This Library Item is available for Apple and Android devices
What are Restrictions?
Restrictions are configuration settings that let you control user access to device features, apps, and system settings. The Restrictions Library Item gives you granular control over device functionality, helping you enforce security policies, comply with regulations, and create a tailored user experience across managed devices. Restrictions can control everything from app installation and removal to hardware features like cameras and cellular settings.How Restrictions work
When you apply a Restrictions Library Item to a device through a Blueprint, the configured limitations are enforced at the system level. Restrictions are continuously enforced, meaning users can’t bypass or disable them even if they have administrator privileges on the device. Different restrictions have varying availability across platforms. For Apple devices, many restrictions require devices to be supervised to function properly, as supervised devices provide deeper management capabilities. For Android devices, restrictions are applied at the enterprise level through the Android Management API.- Apple Devices
- Android (Company-Owned Work Profile)
Apple Device Restrictions
Add a Restrictions Library Item
To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the Library Overview article.1
Name the Library Item
Give the new Restrictions Library Item a Name.
2
Select Device Types
In the Install on field, select the device types you want to target (iPhone, iPad, Mac, Apple TV, or Vision).
3
Assign to Blueprints
Assign to your desired Blueprints.
4
Configure Restrictions
Configure the restriction settings based on your organizational requirements (see configuration sections below).
5
Save Configuration
Click Save.
App Store and Application Restrictions
Control how users interact with apps and the App Store on managed devices.App Store Access
- Disallow App Store app installation: Prevents users from installing or updating apps using the App Store. The App Store is disabled and its icon is removed from the Home screen. Available in iOS 4 and later, and visionOS 2.0 and later. Requires supervised device.
- Disallow App Store app installation (Allow iTunes and Configurator): Prevents App Store installation while still allowing host apps like iTunes and Configurator to install apps. Available in iOS 9 and later, and visionOS 2.0 and later. Requires supervised device.
- Disallow marketplace apps (EU): Prevents installation of marketplace apps and marketplace-hosted apps in the European Union. Available in iOS 17.4 and later. Requires supervised device.
- Disallow web-based app installation (EU): Prevents installing apps directly from websites in the European Union. Available in iOS 17.5 and later. Requires supervised device.
App Management
- Disallow app removal: Users cannot remove apps from the device, including marketplace apps in the EU. Available in iOS 4.2.1 and later. Requires supervised device.
- Disallow system app removal: Prevents removal of built-in system apps. Available in iOS 11 and later, and visionOS 2.0 and later. Requires supervised device.
- Disallow apps being locked: Prevents apps from being locked in iOS and iPadOS 18 and later. Also prevents apps from being hidden. Requires supervised device.
- Disallow apps being hidden: Prevents apps from being hidden in iOS and iPadOS 18 and later. Requires supervised device.
App Content and Ratings
- App Store ratings: Manage the maximum level of app content allowed on the device based on age ratings. Non-compliant apps will be unavailable for download or disabled if already installed. Available in iOS 4 and later, macOS 10.15 and later, and tvOS 11.3 and later.
- Disallow App Clips: Prevents users from adding App Clips and removes existing ones. Available in iOS 14.0 and later.
- App allowlist/blocklist: Choose to block specific apps or specify that only listed apps are allowed. Restricted apps are disabled and hidden from the Home screen. Available in iOS 9.3 and later. Requires supervised device.
Security and Authentication Restrictions
Control access to security features and authentication methods.Passcode and Biometric Settings
- Disallow passcode modification: Prevents users from adding, changing, or removing device passcodes (iPhone/iPad) or user account passcodes (Mac). Available in iOS 9 and later, macOS 10.13 and later, and visionOS 2.0 and later.
- Disallow Touch ID and Face ID modification: Prevents modification of biometric authentication settings. Available in iOS 8.3 and later, macOS 14 and later, and visionOS 2.0 and later. Requires supervised device.
- Disallow Touch ID and Face ID for unlock: Prevents biometric authentication from unlocking devices. Available in iOS 7 and later, visionOS 2.0 and later, and macOS 10.12.4 and later.
Lock Screen Controls
- Disallow Control Center on lock screen: Prevents Control Center access from the lock screen. Available in iOS 7 and later.
- Disallow lock screen notifications: Prevents displaying notifications on the lock screen. Available in iOS 7 and later.
- Disallow Today view on lock screen: Hides the Today view in notification center on the lock screen. Available in iOS 7 and later.
- Disallow Wallet notifications on lock screen: Prevents Wallet notifications from appearing on the lock screen. Available in iOS 6 and later.
Communication and Connectivity Restrictions
Manage how devices connect to networks and communicate with other devices.Network Settings
- Force Wi-Fi to remain on: Prevents Wi-Fi from being turned off in Settings or Control Center. Available in iOS 13.0 and later. Requires supervised device.
- Require Wi-Fi configured by profile: Devices can only join Wi-Fi networks configured by a configuration profile. Available in iOS 10.3 and later, visionOS 2.0 and later. Requires supervised device.
- Disallow Bluetooth modification: Prevents users from changing Bluetooth settings. Available in iOS 11 and later, and macOS 13 and later. Requires supervised device.
- Disallow VPN creation: Prevents creation of VPN configurations. Available in iOS 11 and later, visionOS 2.0 and later. Requires supervised device.
Cellular and Communication Features
- Disallow cellular plan modification: Prevents changes to cellular plan settings. Available in iOS 11 and later. Requires supervised device.
- Disallow Live Voicemail: Prevents use of Live Voicemail feature. Available in iOS 17.2 and later. Requires supervised device.
- Disallow RCS messaging: Prevents use of RCS messaging in Messages app. Available in iOS and iPadOS 18.1 and later. Requires supervised device.
- Disallow call recording: Prevents call recording functionality. Available in iOS 18.1 and later. Requires supervised device.
Content and Media Restrictions
Control access to entertainment content and media services.Apple Services
- Disallow Apple Music: Disables the Music service, reverting the Music app to classic mode. Available in iOS 9.3 and later, and macOS 10.12 and later. Requires supervised device for iPhone and iPad.
- Disallow iTunes Store: Disables the iTunes Music Store and removes its icon. Available in iOS 4 and later. Requires supervised device.
- Disallow Apple Books: Disables the Apple Books app. Available in iOS 6 and later. Requires supervised device for iPhone and iPad.
Content Ratings
- Movie ratings: Enforce maximum level of movie content allowed on the device. Available in iOS 4 and later, macOS 10.15 and later, and tvOS 11.3 and later.
- TV show ratings: Enforce maximum level of TV content allowed on the device. Available in iOS 4 and later, macOS 10.15 and later, and tvOS 11.3 and later.
- Explicit content: Hide explicit music or video content from the iTunes Store. Available in iOS 4 and later, macOS 10.15 and later, and tvOS 11.3 and later. Requires supervised device for iPhone and iPad.
System and Hardware Restrictions
Control access to system settings and hardware features.System Modifications
- Disallow software updates: Delays user visibility of software updates. Available in iOS 11.3 and later, macOS 10.13 and later, and tvOS 12.2 and later. Requires supervised device for iPhone and iPad.
- Disallow configuration profile installation: Prohibits interactive installation of configuration profiles and certificates. Available in iOS 6 and later, macOS 13 and later, and visionOS 2.0 and later. Requires supervised device.
- Disallow Erase All Content and Settings: Prevents users from erasing the device. Available in iOS 8, macOS 12, visionOS 2.0, and later. Requires supervised device.
Hardware Features
- Disallow camera: Disables the camera and removes its icon from the Home screen. Available in iOS 4, visionOS 2.0, and macOS 10.11 and later. Requires supervised device for iPhone and iPad.
- Disallow screenshots and screen recording: Prevents capturing screenshots or screen recordings. Available in iOS 4 and later, macOS 10.14.4 and later, visionOS 2.0 and later.
- Disallow AirDrop: Disables AirDrop file sharing. Available in iOS 7, visionOS 2.0 and later, and macOS 10.13 and later. Requires supervised device for iPhone and iPad.
Apple Intelligence and AI Features
Control access to Apple Intelligence features and external AI services.Apple Intelligence Controls
- Disallow Apple Intelligence reports: Prevents submission of Apple Intelligence reports. Available in iOS and iPadOS 18.4 and later, macOS 15.4 and later, and visionOS 2.4 and later. Requires supervised device.
- Disallow Genmoji creation: Prohibits creating new Genmoji. Available in iOS and iPadOS 18 and later, macOS 15 and later, and visionOS 2.4 and later. Requires supervised device.
- Disallow image generation: Prohibits use of image generation features. Available in iOS and iPadOS 18 and later, macOS 15 and later, and visionOS 2.4 and later. Requires supervised device.
- Disallow Writing Tools: Prevents use of Apple Intelligence writing tools. Available in iOS and iPadOS 18 and later, macOS 15 and later, and visionOS 2.4 and later. Requires supervised device.
External Intelligence Services
- Disallow external intelligence with Siri: Prevents use of external, cloud-based intelligence services with Siri. Cannot be used with Shared iPad. Available in iOS 18.2 and later, macOS 15.2 and later, and visionOS 2.4 and later.
- Force external intelligence anonymous mode: Forces external intelligence providers into anonymous mode, signing out already authenticated users. Available in iOS 18.2 and later, macOS 15.2 and later, and visionOS 2.4 and later.