Configure the Restrictions Library Item

This Library Item is available for Apple and Android devices

What are Restrictions?

Restrictions are settings that limit user access to device features, apps, and system behavior. In the Iru Endpoint Library, Apple platforms use the Apple Restrictions Library Item; Android (company-owned work profile) uses the Android Restrictions Library Item. You apply them through Blueprints. They can cover app install and removal, cameras, cellular behavior, and similar controls.

How Restrictions work

When you apply an Apple Restrictions Library Item or Android Restrictions Library Item through a Blueprint, the OS enforces the limits you set. Users cannot turn those limits off from the device, even with admin rights. Available options differ by platform. Many Apple restrictions require a supervised device. Android restrictions are enforced through the Android Management API.

Apple
Android

Add an Apple Restrictions Library Item

Configure device restrictions for iPhone, iPad, Mac, Apple TV, and Vision using the Apple Restrictions Library Item. To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the Library Overview article. When you choose Add Library Item, select Apple Restrictions to create an Apple Restrictions Library Item.

Name the Library Item

Give the Apple Restrictions Library Item a Name.

Select Device Types

In the Install on field, select the device types you want to target (iPhone, iPad, Mac, Apple TV, or Vision).

Assign to Blueprints

Assign to your desired Blueprints.

Configure Restrictions

Configure the restriction settings you need.

Save Configuration

Click Save.

Apple restrictions reference

This reference groups Apple restrictions by category as shown in the Iru Endpoint web app. Each restriction includes platform tags and availability text as provided by Apple.

Apps

App Store & installation

Disallow installing apps and updates: Users are prevented from installing or updating apps using the App Store or host apps (iTunes, Configurator). Also prevents installation and use of marketplace apps and marketplace-hosted apps in the European Union. The App Store is disabled, and its icon is removed from the Home screen. Requires a supervised device. Available in iOS 4 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision, Supervised
Disallow installing apps and updates from the device: Users are prevented from installing or updating apps using the App Store. The App Store is disabled, and its icon is removed from the Home screen. Host apps (iTunes, Configurator) are still allowed to be used to install and update apps. Requires a supervised device. Available in iOS 9 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision, Supervised
Disallow marketplace apps and marketplace-hosted apps: Disallow installing marketplace apps and marketplace-hosted apps in the European Union. Requires a supervised device. Available in iOS 17.4 and later.
- Platforms: iPad, iPhone, Supervised
Disallow modifying the default browser app: Prevents a user from modifying the default browser app. Available in iOS 18.2 and later and iPadOS 18.2 and later. Requires a supervised device.
- Platforms: iPad, iPhone, Supervised
Disallow modifying the default calling app: Prevents a user from modifying the default calling app. Available in iOS 18.4 and later and iPadOS 18.4 and later. Requires a supervised device.
- Platforms: iPad, iPhone, Supervised
Disallow modifying the default messaging app: Prevents a user from modifying the default messaging app. Available in iOS 18.4 and later and iPadOS 18.4 and later. Requires a supervised device.
- Platforms: iPad, iPhone, Supervised
Disallow app installation directly from websites: Disallow installing apps directly from websites in the European Union. Requires a supervised device. Available in iOS 17.5 and later.
- Platforms: iPad, iPhone, Supervised

Purchases, downloads & removal

Disallow in-app purchases: In-app purchasing is prohibited. Available in iOS 4 and later.
- Platforms: iPad, iPhone
Disallow automatically downloading apps: Automatic downloading of apps purchased on other devices using the same iCloud account is prohibited. This setting doesn’t affect updates to existing apps. Requires a supervised device. Available in iOS 9 and later.
- Platforms: iPad, iPhone, Supervised
Disallow removing apps: Users are unable to remove apps from the device, including marketplace apps and marketplace-hosted apps in the European Union. Requires a supervised device. Available in iOS 4.2.1 and later.
- Platforms: iPad, iPhone, Supervised
Disallow removing system apps: Users are unable to remove system apps from the device. Requires a supervised device. Available in iOS 11 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision, Supervised

FaceTime, Messages, News & Podcasts

Disallow use of FaceTime: The FaceTime app is disabled, and its icon is removed from the Home screen. Requires a supervised device. Available in iOS 4 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision, Supervised
Disallow use of Messages: On iPhone, the Messages app allows SMS text messaging, but not iMessage. On iPad, the Messages app is disabled, and its icon is removed from the Home screen. Requires a supervised device. Available in iOS 5 and later.
- Platforms: iPad, iPhone, Supervised
Disallow use of News: The News app is disabled, and its icon is removed from the Home screen. Requires a supervised device. Available in iOS 9 and later.
- Platforms: iPad, iPhone, Supervised
Disallow use of Podcasts: The Podcasts app is disabled, and its icon is removed from the Home screen. Requires a supervised device. Available in iOS 8 and later.
- Platforms: iPad, iPhone, Supervised

Ratings, App Clips & app updates

Enforce app ratings: Manage the maximum level of app content allowed on the device. Apps that do not meet ratings compliance in the App Store will be unavailable for download. On iPhones and iPads (but not Macs), existing apps on the device that are out of compliance will be disabled and removed from the Home screen. Available in iOS 4 and later, macOS 10.15 and later, and tvOS 11.3 and later.
- Platforms: Mac, iPad, iPhone, Apple TV
Disallow App Clips: Prevents a user from adding any App Clips, and removes any existing App Clips on the device. Available in iOS 14.0 and later.
- Platforms: iPad, iPhone, Supervised
Delay App Software Updates: Delays user visibility of non-OS Software Updates. Requires a supervised device. Available in macOS 11 and later.
- Platforms: Mac, Supervised

Lock, hide & Rosetta

Disallow apps to be locked: Disallow apps to be locked in iOS and iPadOS 18 and later. Requires a supervised device. Note: Applying this restriction will also prevent apps from being able to be hidden.
- Platforms: iPad, iPhone, Supervised
Disallow apps to be hidden: Disallow apps to be hidden in iOS and iPadOS 18 and later. Requires a supervised device.
- Platforms: iPad, iPhone, Supervised
Disallow Rosetta usage awareness: Turns off Rosetta usage awareness, which prevents a pop-up dialog being displayed to the user indicating that Rosetta will be removed in a future version of macOS. Requires a supervised device. Available in macOS 26.4 and later.
- Platforms: Mac, Supervised

Block list & Single App Mode

Manage App Block List: Choose to block specific apps from being used, or specify that only listed apps are allowed. Restricted apps are disabled and hidden from the Home screen. This also applies to use of marketplace apps and marketplace-hosted apps in the European Union. Requires a supervised device. Available in iOS 9.3 and later, and tvOS 11.0 and later.
- Platforms: iPad, iPhone, Apple TV, Supervised
Autonomous Single App Mode: Allow listed apps to autonomously enter Single App Mode. Requires a supervised device. Available in iOS 7 and later.
- Platforms: iPad, iPhone, Supervised

Passcode & authentication

Disallow passcode modification: Prevents the user from adding, changing, or removing device passcodes (iPhone and iPad) or user account passcodes (Mac). iPhone and iPad devices must be supervised. Available in iOS 9 and later, macOS 10.13 and later, and visionOS 2.0 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow adding or removing Face ID / Touch ID data: Prevents the user from modifying Touch ID or Face ID. Requires a supervised device. Available in iOS 8.3 and later, macOS 14 and later, and visionOS 2.0 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow using Face ID / Touch ID for device unlock: Prevents Touch ID or Face ID from unlocking a device. Available in iOS 7 and later, visionOS 2.0 and later, and macOS 10.12.4 and later.
- Platforms: Mac, iPad, iPhone, Vision
Disallow using Apple Watch for device unlock: Prevents Apple Watch from being used to automatically unlock a Mac or iPhone. Available in macOS 10.12 and later.
- Platforms: Mac, iPhone
Enforce Fingerprint Timeout: The number of hours after which the fingerprint unlock will require a password to authenticate. Available in macOS 12 and later.
- Platforms: Mac

Lock screen

Disallow voice dialing while device is locked: Disables voice dialing if the device is locked with a passcode. Available in iOS 4 and later.
- Platforms: iPad, iPhone
Disallow Control Center on lock screen: Prevents the Control Center from appearing on the lock screen. Available in iOS 7 and later.
- Platforms: iPad, iPhone
Disallow Notifications Center on lock screen: Prevents displaying notifications on the lock screen. Available in iOS 7 and later.
- Platforms: iPad, iPhone
Disallow Today view on lock screen: Hides the Today view in the notification center on the lock screen. Available in iOS 7 and later. Also available for user enrollment.
- Platforms: iPad, iPhone
Disallow Wallet notifications on lock screen: Prevents Wallet notifications on the lock screen. Available in iOS 6 and later.
- Platforms: iPad, iPhone
Allow USB accessories while device is locked: Allows the device to always connect to USB accessories while locked. On macOS, allows new USB accessories to connect without authorization. Requires a supervised device. Available in iOS 11.4.1 and later, and macOS 13 and later.
- Platforms: Mac, iPad, iPhone, Supervised

Accounts & passwords

Accounts & AutoFill

Disallow changing account settings: Users are prevented from adding, removing, or modifying accounts (mail, contacts, calendars). Requires a supervised device. Available in iOS 7 and later, visionOS 2.0 and later, and macOS 14 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow AutoFill Passwords: Disables the AutoFill Passwords feature, and the user isn’t prompted to use saved passwords in apps, including Safari. This restriction also disables Automatic Strong Passwords, and strong passwords are no longer suggested to users. iPhone and iPad devices must be supervised. Available in iOS 12 and later, visionOS 2.0 and later, and macOS 10.14 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Require authentication before using AutoFill Passwords: Users must authenticate before passwords or credit card information can be autofilled in apps, including Safari. Only supported on devices with Face ID or Touch ID. Requires a supervised device. Available in iOS 11 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision, Supervised

Password sharing & proximity

Data segregation

Disallow opening documents from managed sources in unmanaged destinations: Documents in managed apps and accounts only open in other managed apps and accounts. Available in iOS 7 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision
Disallow opening documents from unmanaged sources in managed destinations: Documents in unmanaged apps and accounts only open in other unmanaged apps and accounts. Available in iOS 7 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision
Allow managed apps to write contacts to unmanaged contacts accounts: Managed apps can write contacts to unmanaged contacts accounts. Available in iOS 12 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision
Allow unmanaged apps to read contacts from managed contacts accounts: Unmanaged apps can read from managed contacts accounts. Available in iOS 12 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision

iCloud

Mac-only mail, calendar & notes services

Disallow iCloud Address Book: Disables iCloud Address Book services. Available in macOS 10.12 and later.
- Platforms: Mac
Disallow iCloud Bookmarks: Disables iCloud Bookmark sync. Available in macOS 10.12 and later.
- Platforms: Mac
Disallow iCloud Calendar: Disables iCloud Calendar services. Available in macOS 10.12 and later.
- Platforms: Mac
Disallow iCloud Mail: Disables iCloud Mail services. Available in macOS 10.12 and later.
- Platforms: Mac
Disallow iCloud Notes: Disables iCloud Notes services. Available in macOS 10.12 and later.
- Platforms: Mac
Disallow iCloud Reminders: Disables iCloud Reminders services. Available in macOS 10.12 and later.
- Platforms: Mac

Drive, Keychain & Desktop

Disallow iCloud Drive: Disables document and app data syncing to iCloud. iPhone and iPad devices must be supervised. Available in iOS 5 and later, visionOS 2.0 and later, and macOS 10.11 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow iCloud Desktop & Documents: Disables syncing Desktop and Documents folders to iCloud. Available in macOS 10.12.4 and later.
- Platforms: Mac
Disallow iCloud Keychain: Disables syncing the Keychain to iCloud. iPhone and iPad devices must be supervised. Available in iOS 7 and later, visionOS 2.0 and later, and macOS 10.12 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised

Photos, streams, backup & managed data

Disallow iCloud Photo Library: Disables the iCloud Photo Library. Available in iOS 9 and later, macOS 10.12 and later, and visionOS 2.0 and later.
- Platforms: Mac, iPad, iPhone, Vision
Disallow iCloud Photo Stream: Disables the iCloud Photo Stream. Available in iOS 5 and later.
- Platforms: iPad, iPhone
Disallow iCloud Shared Photo Stream: Disables the iCloud Shared Photo Stream. Available in iOS 6 and later.
- Platforms: iPad, iPhone
Disallow device backup to iCloud: Disables backing up the device to iCloud. Requires a supervised device. Available in iOS 5, visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision, Supervised
Disallow managed app data storage in iCloud: Prevents managed apps from using iCloud sync. Available in iOS 8 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision

Handoff, Private Relay, widgets & Freeform

Disallow Handoff: Disables activity continuation. Available in iOS 8, macOS 10.15 and later, and visionOS 2.0 and later.
- Platforms: Mac, iPad, iPhone, Vision
Disallow iCloud Private Relay: Prevents the user from turning on iCloud Private Relay. Available in iOS 15, iPadOS 15, visionOS 2.0, macOS 12, and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow iPhone Widgets on Mac: Prevents syncing of iPhone widgets on a Mac with iCloud. Requires a supervised device. Available in iOS 17 and later.
- Platforms: iPad, iPhone, Supervised
Disallow Freeform Document Syncing: Prevents a user from syncing Freeform documents with iCloud. Available in macOS 14 and later.
- Platforms: Mac

Network

Force Wi-Fi power on: Prevents Wi-Fi from being turned off in Settings or Control Center, even by entering or leaving Airplane Mode. It does not prevent selecting which Wi-Fi network to use. Requires a supervised device. Available in iOS 13.0 and later.
- Platforms: iPad, iPhone, Supervised
Only allow managed Wi-Fi networks: Devices can only join Wi-Fi networks configured by a configuration profile. Requires a supervised device. Available in iOS 10.3 and later, visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision, Supervised
Disallow modifying Bluetooth settings: Prevents the user from changing Bluetooth settings. Requires a supervised device. Available in iOS 11 and later, and macOS 13 and later.
- Platforms: Mac, iPad, iPhone, Supervised
Disallow adding VPN configurations: Prevents the creation of VPN configurations. Requires a supervised device. Available in iOS 11 and later, visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision, Supervised
Disallow NFC: Disables Near Field Communication (NFC) on the device. Available in iOS 14.2 and later.
- Platforms: iPhone, Supervised

Cellular

Plan, data & hotspot

Disallow modifying cellular plan settings: Prevents users from changing settings related to their cellular plan. Requires a supervised device. Available in iOS 11 and later.
- Platforms: iPad, iPhone, Supervised
Disallow modifying cellular data app settings: Prevents users from changing settings for app cellular data usage. Requires a supervised device. Available in iOS 7 and later.
- Platforms: iPad, iPhone, Supervised
Disallow modifying Personal Hotspot settings: Users are prevented from making modifications to the Personal Hotspot setting. Requires a supervised device. Available in iOS 12.2 and later.
- Platforms: iPad, iPhone, Supervised
Disallow global background fetch activity when roaming: Disables background fetch activity for apps when roaming. Available in iOS 4 and later.
- Platforms: iPad, iPhone

eSIM

Disallow modifying eSIM settings: Users are prevented from making modifications to the eSIM setting. Requires a supervised device. Available in iOS 12.1 and later.
- Platforms: iPad, iPhone, Supervised
Disallow eSIM outgoing transfers: Prevent the transfer of an eSIM from the device on which the restriction is installed to a different device. Requires a supervised device. Available in iOS and iPadOS 18 and later.
- Platforms: iPad, iPhone, Supervised
Force preserve eSIM on erase: Preserves eSIM when a device is erased due to too many failed password attempts or Erase All Content and Settings. The eSIM is not preserved if Find My initiates the erase. Requires a supervised device. Available in iOS and iPadOS 17.2 and later.
- Platforms: iPad, iPhone, Supervised

Voice, messages & ICCIDs

Disallow Live Voicemail: Disallow the use of Live Voicemail. Requires a supervised device. Available in iOS 17.2 and later.
- Platforms: iPhone, Supervised
Disallow RCS messaging: Disallow the use of RCS messaging in Messages. Available in iOS and iPadOS 18.1 and later. Requires a supervised device.
- Platforms: iPad, iPhone, Supervised
Disallow call recording: Disallow call recording. Available in iOS 18.1 and later. Requires a supervised device.
- Platforms: iPhone, Supervised
Deny ICCIDs for iMessage & FaceTime: Prevents use of iMessage and FaceTime for listed ICCIDs. The list must contain no more than 4 ICCIDs. Available in iOS 26 and later and iPadOS 26 and later. Requires a supervised device.
- Platforms: iPad, iPhone, Supervised
Deny ICCIDs for RCS: Prevents the use of RCS for listed ICCIDs. The list must contain no more than 4 ICCIDs. Available in iOS 26 and later, and iPadOS 26 and later. Requires a supervised device.
- Platforms: iPad, iPhone, Supervised

AirDrop

Disallow AirDrop: Disables AirDrop file sharing. iPhone and iPad devices must be supervised. Available in iOS 7, visionOS 2.0 and later, and macOS 10.13 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow sharing managed documents using AirDrop: Forces managed apps to treat AirDrop as an unmanaged destination. Available in iOS 9 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision

AirPlay

Disallow incoming AirPlay requests: Disables incoming AirPlay requests. Requires a supervised device. Available in tvOS 10.2 and later, and macOS 12.3 and later.
- Platforms: Mac, Apple TV, Supervised
Require password for incoming AirPlay requests: Forces all devices sending AirPlay requests to the device to use a pairing password. Available in iOS 7.1 and later.
- Platforms: iPad, iPhone
Require password for outgoing AirPlay requests: Forces all devices receiving AirPlay requests from the device to use a pairing password. Available in iOS 7.1 and later.
- Platforms: iPad, iPhone

AirPrint

Disallow AirPrint: Disables AirPrint printing. Requires a supervised device. Available in iOS 11 and later.
- Platforms: iPad, iPhone, Supervised
Disallow storage of AirPrint credentials in Keychain: Disables Keychain storage of usernames and passwords for AirPrint. Requires a supervised device. Available in iOS 11 and later.
- Platforms: iPad, iPhone, Supervised
Disallow discovery of AirPrint printers using iBeacons: Disables iBeacon discovery of AirPrint printers, which prevents spurious AirPrint Bluetooth beacons from phishing for network traffic. Requires a supervised device. Available in iOS 11 and later.
- Platforms: iPad, iPhone, Supervised
Disallow AirPrint to destinations with untrusted certificates: Requires trusted certificates for TLS printing communication. Requires a supervised device. Available in iOS 11 and later.
- Platforms: iPad, iPhone, Supervised

Apple Watch

Disallow pairing with Apple Watch: Disables pairing with an Apple Watch. Any currently paired Apple Watch is unpaired and the watch’s content is erased. Requires a supervised device. Available in iOS 9 and later.
- Platforms: iPad, iPhone, Supervised
Enforce Apple Watch wrist detection: Forces a paired Apple Watch to use Wrist Detection to lock it when the user takes it off. Available in iOS 8.2 and later.
- Platforms: iPad, iPhone

Diagnostics

Disallow sending diagnostics and usage data to Apple: Prevents the device from automatically submitting diagnostic reports to Apple. Available in iOS 6 and later, visionOS 2.0 and later, and macOS 10.13 and later.
- Platforms: Mac, iPad, iPhone, Vision
Disallow modifying diagnostics settings: Disables changing the diagnostic submission and app analytics settings in the Diagnostics & Usage UI in Settings. Requires a supervised device. Available in iOS 9.3.2 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision, Supervised

Files

Disallow network drive access in Files app: Prevents connecting to network drives in the Files app. Requires a supervised device. Available in iOS 13.0 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision, Supervised
Disallow USB drive access in Files app: Prevents connecting to any connected USB devices in the Files app. Requires a supervised device. Available in iOS 13.0 and later.
- Platforms: iPad, iPhone, Supervised

Find My

Disallow Find My Devices: Disables Find My Device in the Find My app. iPhone and iPad devices must be supervised. Available in iOS 13 and later.
- Platforms: Mac, iPad, iPhone, Supervised
Disallow Find My Friends: Disables Find My Friends in the Find My app. iPhone and iPad devices must be supervised. Available in iOS 13 and later.
- Platforms: Mac, iPad, iPhone, Supervised
Disallow modifying Find My Friends settings: Disables changes to Find My Friends. Requires a supervised device. Available in iOS 7 and later.
- Platforms: iPad, iPhone, Supervised

Game Center

Disallow use of Game Center: Disables Game Center, and its icon is removed from the Home screen. iPhone and iPad devices must be supervised. Available in iOS 6 and later, and macOS 10.13 and later.
- Platforms: Mac, iPad, iPhone, Supervised
Disallow adding Game Center friends: Prohibits adding friends to Game Center. iPhone and iPad devices must be supervised. Available in iOS 4.2.1 and later, and macOS 10.13 and later.
- Platforms: Mac, iPad, iPhone, Supervised
Disallow multiplayer gaming: Prohibits multiplayer gaming. iPhone and iPad devices must be supervised. Available in iOS 4.1 and later, and macOS 10.13 and later.
- Platforms: Mac, iPad, iPhone, Supervised

Keyboard

Correction & prediction

Disallow auto correction: Disables keyboard autocorrection. Requires a supervised device. Available in iOS 8.1.3 and later.
- Platforms: iPad, iPhone, Supervised
Disallow spell check: Disables keyboard spell-check. Requires a supervised device. Available in iOS 8.1.3 and later.
- Platforms: iPad, iPhone, Supervised
Disallow predictive keyboard: Disables predictive keyboards. Requires a supervised device. Available in iOS 8.1.3 and later.
- Platforms: iPad, iPhone, Supervised

Definitions, dictation & input

Disallow definition lookup: Disables definition lookup. iPhone and iPad devices must be supervised. Available in iOS 8.1.3 and later, and macOS 10.13 and later.
- Platforms: Mac, iPad, iPhone, Supervised
Disallow dictation input: Disallows dictation input. iPhone and iPad devices must be supervised. Available in iOS 10.3 and later, and macOS 10.13 and later.
- Platforms: Mac, iPad, iPhone, Supervised
Disallow keyboard shortcuts: Disables keyboard shortcuts. Requires a supervised device. Available in iOS 9 and later.
- Platforms: iPad, iPhone, Supervised
Disallow Continuous Path keyboard: Disables QuickPath keyboard. Requires a supervised device. Available in iOS 13 and later.
- Platforms: iPad, iPhone, Supervised

Media

Apple Books & enterprise books

Disallow use of Apple Books: Disables Apple Books. iPhone and iPad devices must be supervised. Available in iOS 6 and later.
- Platforms: Mac, iPad, iPhone, Supervised
Disallow explicit sexual content in Apple Books: Users can’t download Apple Books media that is tagged as erotica. Available in iOS 6 and later, macOS 10.15 and later, and tvOS 11.3 and later.
- Platforms: Mac, iPad, iPhone, Apple TV
Disallow backup of enterprise books: Disables backup of Enterprise books. Available in iOS 8 and later.
- Platforms: iPad, iPhone
Disallow notes and highlights sync of enterprise books: Disables sync of Enterprise books, notes, and highlights. Available in iOS 8 and later.
- Platforms: iPad, iPhone

Music, iTunes & explicit content

Disallow use of Apple Music: Disables the Music service, and the Music app reverts to classic mode. iPhone and iPad devices must be supervised. Available in iOS 9.3 and later, and macOS 10.12 and later.
- Platforms: Mac, iPad, iPhone, Supervised
Disallow use of Apple Music Radio: Disables Apple Music Radio. Requires a supervised device. Available in iOS 9.3 and later.
- Platforms: iPad, iPhone, Supervised
Disallow use of iTunes Store: Disables the iTunes Music Store, and its icon is removed from the Home screen. Users cannot preview, purchase, or download content. Requires a supervised device. Available in iOS 4 and later.
- Platforms: iPad, iPhone, Supervised
Require iTunes Store password for all purchases: Forces the user to enter their iTunes password for each transaction. Available in iOS 6 and later.
- Platforms: iPad, iPhone
Disallow playback of explicit music, podcasts, and iTunes U media: Hides explicit music or video content purchased from the iTunes Store. Explicit content is marked as such by content providers, such as record labels, when sold through the iTunes Store. iPhone and iPad devices must be supervised. Available in iOS 4 and later, macOS 10.15 and later, and tvOS 11.3 and later.
- Platforms: Mac, iPad, iPhone, Apple TV, Supervised
Disallow iTunes file sharing services: Disables iTunes file sharing services. Available in macOS 10.13 and later.
- Platforms: Mac

Movie & TV ratings

Manage Movie rating restrictions: Enforce the maximum level of movie content allowed on the device. Available in iOS 4 and later, macOS 10.15 and later, and tvOS 11.3 and later.
- Platforms: Mac, iPad, iPhone, Apple TV
Manage TV Show rating restrictions: Enforce the maximum level of TV content allowed on the device. Available in iOS 4 and later, macOS 10.15 and later, and tvOS 11.3 and later.
- Platforms: Mac, iPad, iPhone, Apple TV

OS updates

Defer software updates: Delays user visibility of software updates. In macOS, seed build updates are allowed, without delay. iPhone and iPad devices must be supervised. Available in iOS 11.3 and later, macOS 10.13 and later, and tvOS 12.2 and later. Learn more about Software Updates and their deferral limits.

Defer software updates is deprecated on devices running iOS 26, iPadOS 26, tvOS 26, or macOS 26 and later. Use the Software Update Library Item for deferrals instead. See Delay and Enforce OS Updates.

Platforms: Mac, iPad, iPhone, Apple TV, Supervised
Disallow Background Security Improvement installation: Prevents installation of Apple Background Security Improvements (formerly known as Rapid Security responses). Devices must be supervised. Available in iOS 16.0 and later, iPadOS 16.0 and later and macOS 13 and later.
- Platforms: Mac, iPad, iPhone, Supervised
Disallow Background Security Improvement removal: Prevents removal of Apple Background Security Improvements (formerly known as Rapid Security responses). Devices must be supervised. Available in iOS 16.0 and later, iPadOS 16.0 and later and macOS 13 and later.
- Platforms: Mac, iPad, iPhone, Supervised

Safari

Browser basics

Disallow use of Safari: Disables the Safari web browser app, and its icon is removed from the Home screen. This setting also prevents users from opening web clips. Requires a supervised device. Available in iOS 4 and later.
- Platforms: iPad, iPhone, Supervised
Disallow Safari AutoFill: Disables Safari Autofill. iPhone and iPad devices must be supervised. Available in iOS 4 and later, visionOS 2.0 and later, and macOS 10.13 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow Safari pop-ups: Disables pop-up windows in Safari. Available in iOS 4 and later.
- Platforms: iPad, iPhone
Force Safari fraud warnings: Enables fraud warnings in Safari. Available in iOS 4 and later.
- Platforms: iPad, iPhone
Disallow Safari Javascript: Disables the use of Javascript in Safari. Available in iOS 4 and later.
- Platforms: iPad, iPhone
Manage Safari cookies: Enforce cookie settings for Safari. Available in iOS 4 and later.
- Platforms: iPad, iPhone

TLS & privacy modes

Allow deprecated TLS versions in Safari: Allow the use of deprecated TLS versions 1.0/1.1 in Safari. Available in iOS 12.4 and later, and macOS 10.15.4 and later.
- Platforms: Mac, iPad, iPhone
Disallow Safari history clearing: Prevents a user from clearing browsing history in Safari. Available in iOS 26 and later, iPadOS 26 and later, macOS 26 and later, and visionOS 26 and later. Requires a supervised device.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow Safari private browsing: Prevents a user from enabling private browsing in Safari. Available in iOS 26 and later, iPadOS 26 and later, macOS 26 and later, and visionOS 26 and later. Requires a supervised device.
- Platforms: Mac, iPad, iPhone, Vision, Supervised

Siri

Siri access & content

Disallow use of Siri: Disables Siri. Available in iOS 5 and later, and macOS 10.15 and later, and visionOS 2.0 and later.
- Platforms: Mac, iPad, iPhone, Vision
Disallow use of Siri while device is locked: Disables Siri when the device is locked. This restriction is ignored if the device doesn’t have a passcode set. Available in iOS 5.1 and later.
- Platforms: iPad, iPhone
Disallow user-generated content in Siri: Prevents Siri from querying user-generated content from the web. Requires a supervised device. Available in iOS 7 and later.
- Platforms: iPad, iPhone, Supervised
Enable Siri profanity filter: Forces the use of the profanity filter with Siri. iPhone and iPad devices must be supervised. Available in iOS 11 and later, and macOS 10.14 and later.
- Platforms: Mac, iPad, iPhone, Supervised

On-device translation & dictation

Force on device translation: Prevent the device from connecting to the Siri servers for translations. Available in iOS 15, iPadOS 15, and later.
- Platforms: iPad, iPhone
Force on device dictation: Prevent the device from connecting to the Siri servers for dictation. Available in iOS 14.5, iPadOS 14.5 and later, visionOS 2.0 and later, and Mac computers with Apple silicon running macOS 14 and later.
- Platforms: Mac, iPad, iPhone, Vision

OS & general

HTTPS, PKI & profiles

Automatically reject untrusted HTTPS certificates: Automatically rejects untrusted HTTPS certificates without prompting the user. Available in iOS 5 and later, visionOS 1.1 and later.
- Platforms: iPad, iPhone, Vision
Disallow manual installation of configuration profiles and certificates: Prohibits the user from installing configuration profiles and certificates interactively. Requires a supervised device. Available in iOS 6 and later, macOS 13 and later, and visionOS 2.0 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow OTA PKI updates: Disables over-the-air PKI updates. Setting this restriction to false doesn’t disable CRL and OCSP checks. Available in iOS 7 and later.
- Platforms: iPad, iPhone
Disallow “Trust Enterprise Developer” option: Remove the Trust Enterprise Developer button in Settings > General > Profiles & Device Management, preventing apps from being provisioned by universal provisioning profiles. This restriction applies to free developer accounts. It doesn’t apply to enterprise app developers who are trusted because their apps were pushed through APNs. It also doesn’t revoke previously granted trust. Available in iOS 9 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision

Time, backups & privacy

Force automatic date and time: Enables the Set Automatically feature in Date & Time, and this can’t be disabled by the user. The device’s time zone is updated only when the device can determine its location using a cellular connection or Wi-Fi with location services enabled. Requires a supervised device. Available in iOS 12 and later, visionOS 2.0 and later, and tvOS 12.2 and later.
- Platforms: iPad, iPhone, Apple TV, Vision, Supervised
Force encrypted backups: Requires that all backups be encrypted. Available in iOS 4 and later.
- Platforms: iPad, iPhone
Force limited ad tracking: Limits ad tracking on Apple’s ad platform. Additionally, it disables app tracking and the Allow Apps To Request To Track setting. Available in iOS 7 and later, and up through macOS 11.
- Platforms: Mac, iPad, iPhone
Disallow Apple personalized advertisements: Limits Apple personalized advertising. Available in iOS 14, visionOS 2.0 and later, and macOS 12 and later.
- Platforms: Mac, iPad, iPhone, Vision
Disallow Mail Privacy Protection: Disables Mail Privacy Protection on the device. Requires a supervised device. Available in iOS 15.2 and later.
- Platforms: iPad, iPhone, Supervised

Camera, screen & device UI

Disallow use of camera: Disables the camera, and its icon is removed from the Home screen. Users are unable to take photographs. iPhone and iPad devices must be supervised. Available in iOS 4, visionOS 2.0, and macOS 10.11 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow modifying device name: Warning: This restriction, which prevents the device name from being changed, has been moved to the Device Name Library Item.
- Platforms: Mac, iPad, iPhone, Apple TV, Vision, Supervised
Disallow Erase All Content and Settings: Disable Erase All Content and Settings. Requires a supervised device. Available in iOS 8, macOS 12, visionOS 2.0, and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow modifying notification settings: Prevents changing notification settings. Requires a supervised device. Available in iOS 9.3 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision, Supervised
Disallow use of Screen Time: In iOS 12 or later, disables the “Enable Screen Time” option in the Screen Time UI in Settings and disables Screen Time if already enabled. Prior to iOS 12, this disables the “Enable Restrictions” option in the Restrictions UI in Settings. Requires a supervised device. Available in iOS 8 and later, and visionOS 2.0 and later.
- Platforms: iPad, iPhone, Vision, Supervised
Disallow screenshots and screen recording: Disables saving a screenshot of the display and capturing a screen recording. Available in iOS 4 and later, macOS 10.14.4 and later, visionOS 2.0 and later.
- Platforms: Mac, iPad, iPhone, Vision
Disallow Spotlight internet search results: Disables Spotlight Internet search results. Available in iOS 8 and later, and macOS 10.11 and later.
- Platforms: Mac, iPad, iPhone
Disallow modifying Wallpaper: Prevents wallpaper from being changed. iPhone and iPad devices must be supervised. Available in iOS 9 and later, and macOS 10.13 and later.
- Platforms: Mac, iPad, iPhone, Supervised
Disallow guest user: Disallow the ability to log in as a Guest user on iPad devices configured as Shared iPad. Available in iOS 13.4 and later.
- Platforms: iPad
Disallow auto dim: Prevents auto dim on iPads with OLED displays. Available in iOS and iPadOS 17.4 and later.
- Platforms: iPad, iPhone, Supervised

Pairing, recovery & Apple TV

Disallow Remote app pairing: Disables pairing Apple TV for use with the Remote app or Control Center widget. Requires a supervised device. Available in tvOS 10.2 and later.
- Platforms: Apple TV, Supervised
Disallow pairing with non-Configurator hosts: Disables host pairing with the exception of the supervision host. If no supervision host certificate has been configured, all pairing is disabled. Requires a supervised device. Available in iOS 7 and later.
- Platforms: iPad, iPhone, Supervised
Disallow device sleeping: Prevents device from sleeping. Requires a supervised device. Available in tvOS 13 and later.
- Platforms: Apple TV, Supervised
Allow boot to recovery by unpaired device: Allows devices to be booted into recovery by an unpaired device. Requires a supervised device. Available in iOS 14.5 and later.
- Platforms: iPad, iPhone, Supervised
Disallow Apple TV automatic screensaver: Disables the Apple TV from automatically starting the screensaver after inactivity. Available in tvOS 15.4 and later.
- Platforms: Apple TV

macOS system

Disallow use of Content Caching service: Disables content caching. Available in macOS 10.13 and later.
- Platforms: Mac
Disallow Universal Control: Disables Universal Control, which allows the Mac’s trackpad and keyboard to control additional Mac or iPad devices nearby. Available in macOS 13 and later.
- Platforms: Mac
Disallow startup disk modification: Prevents the user from selecting a different startup disk. Available in macOS 14 and later.
- Platforms: Mac
Disallow Time Machine backup: Prevents the user from setting up and using Time Machine. Available in macOS 14 and later.
- Platforms: Mac
Disallow local user creation: Prevents a user with the role of administrator from creating new users in Users & Groups in System Settings. Available in macOS 14 and later.
- Platforms: Mac
Bypass screen capture alerts: Prevents user notifications for content capture technologies in macOS 15.1 and later.
- Platforms: Mac, Supervised

Sharing

Apple Intelligence

Reports & external intelligence

Disallow Apple Intelligence reports: When checked, disallows Apple Intelligence reports. Requires a supervised device. Available in iOS and iPadOS 18.4 and later, macOS 15.4 and later, and visionOS 2.4 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow external intelligence integrations: Prevents the use of external, cloud-based intelligence services with Siri. Cannot be used with Shared iPad. Available in iOS 18.2 and later and macOS 15.2 and later, and visionOS 2.4 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow external intelligence integrations sign-in: Forces external intelligence providers into anonymous mode. If a user is already signed in to an external intelligence provider, applying this restriction will cause them to be signed out. Cannot be used with Shared iPad. Available in iOS 18.2 and later and macOS 15.2 and later, and visionOS 2.4 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Allowed external intelligence workspace IDs: When provided, only accounts in the specified workspace in the external intelligence system, such as ChatGPT, can sign in on the device. In ChatGPT, this ID can be found in the admin panel for your enterprise workspace. Requires a supervised device. Available in iOS and iPadOS 18.3 and macOS 15.3 and later, and visionOS 2.4 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised

Images & personalization

Disallow Genmoji: Prohibits creating new Genmoji. Requires a supervised device. Available in iOS and iPadOS 18 and later, and macOS 15 and later, and visionOS 2.4 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow Image Playground: Prohibits the use of image generation. Requires a supervised device. Available in iOS and iPadOS 18 and later, and macOS 15 and later, and visionOS 2.4 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow Image Wand: Prevent the use of Image Wand. Requires a supervised device. Available in iOS and iPadOS 18 and later, and visionOS 2.4 and later.
- Platforms: iPad, iPhone, Vision, Supervised
Disallow Personalized Handwriting Results: Prevents generating text in the user’s handwriting. Requires a supervised device. Available in iOS and iPadOS 18 and later.
- Platforms: iPad, iPhone, Supervised

Mail, Notes, Safari & writing

Disallow Mail smart replies: When checked, disallows smart replies in Mail. Requires a supervised device. Available in iOS and iPadOS 18.4 and later, macOS 15.4 and later, and visionOS 2.4 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow Mail summaries: Disallow the use of the summarize button in Mail. Requires a supervised device. Available in macOS 15.1 and later, and iOS and iPadOS 18.1 and later, and visionOS 2.4 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow transcription in Notes: Prevents transcription in Notes. Available in iOS 18.2 and later, iPadOS 18.2 and later, macOS 15.2 and later, and visionOS 2.4 and later. Requires a supervised device.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow Notes transcription summary: When checked, disallows transcription summaries in Notes. Requires a supervised device. Available in iOS and iPadOS 18.3 and macOS 15.3 and later, and visionOS 2.4 and later.
- Platforms: Mac, iPad, iPhone, Supervised
Disallow summarizing content in Safari: When checked, disallows summarizing content in Safari. Requires a supervised device. Available in iOS and iPadOS 18.4 and later, macOS 15.4 and later, and visionOS 2.4 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow writing tools: Prevent the user from using Apple Intelligence writing tools. Requires a supervised device. Available in iOS and iPadOS 18 and later, and macOS 15 and later, and visionOS 2.4 and later.
- Platforms: Mac, iPad, iPhone, Vision, Supervised
Disallow visual intelligence summarization: Disables visual intelligence summarization. Available in iOS 18.3 and later, iPadOS 18.3 and later, and visionOS 2.4 and later. Requires a supervised device.
- Platforms: iPad, iPhone, Supervised

Important Considerations

Supervision requirements

Many Apple restrictions only apply on supervised devices. Enroll those devices with Automated Device Enrollment or Apple Configurator.

Platform availability

Support varies by device type and OS. Confirm a restriction exists for your targets before you depend on it.

Policy and usability

Tighter restrictions can block legitimate work; looser ones may leave gaps. Set policies to match your risk and how people use devices.

Testing recommendations

Try changes on test hardware first. Undoing some restrictions may require re-enrolling the device.

Add an Android Restrictions Library Item

Block parts of device behavior on company-owned work profile Android devices with the Android Restrictions Library Item. Enforcement uses the Android Management API. To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the Library Overview article.

Navigate to Library

Navigate to the Iru Endpoint Library

Add Library Item

Select Add Library Item in the upper-right corner.

Select Android Restrictions

Select Android Restrictions and click Add and configure in the lower-right corner.

Configure restrictions

Configure the Android Restrictions settings.

Save Configuration

Click Save.

Android restrictions reference

These controls mirror what Iru exposes from the Android Management API. Pick the ones that match your policy.

Access work contacts from personal profile apps

Specify how personal apps can access work profile contacts, including contact searches and incoming calls.

Allow. Personal apps can use work contacts unless you list specific apps to block.
Deny. Personal apps cannot use work contacts unless you list specific apps to allow.
Allow for system apps only. System apps can use work contacts; you maintain a list of any other apps that may use them.

Add exception

Click Add exception. In the picker, use Search the Play Store in the embedded view (click Select for each app, repeat as needed), or open the Add package name tab, enter App name and Package name (for example Google Chrome and com.android.chrome), click Add for each row, then click Done. You can also click + Add app on the restriction to add another row to the table.The line above the table is Except deny for if Allow is selected, Except allow for if Deny is selected, or and if Allow for system apps only is selected. Each row lists App name and Package name.

Cross profile data sharing

Disallow cross profile copy & paste

Controls the clipboard between the work profile and the personal profile. Under Android’s managed policy model there are two outcomes: either paste is allowed both ways across profiles, or (the common default) paste into the personal profile from text copied in work is blocked while paste from personal into work can still be allowed. Check the option shown in Iru and verify on a test device if you need a specific direction.

Disallow camera access

Disables camera access for the profile or device scopes you enable in the table. Honor any Android 12+ (or similar) requirement shown next to the control.

Disallow screen capture

Restricts screen capture for the scopes you select in the table.

Disallow private space

Blocks creation of a private space. An existing private space may be removed when this restriction is applied.

Limit number of days work profile can be paused

When enabled, set Max days for how long the work profile can remain paused. While the work profile is paused, the device may defer commands and policy updates.

Disallow work profile widgets

Specify if work profile applications are allowed to add widgets to the device home screen. Note, this does not prevent adding work app shortcuts to the device home screen.

Disallow work profile app functions

Determine if work profile app functions are allowed and able to be accessed by the personal profile. Configuration options include:

Allow work app functions and allow personal apps to call them
Allow work app functions and prevent personal apps from calling them
Disallow work app functions

Disallow apps from unknown sources

Blocks installing apps from unknown sources for the scopes you select in the table.

Disallow Android Developer Mode

Typically applies at Device scope.

Default app permissions

Applies to the work profile. Chooses the default response to runtime permission requests for work apps:

Prompt
Grant
Deny

Configuration options depend on Android version and hardware. The Iru web app shows what you can set for each Library Item.

Android-Specific Considerations

Android Developer Mode: Android Developer Mode is disabled by default for managed Android devices. To allow Android Developer Mode, apply an Android Restrictions Library Item with Disallow Android Developer Mode deselected.
Disallow screen capture: Google supports turning off screen capture for the whole device or for the work profile only—not for the personal profile alone.
Disallow apps from unknown sources: You can block unknown-source installs for the whole device or for the work profile only—not for the personal profile alone.

Deploy to Devices

Assign the Android Restrictions Library Item to a Blueprint and click Save to deploy to your Android devices.

Work profile vs device: On company-owned work profile devices, some controls apply to the whole device and some only to the work profile. Iru shows the scope next to each restriction while you configure the Library Item.

Important Considerations

Android Management API limits

You only get controls the Android Management API exposes. Apple and Android policies do not always line up one-to-one.

Work profile vs device-wide

Some Android restrictions apply to the full device; others only to the work profile. Check scope in Iru when you configure the Library Item.

Testing recommendations

Verify on representative devices and Android versions before a wide rollout. OEMs can interpret policies slightly differently.

General

Devices

Agent

Blueprints

Enrollment

Library

Deployment Guides

Settings

Integrations

Endpoint Detection & Response

Vulnerability Management

API

Configure the Restrictions Library Item

What are Restrictions?

How Restrictions work

Add an Apple Restrictions Library Item

Apple restrictions reference

Important Considerations

Supervision requirements

Platform availability

Policy and usability

Testing recommendations

Add an Android Restrictions Library Item

Android restrictions reference

Android-Specific Considerations

Deploy to Devices

Important Considerations

Android Management API limits

Work profile vs device-wide

Testing recommendations

General

Devices

Agent

Blueprints

Enrollment

Library

Deployment Guides

Settings

Integrations

Endpoint Detection & Response

Vulnerability Management

API

​What are Restrictions?

​How Restrictions work

​Add an Apple Restrictions Library Item

​Apple restrictions reference

​Important Considerations

Supervision requirements

Platform availability

Policy and usability

Testing recommendations

​Add an Android Restrictions Library Item

​Android restrictions reference

​Android-Specific Considerations

​Deploy to Devices

​Important Considerations

Android Management API limits

Work profile vs device-wide

Testing recommendations

What are Restrictions?

How Restrictions work

Add an Apple Restrictions Library Item

Apple restrictions reference

Important Considerations

Add an Android Restrictions Library Item

Android restrictions reference

Android-Specific Considerations

Deploy to Devices

Important Considerations