.So if the system doesn’t allow
www.test.com, it also blocksm.test.com
All filtering options are active simultaneously. The system only permits URLs and sites that pass all rules.
Enabling the Web Content Filter Profile in Jamf School
We highly recommend testing on a small group of devices first before adding all student and teacher devices.
iOS/iPadOS Profile
iOS/iPadOS Profile
To create the web content filter device profile for managed iOS and iPad OS devices:
In Jamf School, navigate to Profiles > Overview.
In the upper right hit the button for Create Profile.
Select iOS for your deployment Platform and Device for the enrollment type.
The Web Content filter payload for iOS requires supervision so it must be deployed with the "Device" enrollment type.
Give your profile a name and description and click Finish.
Under the iOS Payload (Supervised only) section, select the Web Content Filter payload, and click Configure.
Check the box for Enable web content filter
By default the filter types is set to "Limit adult content and blocklist websites"
The Automatic filtering is also enabled by default, this is functionality that is baked into the OS by Apple and little information about how it works is available so results may vary.
Click Scope and use the + button to add desired device groups to the Scope.
Click Save.
With that you have now deployed the most basic configuration of a web content filter for iOS devices in Jamf School.
macOS Profile
macOS Profile
To enable the built in web content filter for macOS:
In Jamf School, navigate to Profiles > Overview.
In the upper right hit the button for Create Profile.
Select macOS for your deployment Platform and Device for the enrollment type.
macOS requires the "Device" enrollment type for use of the built in web content filter.
Give your profile a name and description and click Finish.
Under the macOS payload section, select the Parental Controls payload, and click Configure.
Under the Content Filtering tab for this payload, check the box for Limit Access to Websites.
The default behavior of the configuration is for the device to try and automatically limit adult content.
Click Scope and use the + button to add the desired computer groups to the Scope
Click Save.
With that you have now deployed the most basic configuration of a web content filter for macOS devices in Jamf School.
Customized Content Filtering Resources
The built-in content filter is limited in how much it can be customized. Apple lists the different options for filtering content on iOS/iPadOS & macOS in the Apple Platform Deployment Documentation.
If you need more customization than the built-in filter, it will be necessary to find an additional filter/solution. Inside the Jamf ecosystem there is Jamf Safe Internet which is a fully fledged web content filter, and because of its tight integration with Jamf School it is easy to deploy. The video below provides an overview.