Skip to main content
This Library Item is available for Apple devices
Restrictions limit user access to device features, apps, and system behavior. Use the Apple Restrictions Library Item to apply those limits on iPhone, iPad, Mac, Apple TV, and Vision through Blueprints. Many Apple restrictions require a supervised device. For company-owned Android work profile devices, see Configure the Android Restrictions Library Item.

​
Add an Apple Restrictions Library Item

Configure device restrictions for iPhone, iPad, Mac, Apple TV, and Vision using the Apple Restrictions Library Item. To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the Library Overview article. When you choose Add Library Item, select Apple Restrictions to create an Apple Restrictions Library Item.
1

Name the Library Item

Give the Apple Restrictions Library Item a Name.
2

Select Device Types

In the Install on field, select the device types you want to target (iPhone, iPad, Mac, Apple TV, or Vision).
3

Assign to Blueprints

Assign to your desired Blueprints.
4

Filter by supervision

From the drop-down menu above the restriction list, choose All Restrictions, Supervision required, or Supervision not required.
5

Show enabled restrictions

Select the Show enabled only checkbox to hide restrictions that aren’t enabled.
6

Filter by platform

Select All, Mac, iPhone, iPad, Apple TV, or Vision to show restrictions for that device type.
7

Search for a restriction

In the search field, enter the name of a restriction.
8

Jump to a category

Select a category on the left, such as Apps, Siri, or OS & General. The list on the right moves to that section and shows the restrictions in it.
9

Select restrictions

Select the restrictions you want to apply. Each one shows the device types it supports and whether it requires supervision.
10

Save Configuration

Select Save.

​
Apple Restrictions Reference

This reference groups Apple restrictions by category as shown in the Iru Endpoint web app. Each restriction includes platform tags and availability text as provided by Apple.
  • Disallow installing apps and updates: Prevents users from installing or updating apps using the App Store or host apps (Apple Configurator, Xcode). Also prevents installation and use of marketplace apps and marketplace-hosted apps in the European Union. The App Store is disabled, and its icon is removed from the Home Screen. Requires a supervised device. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision, Supervised
  • Disallow installing apps and updates from the device: Prevents users from installing or updating apps using the App Store. The App Store is disabled, and its icon is removed from the Home Screen. Host apps (Apple Configurator, Xcode) can still install and update apps. Requires a supervised device. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision, Supervised
  • Disallow marketplace apps and marketplace-hosted apps: Disallow installing marketplace apps and marketplace-hosted apps in the European Union. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow modifying the default browser app: Prevents a user from modifying the default browser app. Available in iOS 18.2, iPadOS 18.2, or later. Requires a supervised device.
    • Platforms: iPad, iPhone, Supervised
  • Disallow modifying the default calling app: Prevents a user from modifying the default calling app. Available in iOS 18.4, iPadOS 18.4, or later. Requires a supervised device.
    • Platforms: iPad, iPhone, Supervised
  • Disallow modifying the default messaging app: Prevents a user from modifying the default messaging app. Available in iOS 18.4, iPadOS 18.4, or later. Requires a supervised device.
    • Platforms: iPad, iPhone, Supervised
  • Disallow app installation directly from websites: Disallow installing apps directly from websites in the European Union. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow in-app purchases: Prohibits in-app purchases. Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow automatically downloading apps: Prohibits automatic downloads of apps purchased on other devices that use the same iCloud account. This setting doesn’t affect updates to existing apps. Requires a supervised device. Available in iOS and visionOS 27 or later.
    • Platforms: iPad, iPhone, Vision, Supervised
  • Disallow removing apps: Users can’t remove apps from the device, including marketplace apps and marketplace-hosted apps in the European Union. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow removing system apps: Users can’t remove system apps from the device. Requires a supervised device. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision, Supervised
  • Disallow use of FaceTime: The FaceTime app is disabled, and its icon is removed from the Home Screen. Requires a supervised device. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision, Supervised
  • Disallow use of Messages: On iPhone, the Messages app allows SMS text messaging and blocks iMessage. On iPad, the Messages app is disabled, and its icon is removed from the Home Screen. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow use of News: The News app is disabled, and its icon is removed from the Home Screen. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow use of Podcasts: The Podcasts app is disabled, and its icon is removed from the Home Screen. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Enforce app ratings: Manage the maximum level of app content allowed on the device. Apps that don’t meet ratings compliance in the App Store are unavailable for download. On iPhone and iPad, existing apps that are out of compliance are disabled and removed from the Home Screen. On Mac computers, existing apps stay on the device. Available in iOS, macOS, and tvOS.
    • Platforms: Mac, iPad, iPhone, Apple TV
  • Disallow App Clips: Prevents a user from adding any App Clips, and removes any existing App Clips on the device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Delay App Software Updates: Delays user visibility of non-OS Software Updates. Requires a supervised device. Available in macOS.
  • Disallow apps to be locked: Disallow apps to be locked in iOS and iPadOS. Requires a supervised device. Applying this restriction also prevents apps from being hidden.
    • Platforms: iPad, iPhone, Supervised
  • Disallow apps to be hidden: Disallow apps to be hidden in iOS and iPadOS. Requires a supervised device.
    • Platforms: iPad, iPhone, Supervised
  • Disallow Rosetta usage awareness: Turns off Rosetta usage awareness, which prevents an alert that tells the user Rosetta will be removed in a future version of macOS. Requires a supervised device. Available in macOS 26.4 or later.
    • Platforms: Mac, Supervised
  • Manage App Block List: Choose to block specific apps from being used, or specify that only listed apps are allowed. Restricted apps are disabled and hidden from the Home Screen. This also applies to use of marketplace apps and marketplace-hosted apps in the European Union. Requires a supervised device. Available in iOS, tvOS, and visionOS 27 or later.
    • Platforms: iPad, iPhone, Apple TV, Vision, Supervised
  • Autonomous Single App Mode: Allow listed apps to autonomously enter Single App Mode. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow passcode modification: Prevents the user from adding, changing, or removing device passcodes (iPhone and iPad) or user account passcodes (Mac). iPhone and iPad devices must be supervised. Available in iOS, macOS, and visionOS 2 or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow adding or removing Face ID / Touch ID data: Prevents the user from modifying Touch ID or Face ID. Requires a supervised device. Available in iOS, macOS, and visionOS 2 or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow using Face ID / Touch ID for device unlock: Prevents Touch ID or Face ID from unlocking a device. Available in iOS, visionOS 2 or later, and macOS.
    • Platforms: Mac, iPad, iPhone, Vision
  • Disallow using Apple Watch for device unlock: Prevents Apple Watch from being used to automatically unlock a Mac or iPhone. Available in iOS and macOS.
    • Platforms: Mac, iPhone
  • Enforce Fingerprint Timeout: The number of hours after which fingerprint unlock requires a password to authenticate. Available in macOS.
    • Platforms: Mac
  • Disallow voice dialing while device is locked: Disables voice dialing if the device is locked with a passcode. Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow Control Center on lock screen: Prevents Control Center from appearing on the Lock Screen. Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow Notification Center on lock screen: Prevents notifications from appearing on the Lock Screen. Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow Today view on lock screen: Hides Today View in Notification Center on the Lock Screen. Available in iOS. Also available for user enrollment.
    • Platforms: iPad, iPhone
  • Disallow Wallet notifications on lock screen: Prevents Wallet notifications on the Lock Screen. Available in iOS.
    • Platforms: iPad, iPhone
  • Allow USB accessories while device is locked: Allows the device to always connect to USB accessories while locked. On macOS, allows new USB accessories to connect without authorization. Requires a supervised device. Available in iOS and macOS.
    • Platforms: Mac, iPad, iPhone, Supervised
  • Enable captive Wi-Fi portal for login and unlock: If enabled, the Mac allows use of the captive Wi-Fi portal at login or unlock. Requires a supervised device. Available in macOS 27 or later.
    • Platforms: Mac, Supervised
  • Enable Wi-Fi network selection for login and unlock: If enabled, the Mac allows the user to select Wi-Fi networks at login or unlock. Requires a supervised device. Available in macOS 27 or later.
    • Platforms: Mac, Supervised
  • Disallow changing account settings: Prevents users from adding, removing, or modifying accounts (mail, contacts, calendars). Requires a supervised device. Available in iOS, visionOS 2 or later, and macOS.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow AutoFill Passwords: Disables the AutoFill Passwords feature, and the user isn’t prompted to use saved passwords in apps, including Safari. This restriction also disables Automatic Strong Passwords, and strong passwords are no longer suggested to users. iPhone and iPad devices must be supervised. Available in iOS, visionOS 2 or later, and macOS.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Require authentication before using AutoFill Passwords: Users must authenticate before passwords or credit card information can be autofilled in apps, including Safari. Only supported on devices with Face ID or Touch ID. Requires a supervised device. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision, Supervised
  • Disallow Password Sharing: Prevents users from sharing passwords with the AirDrop Passwords feature. iPhone and iPad devices must be supervised. Available in iOS, visionOS 2 or later, and macOS.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow proximity based password sharing requests: Prevents devices from requesting passwords from nearby devices. iPhone and iPad devices must be supervised. Available in iOS, macOS, and tvOS.
    • Platforms: Mac, iPad, iPhone, Apple TV, Supervised
  • Disallow Proximity Setup for New Devices: Disables the prompt to set up new devices that are nearby. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow opening documents from managed sources in unmanaged destinations: Documents in managed apps and accounts only open in other managed apps and accounts. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision
  • Disallow opening documents from unmanaged sources in managed destinations: Documents in unmanaged apps and accounts only open in other unmanaged apps and accounts. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision
  • Allow managed apps to write contacts to unmanaged contacts accounts: Managed apps can write contacts to unmanaged contacts accounts. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision
    • This option is only available when Disallow opening documents from managed sources in unmanaged destinations is enabled.
  • Allow unmanaged apps to read contacts from managed contacts accounts: Unmanaged apps can read from managed contacts accounts. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision
    • This option is only available when Disallow opening documents from managed sources in unmanaged destinations is enabled.
  • Disallow iCloud Address Book: Disables iCloud Address Book services. Available in macOS.
    • Platforms: Mac
  • Disallow iCloud Bookmarks: Disables iCloud Bookmark sync. Available in macOS.
    • Platforms: Mac
  • Disallow iCloud Calendar: Disables iCloud Calendar services. Available in macOS.
    • Platforms: Mac
  • Disallow iCloud Drive: Disables document and app data syncing to iCloud. iPhone and iPad devices must be supervised. Available in iOS, visionOS 2 or later, and macOS.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow iCloud Desktop & Documents: Disables syncing Desktop and Documents folders to iCloud. Available in macOS.
    • Platforms: Mac
  • Disallow iCloud Keychain: Disables syncing the Keychain to iCloud. iPhone and iPad devices must be supervised. Available in iOS, visionOS 2 or later, and macOS.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow iCloud Mail: Disables iCloud Mail services. Available in macOS.
    • Platforms: Mac
  • Disallow iCloud Notes: Disables iCloud Notes services. Available in macOS.
    • Platforms: Mac
  • Disallow iCloud Reminders: Disables iCloud Reminders. Available in macOS.
    • Platforms: Mac
  • Disallow iCloud Photo Library: Disables the iCloud Photo Library. Available in iOS, macOS, and visionOS 2 or later.
    • Platforms: Mac, iPad, iPhone, Vision
  • Disallow iCloud Photo Stream: Disables the iCloud Photo Stream. Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow iCloud Shared Photo Stream: Disables the iCloud Shared Photo Stream. Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow device backup to iCloud: Disables backing up the device to iCloud. Requires a supervised device. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision, Supervised
  • Disallow managed app data storage in iCloud: Prevents managed apps from using iCloud sync. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision
  • Disallow Handoff: Disables activity continuation. Available in iOS, macOS, and visionOS 2 or later.
    • Platforms: Mac, iPad, iPhone, Vision
  • Disallow iCloud Private Relay: Prevents the user from turning on iCloud Private Relay. Available in iOS, iPadOS, visionOS 2 or later, and macOS.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow iPhone Widgets on Mac: Prevents syncing of iPhone widgets on a Mac with iCloud. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow Freeform Document Syncing: Prevents a user from syncing Freeform documents with iCloud. Available in macOS.
    • Platforms: Mac
  • Force Wi-Fi power on: Prevents Wi-Fi from being turned off in Settings or Control Center, even by entering or leaving Airplane Mode. It doesn’t prevent selecting which Wi-Fi network to use. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Only allow managed Wi-Fi networks: Devices can only join Wi-Fi networks configured by a configuration profile. Requires a supervised device. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision, Supervised
    • This option can prevent devices from connecting to the internet. Ensure at least one Wi-Fi profile is installed on every device.
  • Disallow modifying Bluetooth settings: Prevents the user from changing Bluetooth settings. Requires a supervised device. Available in iOS and macOS.
    • Platforms: Mac, iPad, iPhone, Supervised
  • Disallow adding VPN configurations: Prevents the creation of VPN configurations. Requires a supervised device. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision, Supervised
  • Disallow NFC: Disables Near Field Communication (NFC) on the device. Available in iOS.
    • Platforms: iPhone, Supervised
  • Disallow modifying cellular plan settings: Prevents users from changing settings related to their cellular plan. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow modifying cellular data app settings: Prevents users from changing settings for app cellular data usage. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow modifying Personal Hotspot settings: Prevents users from making modifications to the Personal Hotspot setting. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow global background fetch activity when roaming: Disables background fetch activity for apps when roaming. Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow modifying eSIM settings: Prevents users from making modifications to the eSIM setting. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow eSIM outgoing transfers: Prevent the transfer of an eSIM from the device on which the restriction is installed to a different device. Requires a supervised device. Available in iOS and iPadOS.
    • Platforms: iPad, iPhone, Supervised
  • Force preserve eSIM on erase: Preserves eSIM when a device is erased due to too many failed password attempts or Erase All Content and Settings. The eSIM isn’t preserved if Find My initiates the erase. Requires a supervised device. Available in iOS and iPadOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow Live Voicemail: Disallow the use of Live Voicemail. Requires a supervised device. Available in iOS.
    • Platforms: iPhone, Supervised
  • Disallow RCS messaging: Disallow the use of RCS messaging in Messages. Available in iOS 18.1, iPadOS 18.1, or later. Requires a supervised device.
    • Platforms: iPad, iPhone, Supervised
  • Disallow call recording: Disallow call recording. Available in iOS 18.1 or later. Requires a supervised device.
    • Platforms: iPhone, Supervised
  • Deny ICCIDs for iMessage & FaceTime: Prevents use of iMessage and FaceTime for listed ICCIDs. The list can include up to four ICCIDs. Available in iOS 26, iPadOS 26, or later. Requires a supervised device.
    • Platforms: iPad, iPhone, Supervised
  • Deny ICCIDs for RCS: Prevents the use of RCS for listed ICCIDs. The list can include up to four ICCIDs. Available in iOS 26, iPadOS 26, or later. Requires a supervised device.
    • Platforms: iPad, iPhone, Supervised
  • Disallow AirDrop: Disables AirDrop file sharing. iPhone and iPad devices must be supervised. Available in iOS, visionOS 2 or later, and macOS.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow sharing managed documents using AirDrop: Forces managed apps to treat AirDrop as an unmanaged destination. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision
  • Disallow incoming AirPlay requests: Disables incoming AirPlay requests. Requires a supervised device. Available in tvOS and macOS.
    • Platforms: Mac, Apple TV, Supervised
  • Require password for incoming AirPlay requests: Forces all devices sending AirPlay requests to the device to use a pairing password. Available in iOS.
    • Platforms: iPad, iPhone
  • Require password for outgoing AirPlay requests: Forces all devices receiving AirPlay requests from the device to use a pairing password. Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow AirPrint: Disables AirPrint printing. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow storage of AirPrint credentials in Keychain: Disables Keychain storage of usernames and passwords for AirPrint. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow discovery of AirPrint printers using iBeacons: Disables iBeacon discovery of AirPrint printers, which prevents spurious AirPrint Bluetooth beacons from phishing for network traffic. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow AirPrint to destinations with untrusted certificates: Requires trusted certificates for TLS printing communication. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow pairing with Apple Watch: Disables pairing with an Apple Watch. Any currently paired Apple Watch is unpaired and the watch’s content is erased. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Enforce Apple Watch wrist detection: Forces a paired Apple Watch to use Wrist Detection to lock it when the user takes it off. Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow sending diagnostics and usage data to Apple: Prevents the device from automatically submitting diagnostic reports to Apple. Available in iOS, visionOS 2 or later, and macOS.
    • Platforms: Mac, iPad, iPhone, Vision
  • Disallow modifying diagnostics settings: Disables changing the diagnostic submission and app analytics settings in Diagnostics & Usage in Settings. Requires a supervised device. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision, Supervised
  • Disallow network drive access in Files app: Prevents connecting to network drives in the Files app. Requires a supervised device. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision, Supervised
  • Disallow USB drive access in Files app: Prevents connecting to any connected USB devices in the Files app. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow Find My Devices: Disables Find My Device in the Find My app. iPhone and iPad devices must be supervised. Available in iOS and macOS.
    • Platforms: Mac, iPad, iPhone, Supervised
  • Disallow Find My Friends: Disables Find My Friends in the Find My app. iPhone and iPad devices must be supervised. Available in iOS and macOS.
    • Platforms: Mac, iPad, iPhone, Supervised
  • Disallow modifying Find My Friends settings: Disables changes to Find My Friends. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow use of Game Center: Disables Game Center, and its icon is removed from the Home Screen. iPhone and iPad devices must be supervised. Available in iOS and macOS.
    • Platforms: Mac, iPad, iPhone, Supervised
  • Disallow adding Game Center friends: Prohibits adding friends to Game Center. iPhone and iPad devices must be supervised. Available in iOS and macOS.
    • Platforms: Mac, iPad, iPhone, Supervised
  • Disallow multiplayer gaming: Prohibits multiplayer gaming. iPhone and iPad devices must be supervised. Available in iOS and macOS.
    • Platforms: Mac, iPad, iPhone, Supervised
  • Disallow auto correction: Disables keyboard autocorrection. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow definition lookup: Disables definition lookup. iPhone and iPad devices must be supervised. Available in iOS and macOS.
    • Platforms: Mac, iPad, iPhone, Supervised
  • Disallow dictation input: Disallows dictation input. iPhone and iPad devices must be supervised. Available in iOS and macOS.
    • Platforms: Mac, iPad, iPhone, Supervised
  • Disallow keyboard shortcuts: Disables keyboard shortcuts. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow spell check: Disables keyboard spell-check. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow predictive keyboard: Disables predictive keyboards. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow Continuous Path keyboard: Disables QuickPath keyboard. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow use of Apple Books: Disables Apple Books. iPhone and iPad devices must be supervised. Available in iOS and macOS.
    • Platforms: Mac, iPad, iPhone, Supervised
  • Disallow explicit sexual content in Apple Books: Users can’t download Apple Books media that is tagged as erotica. Available in iOS, macOS, and tvOS.
    • Platforms: Mac, iPad, iPhone, Apple TV
  • Disallow backup of enterprise books: Disables backup of Enterprise books. Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow notes and highlights sync of enterprise books: Disables sync of Enterprise books, notes, and highlights. Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow use of Apple Music: Disables the Music service, and the Music app reverts to classic mode. iPhone and iPad devices must be supervised. Available in iOS and macOS.
    • Platforms: Mac, iPad, iPhone, Supervised
  • Disallow use of Apple Music Radio: Disables Apple Music Radio. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow use of iTunes Store: Disables the iTunes Store, and its icon is removed from the Home Screen. Users can’t preview, purchase, or download content. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Require iTunes Store password for all purchases: Forces the user to enter their iTunes password for each transaction. Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow playback of explicit music, podcasts, and iTunes U media: Hides explicit music or video content purchased from the iTunes Store. Explicit content is marked as such by content providers, such as record labels, when sold through the iTunes Store. iPhone and iPad devices must be supervised. Available in iOS, macOS, and tvOS.
    • Platforms: Mac, iPad, iPhone, Apple TV, Supervised
  • Disallow iTunes file sharing services: Disables iTunes file sharing services. Available in macOS.
    • Platforms: Mac
  • Manage Movie rating restrictions: Enforce the maximum level of movie content allowed on the device. Available in iOS, macOS, and tvOS.
    • Platforms: Mac, iPad, iPhone, Apple TV
  • Manage TV Show rating restrictions: Enforce the maximum level of TV content allowed on the device. Available in iOS, macOS, and tvOS.
    • Platforms: Mac, iPad, iPhone, Apple TV
  • Defer software updates: Delays user visibility of software updates. In macOS, seed build updates are allowed, without delay. iPhone and iPad devices must be supervised. Available in iOS, macOS, and tvOS. Learn more about Software Updates and their deferral limits.
    • Platforms: Mac, iPad, iPhone, Apple TV, Supervised
    • Deprecated as of iOS 27, iPadOS 27, tvOS 27, and macOS 27. Use the Software Update Library Item instead.
  • Disallow Background Security Improvement installation: Prevents installation of Apple Background Security Improvements (formerly known as Rapid Security Responses). Devices must be supervised. Available in iOS, iPadOS, and macOS.
  • Disallow Background Security Improvement removal: Prevents removal of Apple Background Security Improvements (formerly known as Rapid Security Responses). Devices must be supervised. Available in iOS, iPadOS, and macOS.
  • Disallow use of Safari: Disables the Safari web browser app, and its icon is removed from the Home Screen. This setting also prevents users from opening web clips. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow Safari AutoFill: Disables Safari AutoFill. iPhone and iPad devices must be supervised. Available in iOS, visionOS 2 or later, and macOS.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow Safari pop-ups: Disables pop-up windows in Safari. Available in iOS.
    • Platforms: iPad, iPhone
  • Force Safari fraud warnings: Enables fraud warnings in Safari. Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow Safari Javascript: Disables JavaScript in Safari. Available in iOS.
    • Platforms: iPad, iPhone
  • Manage Safari cookies: Enforce cookie settings for Safari. Available in iOS.
    • Platforms: iPad, iPhone
  • Allow deprecated TLS versions in Safari: Allow the use of deprecated TLS versions 1.0/1.1 in Safari. Available in iOS and macOS.
    • Platforms: Mac, iPad, iPhone
  • Disallow Safari history clearing: Prevents a user from clearing browsing history in Safari. Available in iOS 26, iPadOS 26, macOS 26, visionOS 26, or later. Requires a supervised device.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow Safari private browsing: Prevents a user from enabling private browsing in Safari. Available in iOS 26, iPadOS 26, macOS 26, visionOS 26, or later. Requires a supervised device.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow use of Siri: Disables Siri. Available in iOS, macOS, and visionOS 2 or later.
    • Platforms: Mac, iPad, iPhone, Vision
  • Disallow use of Siri while device is locked: Disables Siri when the device is locked. This restriction is ignored if the device doesn’t have a passcode set. Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow user-generated content in Siri: Prevents Siri from querying user-generated content from the web. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow Siri AI: When selected, disallows the Siri AI specific features of Siri. Requires a supervised device. Available in iOS 27, iPadOS 27, macOS 27, visionOS 27, or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Enable Siri profanity filter: Forces the use of the profanity filter with Siri. iPhone and iPad devices must be supervised. Available in iOS and macOS.
    • Platforms: Mac, iPad, iPhone, Supervised
  • Force on device translation: Prevent the device from connecting to the Siri servers for translations. Available in iOS and iPadOS.
    • Platforms: iPad, iPhone
  • Force on device dictation: Prevent the device from connecting to the Siri servers for dictation. Available in iOS, iPadOS, visionOS 2 or later, and Mac computers with Apple silicon.
    • Platforms: Mac, iPad, iPhone, Vision
  • Reduce sensitive content: When selected, forces Siri to reduce sensitive content. Requires a supervised device. Available in iOS 27, iPadOS 27, macOS 27, visionOS 27, or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Automatically reject untrusted HTTPS certificates: Automatically rejects untrusted HTTPS certificates without prompting the user. Available in iOS and visionOS.
    • Platforms: iPad, iPhone, Vision
  • Force automatic date and time: Enables the Set Automatically feature in Date & Time, and this can’t be disabled by the user. The device’s time zone is updated only when the device can determine its location using a cellular connection or Wi-Fi with Location Services turned on. Requires a supervised device. Available in iOS, visionOS 2 or later, and tvOS.
    • Platforms: iPad, iPhone, Apple TV, Vision, Supervised
  • Disallow Remote app pairing: Disables pairing with Apple TV for use with the Remote app or Control Center widget. Requires a supervised device. Available in tvOS.
    • Platforms: Apple TV, Supervised
  • Disallow use of camera: Disables the camera, and its icon is removed from the Home Screen. Users can’t take photographs. iPhone and iPad devices must be supervised. Available in iOS, visionOS 27 or later, and macOS.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow pairing with non-Configurator hosts: Disables host pairing with the exception of the supervision host. If no supervision host certificate has been configured, all pairing is disabled. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow use of Content Caching service: Disables content caching. Available in macOS.
    • Platforms: Mac
  • Disallow modifying device name: Warning: This restriction prevents the device name from being changed. It has been moved to the Device Name Library Item.
    • Platforms: Mac, iPad, iPhone, Apple TV, Vision, Supervised
  • Disallow device sleeping: Prevents the device from sleeping. Requires a supervised device. Available in tvOS.
    • Platforms: Apple TV, Supervised
  • Disallow Erase All Content and Settings: Disable Erase All Content and Settings. Requires a supervised device. Available in iOS, macOS, and visionOS 2 or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow manual installation of configuration profiles and certificates: Prohibits the user from installing configuration profiles and certificates interactively. Requires a supervised device. Available in iOS, macOS, and visionOS 2 or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow modifying notification settings: Prevents changing notification settings. Requires a supervised device. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision, Supervised
  • Disallow OTA PKI updates: Disables over-the-air public key infrastructure (PKI) updates. This doesn’t disable certificate revocation checks (CRL and OCSP). Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow use of Screen Time: Disables the “Enable Screen Time” option in Screen Time in Settings, and disables Screen Time if it’s already turned on. Requires a supervised device. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision, Supervised
  • Disallow screenshots and screen recording: Disables saving a screenshot of the display and capturing a screen recording. Available in iOS, macOS, and visionOS 2 or later.
    • Platforms: Mac, iPad, iPhone, Vision
  • Disallow Spotlight internet search results: Disables Spotlight internet search results. Available in iOS and macOS.
    • Platforms: Mac, iPad, iPhone
  • Disallow “Trust Enterprise Developer” option: Remove the Trust Enterprise Developer button in Settings > General > Profiles & Device Management, preventing apps from being provisioned by universal provisioning profiles. This restriction applies to free developer accounts. It doesn’t apply to enterprise app developers who are trusted because their apps were pushed through APNs. It also doesn’t revoke previously granted trust. Available in iOS and visionOS 2 or later.
    • Platforms: iPad, iPhone, Vision
  • Disallow modifying Wallpaper: Prevents wallpaper from being changed. iPhone and iPad devices must be supervised. Available in iOS and macOS.
    • Platforms: Mac, iPad, iPhone, Supervised
  • Force limited ad tracking: Limits ad tracking on Apple’s ad platform. Additionally, it disables app tracking and the Allow Apps To Request To Track setting. Available in iOS and up through macOS 11.
    • Platforms: Mac, iPad, iPhone
  • Force encrypted backups: Requires that all backups be encrypted. Available in iOS.
    • Platforms: iPad, iPhone
  • Disallow guest user: Disallow the ability to log in as a Guest user on iPad devices configured as Shared iPad. Available in iOS.
    • Platforms: iPad
  • Allow boot to recovery by unpaired device: Allows devices to be booted into recovery by an unpaired device. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow Apple TV automatic screensaver: Disables the Apple TV from automatically starting the screensaver after inactivity. Available in tvOS.
    • Platforms: Apple TV
  • Disallow Universal Control: Disables Universal Control, preventing the Mac’s trackpad and keyboard from controlling additional Mac or iPad devices nearby. Available in macOS.
    • Platforms: Mac
  • Disallow Apple personalized advertisements: Limits Apple personalized advertising. Available in iOS, visionOS 2 or later, and macOS.
    • Platforms: Mac, iPad, iPhone, Vision
  • Disallow startup disk modification: Prevents the user from selecting a different startup disk. Available in macOS.
    • Platforms: Mac
  • Disallow Time Machine backup: Prevents the user from setting up and using Time Machine. Available in macOS.
    • Platforms: Mac
  • Disallow local user creation: Prevents a user with the role of administrator from creating new users in Users & Groups in System Settings. Available in macOS.
    • Platforms: Mac
  • Disallow Mail Privacy Protection: Disables Mail Privacy Protection on the device. Requires a supervised device. Available in iOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow auto dim: Prevents auto dim on iPads with OLED displays. Available in iOS and iPadOS.
    • Platforms: iPad, iPhone, Supervised
  • Bypass screen capture alerts: Prevents user notifications for content capture technologies in macOS 15.1 or later.
    • Platforms: Mac, Supervised
  • Disallow natural language editing in Calendar and Reminders: When selected, disallows natural language editing in Calendar and Reminders. Requires a supervised device. Available in iOS 27, iPadOS 27, macOS 27, visionOS 27, or later.
  • Disallow File Sharing modification: Prevents a user from changing the state of the File Sharing service in System Settings. Available in macOS.
    • Platforms: Mac
  • Disallow Printer Sharing modification: Prevents a user from changing the state of the Printer Sharing service in System Settings. Available in macOS.
    • Platforms: Mac
  • Disallow Remote Management modification: Prevents a user from changing the state of the Remote Management service in System Settings. Available in macOS.
    • Platforms: Mac
  • Disallow Remote Apple Events modification: Prevents a user from changing the state of the Remote Apple Events service in System Settings. Available in macOS.
    • Platforms: Mac
  • Disallow Internet Sharing modification: Prevents a user from changing the state of the Internet Sharing service in System Settings. Available in macOS.
    • Platforms: Mac
  • Disallow Bluetooth Sharing modification: Prevents a user from changing the state of the Bluetooth Sharing service in System Settings. Available in macOS.
    • Platforms: Mac
  • Disallow iPhone Mirroring: Prevents the use of iPhone Mirroring. When used on macOS, this prevents the Mac from mirroring any iPhone. When used on iOS, this prevents the iPhone from mirroring to any Mac. Requires a supervised device. Available in macOS and iOS.
    • Platforms: Mac, iPhone, Supervised
  • Disallow remote screen control via FaceTime: Prevents the ability for a remote FaceTime session to request control of the device. Requires a supervised device. Available in iOS and iPadOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow Media Sharing modification: Prevents a user from changing the state of the Media Sharing service in System Settings. Available in macOS 15.1 or later.
    • Platforms: Mac, Supervised
For Apple Intelligence and Visual Intelligence, see Apple’s Apple Intelligence declarative configuration guide and IntelligenceSettings documentation.
  • Disallow Apple Intelligence reports: When selected, disallows Apple Intelligence reports. Requires a supervised device. Available in iOS 18.4, iPadOS 18.4, or later, macOS 15.4 or later, and visionOS 2.4 or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow external intelligence integrations: Prevents the use of external, cloud-based intelligence services with Siri. Can’t be used with Shared iPad. Available in iOS 18.2 or later, macOS 15.2 or later, and visionOS 2.4 or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow external intelligence integrations sign-in: Forces external intelligence providers into anonymous mode. If a user is already signed in to an external intelligence provider, applying this restriction signs them out. Can’t be used with Shared iPad. Available in iOS 18.2 or later, macOS 15.2 or later, and visionOS 2.4 or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Allowed external intelligence workspace IDs: When provided, only accounts in the specified workspace in the external intelligence system, such as ChatGPT, can sign in on the device. In ChatGPT, this ID can be found in the admin panel for your enterprise workspace. Requires a supervised device. Available in iOS 18.3, iPadOS 18.3, or later, macOS 15.3 or later, and visionOS 2.4 or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow Genmoji: Prohibits creating new Genmoji. Requires a supervised device. Available in iOS, iPadOS, and macOS, and in visionOS 2.4 or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow Image Playground: Prohibits the use of image generation. Requires a supervised device. Available in iOS, iPadOS, and macOS, and in visionOS 2.4 or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow Image Wand: Prevents use of Image Wand. Requires a supervised device. Available in iOS and iPadOS, and in visionOS 2.4 or later.
    • Platforms: iPad, iPhone, Vision, Supervised
  • Disallow Live Recognition: When selected, disables the Live Recognition accessibility feature. Requires a supervised device. Available in iOS 27, iPadOS 27, macOS 27, visionOS 27, or later.
  • Disallow Mail smart replies: When selected, disallows Smart Reply in Mail. Requires a supervised device. Available in iOS 18.4, iPadOS 18.4, or later, macOS 15.4 or later, and visionOS 2.4 or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow Mail summaries: Disallow the use of the summarize button in Mail. Requires a supervised device. Available in macOS 15.1 or later, iOS 18.1, iPadOS 18.1, or later, and visionOS 2.4 or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow transcription in Notes: Prevents transcription in Notes. Available in iOS 18.2, iPadOS 18.2, or later, macOS 15.2 or later, and visionOS 2.4 or later. Requires a supervised device.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow Notes transcription summary: When selected, disallows transcription summaries in Notes. Requires a supervised device. Available in iOS 18.3, iPadOS 18.3, or later, and macOS 15.3 or later.
    • Platforms: Mac, iPad, iPhone, Supervised
  • Disallow Personalized Handwriting Results: Prevents generating text in the user’s handwriting. Requires a supervised device. Available in iOS and iPadOS.
    • Platforms: iPad, iPhone, Supervised
  • Disallow summarizing content in Safari: When selected, disallows summarizing content in Safari. Requires a supervised device. Available in iOS 18.4, iPadOS 18.4, or later, macOS 15.4 or later, and visionOS 2.4 or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow writing tools: Prevents the user from using Apple Intelligence Writing Tools. Requires a supervised device. Available in iOS, iPadOS, and macOS, and in visionOS 2.4 or later.
    • Platforms: Mac, iPad, iPhone, Vision, Supervised
  • Disallow Visual Intelligence: When selected, disables Visual Intelligence. Requires a supervised device. Available in iOS 26.4, iPadOS 26.4, or later, and macOS 27 or later.
    • Platforms: Mac, iPad, iPhone, Supervised

​
Important Considerations

Supervision requirements

Many Apple restrictions only apply on supervised devices. Enroll those devices with Automated Device Enrollment or Apple Configurator.

Platform availability

Support varies by device type and OS. Confirm a restriction exists for your targets before you depend on it.

Policy and usability

Tighter restrictions can block legitimate work; looser ones may leave gaps. Set policies to match your risk and how people use devices.

Testing recommendations

Try changes on test hardware first. Undoing some restrictions may require re-enrolling the device.

Configure the Android Restrictions Library Item

Set up the Android Restrictions Library Item in Iru Endpoint to control work profile, personal profile, and device restrictions on company-owned Android devices.

Library Overview

Overview of the Iru Endpoint Library for managing apps, profiles, scripts, and configurations. Curate Library Items and assign them to device Blueprints.

Delay and Enforce OS Updates

Configure OS update delays and enforcement deadlines for managed Apple devices in Iru Endpoint. Defer updates and set mandatory installation windows.

Setting Device Names

Set or change device names remotely from the Iru Endpoint web app. Rename Mac computers, iPhone and iPad devices, Apple TV devices, and Apple Vision Pro for easier.