Relution Signet Customer Hub

Restrictions

The following is an overview of the available iOS/iPadOS restrictions. The structure follows the sections of the form in the portal.

In the form, individual restrictions carry additional notes: Supervised (only effective on supervised devices), Supports user enrollment (also effective with user enrollment), Deprecated, Deprecated on unsupervised devices and the minimum OS version, e.g. iOS 16+. These notes are stated for each restriction in the overview.

Unless stated otherwise for an option, it is enabled by default.

The download icon at the top of the form (Export restrictions as CSV file) downloads the configured values, including unsaved changes, as a CSV file.

Recommended restrictions →

Device

The device restrictions are divided into two sections.

Device restrictions

Show all restrictions
  • Allow voice dialing
    • If disabled, voice dialing is not available while the device is locked with a passcode.
    • Marked as deprecated in the portal (Deprecated).
  • Allow Touch ID / Face ID for unlock
    • If disabled, the device cannot be unlocked using Touch ID or Face ID. If unlocking is allowed again, the feature must be set up again in the device settings.
    • Only effective on supervised devices (Supervised).
  • Enable Activity Continuation
    • If disabled, other devices cannot hand off activities to this device via Handoff.
  • Force Apple Watch wrist detection
    • If enabled, wrist detection is enforced on a paired Apple Watch.
    • Disabled by default.
    • Also effective with user enrollment (Supports user enrollment).
  • Allow eSIM modification
    • If disabled, no cellular plan can be added to or removed from the eSIM of the device.
  • Allow temporary sessions on Shared iPads
    • If disabled, signing in as a guest on Shared iPads is not possible.
  • Allow AirDrop
    • If disabled, AirDrop cannot be used.
    • Only effective on supervised devices (Supervised).
  • Enable pairing with Macs or PCs
    • If disabled, pairing with a Mac or PC is not possible, with the exception of the supervision host. If no supervision host certificate has been configured, all pairing is disabled.
    • Only effective on supervised devices (Supervised).
  • Allow definition lookup
    • If disabled, the definition lookup feature is not available.
    • Disabled by default.
    • Only effective on supervised devices; marked as deprecated in the portal (Supervised, Deprecated).
    • From iOS 26.4, also controllable via the Keyboard Settings → configuration.
  • Allow paired watch
    • If disabled, pairing with an Apple Watch is not possible. Any Apple Watch that is already paired is unpaired and erased immediately.
    • Only effective on supervised devices (Supervised).
  • Allow Keyboard Shortcuts
    • If disabled, keyboard shortcuts cannot be used.
    • Only effective on supervised devices (Supervised).
  • Allow proximity setup for new devices
    • If disabled, setting up new devices nearby via proximity is not available.
    • Only effective on supervised devices (Supervised).
  • Allow iBeacon discovery of AirPrint printers
    • If enabled, AirPrint printers are discovered using iBeacons. If disabled, spurious AirPrint Bluetooth beacons are prevented from phishing for network traffic.
    • Only effective on supervised devices (Supervised).
  • Allow AirPrint
    • If disabled, AirPrint is not available.
    • Only effective on supervised devices (Supervised).
  • Allow USB connection while locked
    • If enabled, the USB connection is established even while the device is locked, e.g. for a LAN adapter while the device is in Lost Mode. If the option is disabled, no USB connection is established while the device is locked.
    • Disabled by default.
    • Only effective on supervised devices (Supervised).
  • Allow auto unlock
    • If disabled, the device cannot be unlocked automatically with an Apple Watch.
  • Perform dictation on the device only, do not connect to Siri servers
    • If enabled, the device does not connect to Siri servers for dictation.
    • Disabled by default.
    • Also effective with user enrollment; marked as deprecated in the portal (Supports user enrollment, Deprecated).
  • Perform translation on the device only, do not connect to Siri servers
    • If enabled, the device does not connect to Siri servers for translation.
    • Disabled by default.
    • Marked as deprecated in the portal (Deprecated).
  • Allow Password Proximity Requests
    • If disabled, the device cannot request passwords from nearby devices.
    • Only effective on supervised devices (Supervised).
  • Allow Password Sharing
    • If disabled, passwords cannot be shared via AirDrop.
    • Only effective on supervised devices (Supervised).
  • Allow Access to USB Devices in the Files app
    • If disabled, the Files app cannot connect to attached USB devices.
    • Only effective on supervised devices (Supervised).
  • Allow Access to Network Devices in the Files app
    • If disabled, the Files app cannot connect to network drives.
    • Only effective on supervised devices (Supervised).
  • Allow booting into recovery mode by an unpaired device
    • If enabled, the device can be booted into recovery mode by an unpaired USB device.
    • Disabled by default.
    • Only effective on supervised devices (Supervised).
  • Allow iPhone widgets on Mac
    • If disabled, widgets from the iPhone cannot be shown on a Mac.
    • Requires iOS 17 or later and only effective on supervised devices (iOS 17+, Supervised).
  • Allow NFC
    • If disabled, NFC is not available on the device.
    • Only effective on supervised devices (Supervised).
  • Allow iPhone mirroring
    • If disabled, the iPhone cannot be mirrored on a Mac.
    • Requires iOS 18 or later and only effective on supervised devices (iOS 18+, Supervised).
  • Allow auto dimming the screen
    • If disabled, the screen is not dimmed automatically.
    • Requires iOS 17.4 or later and only effective on supervised devices (iOS 17.4+, Supervised).
  • Allow Hiding Apps
    • If disabled, apps cannot be hidden on the device.
    • Requires iOS 18 or later and only effective on supervised devices (iOS 18+, Supervised).
  • Allow Locking Apps
    • Allows apps to be locked. Because hiding an app also requires locking it, apps cannot be hidden either if this option is disabled.
    • Requires iOS 18 or later and only effective on supervised devices (iOS 18+, Supervised).
  • Allow the connection to and use of satellite services
    • If disabled, the device cannot connect to or use satellite services.
    • Requires iOS 18.4 or later and only effective on supervised devices (iOS 18.4+, Supervised).
  • Disable Jailbreak detection
    • If enabled, the jailbreak status of the device is not checked.
    • Disabled by default.

Update Restrictions

Show all restrictions
  • Force delayed software updates
    • If enabled, OS updates are hidden for the specified number of days after their release. This also applies to security updates.
    • The Delay a software update in days field accepts a value from 0 to 90 (default: 30). The field can only be edited if the option is enabled.
    • Disabled by default.
    • Only effective on supervised devices (Supervised).
  • Allow Rapid Security Response Installation
    • If disabled, Rapid Security Responses cannot be installed.
    • Requires iOS 16 or later and only effective on supervised devices (iOS 16+, Supervised).
  • Allow Rapid Security Response Removal
    • If disabled, installed Rapid Security Responses cannot be removed.
    • Requires iOS 16 or later and only effective on supervised devices (iOS 16+, Supervised).

Apps

The app restrictions are grouped by area of use.

General

Show all restrictions
  • Allow In-App Purchase
    • If disabled, in-app purchases are not possible.
  • Require Apple ID password for all purchases
    • If enabled, the Apple Account password must be entered for every transaction.
    • Disabled by default.
    • Marked as deprecated in the portal (Deprecated).
  • Allow Enterprise App Trust
    • If disabled, the Trust “[developer]” button under Settings → General → VPN & Device Management disappears; this prevents apps from being provisioned by universal provisioning profiles. This restriction applies to free developer accounts, but not to enterprise app developers who are trusted because their apps were distributed via MDM. Trust that has already been granted is not revoked.
  • Allow Apps to use cellular data
    • If disabled, changes to the cellular data usage of apps are not possible.
    • Only effective on supervised devices (Supervised).
  • Allow spotlight to return internet search results
    • If disabled, Spotlight no longer displays Internet search results.
    • Only effective on supervised devices (Supervised).
  • Allow installing apps
    • If disabled, the App Store cannot be used and its icon is removed from the Home Screen. Apps can neither be installed nor updated on the device.
    • Only effective on supervised devices; deprecated on unsupervised devices (Supervised, Deprecated on unsupervised devices).
  • Allow App Removal
    • If disabled, apps cannot be removed from the device.
    • Only effective on supervised devices; deprecated on unsupervised devices (Supervised, Deprecated on unsupervised devices).
  • Allow Spell Check
    • If disabled, words are not corrected when entering text.
    • Only effective on supervised devices; marked as deprecated in the portal (Supervised, Deprecated).
    • From iOS 26.4, also controllable via the Keyboard Settings → configuration.
  • Allow Predictive Keyboard
    • If disabled, words are not completed automatically when entering text.
    • Only effective on supervised devices; marked as deprecated in the portal (Supervised, Deprecated).
    • From iOS 26.4, also controllable via the Keyboard Settings → configuration.
  • Allow Auto Correction
    • If disabled, auto-correction is not available when typing.
    • Only effective on supervised devices; marked as deprecated in the portal (Supervised, Deprecated).
    • From iOS 26.4, also controllable via the Keyboard Settings → configuration.
  • Allow App Store
    • If disabled, the App Store is not available and its icon is removed from the Home Screen. Apps can still be installed and updated using host apps such as iTunes or Apple Configurator.
    • Only effective on supervised devices (Supervised).
  • Allow automatic app downloads
    • Controls the automatic download of apps purchased on other devices. Updates to apps that are already installed are not affected.
    • Only effective on supervised devices (Supervised).
  • Allow Dictation
    • If disabled, dictation is not available.
    • Only effective on supervised devices; marked as deprecated in the portal (Supervised, Deprecated).
    • From iOS 26.4, also controllable via the Keyboard Settings → configuration.
  • Allow system app removal
    • If disabled, system apps cannot be removed.
    • Only effective on supervised devices (Supervised).
  • Force authentication before auto fill
    • If enabled, authentication is required before passwords or credit card information are filled in automatically in Safari or other apps. If disabled, the user does not need to authenticate and can toggle the feature in Settings. Only supported on devices with Face ID or Touch ID.
    • Only effective on supervised devices (Supervised).
  • Allow Password AutoFill
    • If disabled, the AutoFill Passwords feature is not available, and Safari and other apps do not offer to use a saved password. In addition, automatic strong passwords are disabled and not suggested.
    • Only effective on supervised devices (Supervised).
  • Allow modification of Touch ID or Face ID
    • If disabled, Touch ID and Face ID cannot be modified.
    • Only effective on supervised devices (Supervised).
  • Allow App Clips
    • If disabled, all existing App Clips on the device are removed.
  • Allow ‘Find my device’ in the ‘Find my’ app
    • If disabled, the Find My Device option is not available in the Find My app.
    • Only effective on supervised devices (Supervised).
  • Allow changes to ‘Find my friends’
    • If disabled, the Find My Friends settings cannot be changed.
    • Only effective on supervised devices (Supervised).
  • Allow ‘Find my friends’ in the Find my App
    • If disabled, the Find My Friends option is not available in the Find My app.
    • Only effective on supervised devices (Supervised).
  • Allow alternative marketplace apps installations
    • If disabled, the system prevents the installation of alternative app marketplaces from the web and prevents installed alternative app marketplaces from installing apps.
    • Requires iOS 17.4 or later (iOS 17.4+).
  • Allow installation of apps directly from the web
    • If disabled, apps cannot be installed directly from websites (web distribution).
    • Requires iOS 17.5 or later (iOS 17.5+).
  • Limit ad tracking
    • If enabled, ad tracking is limited. In addition, app tracking and the Allow Apps to Request to Track setting are disabled.
    • Disabled by default.

Safari

Show all restrictions
  • Allow use of Safari
    • If disabled, the Safari app is not available and its icon is hidden from the Home Screen. In addition, web links on the Home Screen (web clips) can no longer be opened.
    • If the option is disabled, the related Safari options (autofill, summarization, fraud warning, JavaScript, pop-ups, clearing browsing history, private browsing) can no longer be edited.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • Enable autofill
    • If disabled, autofill is not available in Safari.
  • Allow Safari content summarization
    • If disabled, Apple Intelligence cannot create summaries of content in Safari.
    • Requires iOS 18.4 or later and only effective on supervised devices (iOS 18.4+, Supervised).
  • Force fraud warning
    • If enabled, the display of fraud warnings in Safari is enforced.
    • Disabled by default.
    • Also effective with user enrollment (Supports user enrollment).
  • Enable JavaScript
    • If disabled, Safari does not execute JavaScript.
  • Allow pop-ups
    • If disabled, pop-ups cannot be displayed in Safari.
  • Allow clearing browsing history in Safari
    • If disabled, the browsing history in Safari cannot be cleared.
    • Requires iOS 26 or later and only effective on supervised devices (iOS 26+, Supervised).
  • Allow private browsing in Safari
    • If disabled, private browsing is not available in Safari.
    • Requires iOS 26 or later and only effective on supervised devices (iOS 26+, Supervised).
  • Accept cookies
    • Determines the conditions under which the device accepts cookies: Always (default), From visited websites or Never. The selection remains editable even if Allow use of Safari is disabled.

Siri

All options in this section are marked Deprecated in the portal.

Show all restrictions
  • Allow Siri
    • If disabled, Siri is not available. The other Siri options can then no longer be edited.
    • Also effective with user enrollment; marked as deprecated in the portal (Supports user enrollment, Deprecated).
  • Allow Siri while device is locked
    • If disabled, Siri cannot be used while the device is locked. This setting is ignored if no passcode is set on the device.
    • Also effective with user enrollment; marked as deprecated in the portal (Supports user enrollment, Deprecated).
  • Enable Siri profanity filter
    • If enabled, the use of the Siri profanity filter is enforced.
    • Disabled by default.
    • Only effective on supervised devices; marked as deprecated in the portal (Supervised, Deprecated).
  • Allow Siri to query user content on the web
    • If disabled, Siri is not allowed to query user-generated content on the web.
    • Only effective on supervised devices; marked as deprecated in the portal (Supervised, Deprecated).

Other Apps

Show all restrictions
  • Protect mail activity
    • If enabled, the IP address is hidden and remote content is loaded securely in the background, even if an email is not opened. This makes it more difficult for senders to track email activity.
    • Requires iOS 15.2 or later (iOS 15.2+).
  • Enable use of the Messages App
    • If disabled, the Messages app cannot be used.
    • Only effective on supervised devices (Supervised).
  • Allow Music Service
    • If disabled, Apple Music cannot be used and the Music app reverts to classic mode.
    • Only effective on supervised devices (Supervised).
  • Allow use of iTunes Store
    • If disabled, the iTunes Store is not available and its icon is hidden from the Home Screen. Content can then neither be previewed nor purchased or downloaded.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • Allow Mail Summary
    • If disabled, summaries of email messages cannot be created manually. Automatically generated summaries are not affected.
    • Requires iOS 18.1 or later and only effective on supervised devices (iOS 18.1+, Supervised).
  • Allow smart replies in Mail
    • If disabled, Mail does not suggest smart replies.
    • Requires iOS 18.2 or later and only effective on supervised devices (iOS 18.2+, Supervised).
  • Allow transcription in Notes
    • If disabled, audio recordings cannot be transcribed in the Notes app.
    • Requires iOS 18.2 or later and only effective on supervised devices (iOS 18.2+, Supervised).
  • Allow transcription summarization
    • If disabled, no summaries are created for transcriptions. The option can only be edited if Allow transcription in Notes is enabled.
    • Requires iOS 18.3 or later and only effective on supervised devices (iOS 18.3+, Supervised).

Managed Apps and Documents

These settings control the exchange of data between managed and unmanaged apps.

Managed Apps and Documents restrictions

Show all restrictions
  • Allow opening managed documents in unmanaged apps
    • If disabled, documents from managed apps and accounts only open in other managed apps and accounts. As of iOS 11.3, this also applies to contacts.
    • Also effective with user enrollment (Supports user enrollment).
  • Allow unmanaged apps to read managed contacts
    • If enabled, unmanaged apps are allowed to read managed contacts. The option can only be edited and only takes effect if Allow opening managed documents in unmanaged apps is disabled.
    • Disabled by default.
    • Also effective with user enrollment (Supports user enrollment).
  • Allow managed apps to write unmanaged contacts
    • If enabled, managed apps are allowed to create unmanaged contacts. The option can only be edited and only takes effect if Allow opening managed documents in unmanaged apps is disabled.
    • Disabled by default.
  • Allow opening unmanaged documents in managed apps
    • If disabled, documents from unmanaged apps and accounts only open in other unmanaged apps and accounts.
    • Also effective with user enrollment (Supports user enrollment).
  • Also apply the Allow opening … settings for copy and paste
    • If enabled, the Allow opening managed documents in unmanaged apps and Allow opening unmanaged documents in managed apps restrictions also control whether information copied from managed apps can be pasted into unmanaged apps and vice versa.
    • Disabled by default.
    • Also effective with user enrollment (Supports user enrollment).
  • Allow managed apps to use iCloud sync
    • If disabled, managed apps cannot use iCloud synchronization.
    • Also effective with user enrollment (Supports user enrollment).
  • AirDrop targets considered as unmanaged
    • If enabled, all AirDrop destinations are always considered unmanaged.
    • Disabled by default.
    • Also effective with user enrollment (Supports user enrollment).

Settings

The following restrictions apply to the system settings of the device.

Settings restrictions

Show all restrictions
  • Send diagnostic and usage data to Apple
    • If disabled, the device does not automatically send diagnostic and usage data to Apple.
    • Also effective with user enrollment (Supports user enrollment).
  • Allow personalized advertising from Apple
    • If disabled, personalized advertising from Apple is restricted.
  • Allow over-the-air PKI updates
    • If disabled, no over-the-air updates of the certificate trust information (PKI) are installed. CRL and OCSP checks are not disabled by this.
  • Allow users to accept untrusted TLS certificates
    • If disabled, untrusted HTTPS certificates are rejected automatically without a prompt.
  • Allow screen shots and screen recordings
    • If disabled, screenshots and screen recordings cannot be made. In addition, screen observation in the Classroom app is not available, and the Allow remote screen observation by Classroom App option can no longer be edited.
    • Also effective with user enrollment (Supports user enrollment).
  • Allow remote screen observation by Classroom App
    • If disabled, remote screen observation by the Classroom app is not possible.
  • Allow user to install configuration profiles
    • If disabled, configuration profiles and certificates cannot be installed manually on the device.
    • Only effective on supervised devices (Supervised).
  • Allow enabling Restrictions and ScreenTime in Settings
    • If disabled, the Enable Restrictions option in Settings is not available. Also, on iOS 12 or later, turning on Screen Time is not available and, if it is already active, it is disabled.
    • Only effective on supervised devices (Supervised).
  • Enable Erase All Content and Settings
    • If disabled, the Erase All Content and Settings option in the Reset menu is hidden.
    • Only effective on supervised devices (Supervised).
  • Allow AirPrint credentials storage
    • If disabled, the user name and password for AirPrint are not stored in the keychain.
    • Disabled by default.
    • Only effective on supervised devices (Supervised).
  • Require trusted TLS for AirPrint
    • If enabled, communication with printers is only possible with a trusted TLS certificate.
    • Disabled by default.
    • Only effective on supervised devices (Supervised).
  • Force Automatic Date and Time
    • If enabled, the date and time setting is set to automatic and cannot be changed on the device. The time zone of the device is only updated if the device can determine its location (cellular or Wi-Fi connection with location services enabled).
    • Disabled by default.
    • Only effective on supervised devices (Supervised).
  • Prohibit switching off the Wi-Fi
    • If enabled, Wi-Fi cannot be turned off, even in Airplane Mode. Switching between Wi-Fi networks is still possible.
    • Disabled by default.
    • Only effective on supervised devices (Supervised).
  • Allow usage of the QuickPath keyboard
    • Allows typing using swipe gestures (QuickPath).
    • Only effective on supervised devices (Supervised).
    • From iOS 26.4, also controllable via the Keyboard Settings → configuration.
  • Allow Call Recording
    • If disabled, calls cannot be recorded.
    • Requires iOS 18.1 or later and only effective on supervised devices (iOS 18.1+, Supervised).
  • Allow RCS Messaging
    • If disabled, RCS messaging cannot be used.
    • Requires iOS 18.1 or later and only effective on supervised devices (iOS 18.1+, Supervised).
  • Blocked ICCIDs for RCS messaging
    • ICCIDs of cellular plans that must not be used for RCS messaging. Up to 4 ICCIDs are possible; the list is empty by default. The field can only be edited if Allow RCS Messaging is enabled.
    • Requires iOS 26 or later and only effective on supervised devices (iOS 26+, Supervised).

Classroom

The following restrictions apply to controlling the devices via the Classroom app.

Classroom restrictions

Show all restrictions
  • Allow teachers to observe devices via the Apple Classroom without prompting to the user
    • Only takes effect if Allow remote screen observation by Classroom App and Allow screen shots and screen recordings are enabled in the Settings section. Otherwise, the form displays a notice.
    • Disabled by default.
    • Only effective on supervised devices (Supervised).
  • Allow teachers to lock apps and devices via Apple Classroom without prompting to the user
    • Allows the teacher to lock devices or an app open on the device via Apple Classroom without requesting confirmation.
    • Disabled by default.
    • Only effective on supervised devices (Supervised).
  • Force automatic Classroom-class join
    • If enabled, requests from the teacher in the Classroom app are accepted automatically without a prompt on the device.
    • Disabled by default.
    • Only effective on supervised devices (Supervised).
  • Request permission on leaving Classroom-class
    • If enabled, leaving an unmanaged course requires the teacher’s permission.
    • Disabled by default.
    • Only effective on supervised devices (Supervised).

Media

The following restrictions apply to media content and its playback.

Media restrictions

Show all restrictions
  • Allow use of camera
    • If disabled, the camera icon is removed from the Home Screen and it is no longer possible to take photos or videos in any app.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • Exemptions
    • The selected apps are exempt from the Allow use of camera restriction. They are not automatically granted access to the camera. The list can only be edited and only takes effect if Allow use of camera is disabled.
    • Requires iOS 26 or later and only effective on supervised devices (iOS 26+, Supervised).
  • Allow Photo Stream
    • If disabled, Photo Stream cannot be used.
    • Marked as deprecated in the portal (Deprecated).
  • Allow Shared Photo Streams
    • If disabled, shared Photo Streams cannot be used.
  • Allow downloads of media tagged as Erotica
    • If disabled, books tagged as erotica cannot be downloaded from the Book Store.
  • Force a pairing password for AirPlay requests from this device
    • If enabled, all devices receiving AirPlay requests from this device must use a pairing password.
    • Disabled by default.
    • Also effective with user enrollment (Supports user enrollment).
  • Allow use of Gamecenter
    • If disabled, Game Center cannot be used. The Allow Multiplayer gaming and Allow adding friends to the Game Center options can then no longer be edited.
    • Only effective on supervised devices (Supervised).
  • Allow Multiplayer gaming
    • If disabled, multiplayer games via Game Center are not possible.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • Allow adding friends to the Game Center
    • If disabled, no friends can be added to Game Center.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • Enable iBookstore
    • If disabled, the Book Store cannot be used.
    • Only effective on supervised devices (Supervised).
  • Enable Podcasts
    • If disabled, the Podcasts app cannot be used.
    • Only effective on supervised devices (Supervised).
  • Allow News
    • If disabled, the News widget and Apple News are not displayed.
    • Only effective on supervised devices (Supervised).
  • Enable Apple Music Radio
    • If disabled, Apple Music Radio cannot be used.
    • Only effective on supervised devices (Supervised).
  • Blocked ICCIDs for iMessage and FaceTime
    • ICCIDs of cellular plans that must not be used for iMessage and FaceTime. Up to 4 ICCIDs are possible; the list is empty by default.
    • Requires iOS 26 or later and only effective on supervised devices (iOS 26+, Supervised).
  • Allow FaceTime conferencing
    • If disabled, FaceTime video conferencing cannot be used.
    • Only effective on supervised devices (Supervised).
  • Allow a remote FaceTime session to request control of the device
    • If disabled, remote control of the device cannot be requested in a FaceTime session.
    • Requires iOS 18.4 or later and only effective on supervised devices (iOS 18.4+, Supervised).
  • Allow explicit music, podcasts & iTunes U
    • If disabled, explicit music or video content purchased from the iTunes Store is hidden. Explicit content is marked as such by the content providers, such as record labels, when sold through the iTunes Store.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • The maximum age restriction level of app content allowed
    • Sets the highest age rating for apps that may be installed: None, 4+, 9+, 12+, 17+ or All. Default: Unspecified.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • The maximum age restriction level of movie content
    • Sets the highest age rating for movies that may be downloaded and watched: None, G, PG, PG-13, R, NC-17 or All. Default: Unspecified.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • The maximum age restriction of TV content allowed on the device
    • Sets the highest age rating for TV shows that may be downloaded and watched: None, TV-Y, TV-Y7, TV-G, TV-PG, TV-14, TV-MA or All. Default: Unspecified.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).

Modifications

These restrictions define which settings may be changed on the device.

Modifications restrictions

Show all restrictions
  • Allow Account modification
    • If disabled, account modifications are not possible in Settings.
    • Only effective on supervised devices (Supervised).
  • Allow passcode modification
    • If disabled, the device passcode cannot be added, changed or removed. This restriction is ignored by Shared iPads.
    • Only effective on supervised devices (Supervised).
  • Allow device name modification
    • If disabled, the device name cannot be changed.
    • Only effective on supervised devices (Supervised).
  • Allow wallpaper modification
    • If disabled, the wallpaper cannot be changed.
    • Only effective on supervised devices (Supervised).
  • Allow modification of notification settings
    • If disabled, the notification settings cannot be changed.
    • Only effective on supervised devices (Supervised).
  • Allow settings modification in app analytics
    • If disabled, the settings for sending diagnostic and app analytics data cannot be changed.
    • Only effective on supervised devices (Supervised).
  • Allow modification of Bluetooth settings
    • If disabled, the Bluetooth settings cannot be changed.
    • Only effective on supervised devices (Supervised).
  • Force WiFi whitelisting
    • The devices can only join Wi-Fi networks that were configured via a Wi-Fi configuration in a policy or via Apple Configurator (.mobileconfig).
    • Disabled by default.
    • Only effective on supervised devices (Supervised).
  • Allow VPN configurations creation
    • If disabled, it is not possible to create VPN configurations.
    • Only effective on supervised devices (Supervised).
  • Allow cellular plan modification
    • If enabled, the cellular plan settings can be changed on the device.
    • Disabled by default.
    • Only effective on supervised devices (Supervised).
  • Allow personal hotspot modification
    • If disabled, the personal hotspot settings cannot be changed.
    • Only effective on supervised devices (Supervised).
  • Allow default browser preference modification
    • If disabled, the default browser cannot be changed on the device. Setting it via an MDM command is still possible.
    • Requires iOS 18.2 or later and only effective on supervised devices (iOS 18.2+, Supervised).
  • Allow default calling app preference modification
    • If disabled, the default calling app cannot be changed on the device. Setting it via an MDM command is still possible.
    • Requires iOS 18.4 or later and only effective on supervised devices (iOS 18.4+, Supervised).
  • Allow default messaging app preference modification
    • If disabled, the default messaging app cannot be changed on the device. Setting it via an MDM command is still possible.
    • Requires iOS 18.4 or later and only effective on supervised devices (iOS 18.4+, Supervised).

iCloud

The following restrictions apply to the iCloud services on the device.

iCloud restrictions

Show all restrictions
  • Allow iCloud backup
    • If disabled, iCloud backups of the device are not possible.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • Allow iCloud keychain synchronisation
    • If disabled, iCloud Keychain synchronization cannot be used.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • Allow iCloud Photo Library
    • If disabled, iCloud Photo Library is not available. Photos that have not yet been fully downloaded are removed from local storage.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • Allow iCloud documents & data
    • If disabled, synchronization of iCloud documents and data is not possible.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • Allow iCloud private relay
    • If disabled, internet traffic is not routed through iCloud Private Relay.
    • Only effective on supervised devices (Supervised).

Lockscreen

The following restrictions apply to the lock screen of the device.

Lockscreen restrictions

Show all restrictions
  • Allow Control Center to appear on the lock screen
    • If disabled, Control Center cannot be opened on the lock screen.
    • Also effective with user enrollment (Supports user enrollment).
  • Allow Notifications to show in the Notification Center on the lock screen
    • If disabled, no notifications are shown on the lock screen and Notification Center cannot be opened while the device is locked.
    • Also effective with user enrollment (Supports user enrollment).
  • Allow Today view in Notification Center on the lock screen
    • If disabled, the Today view is not available while the device is locked.
    • Also effective with user enrollment (Supports user enrollment).
  • Show Passbook notifications on the lock screen
    • If disabled, Wallet notifications (formerly Passbook) are not shown on the lock screen.

Backups and Synchronization

The following restrictions apply to backups, synchronization and the eSIM of the device.

Backups and Synchronization restrictions

Show all restrictions
  • Force encrypted backups
    • If enabled, all backups are encrypted.
    • Disabled by default.
    • Also effective with user enrollment (Supports user enrollment).
  • Backup Enterprise books
    • If disabled, Enterprise books are not backed up.
    • Also effective with user enrollment (Supports user enrollment).
  • Sync Enterprise books’ notes and highlights
    • If disabled, notes and highlights in Enterprise books are not synchronized.
    • Also effective with user enrollment (Supports user enrollment).
  • Allow automatic sync while roaming
    • If disabled, background data fetching is turned off while roaming.
  • Allow transfer of an eSIM to a different device
    • If disabled, the eSIM of the device cannot be transferred to another device.
    • Requires iOS 18 or later and only effective on supervised devices (iOS 18+, Supervised).
  • Preserve eSIM on erase
    • If enabled, the eSIM is preserved when the device is erased.
    • Disabled by default.
    • Requires iOS 17.2 or later (iOS 17.2+).

AI feature restrictions

These restrictions control the Apple Intelligence features.

General

Show all restrictions
  • Allow Genmoji creation
    • If disabled, Apple Intelligence cannot create personalized Genmoji.
    • Requires iOS 18 or later and only effective on supervised devices; marked as deprecated in the portal (iOS 18+, Supervised, Deprecated).
  • Allow image generation
    • If disabled, Apple Intelligence cannot generate images (Image Playground).
    • Requires iOS 18 or later and only effective on supervised devices; marked as deprecated in the portal (iOS 18+, Supervised, Deprecated).
  • Allow Apple Intelligence writing tools
    • If disabled, the Apple Intelligence writing tools (e.g. rewriting, proofreading or summarizing text) are not available.
    • Requires iOS 18 or later and only effective on supervised devices; marked as deprecated in the portal (iOS 18+, Supervised, Deprecated).
  • Allow using image wand
    • If disabled, Apple Intelligence cannot use Image Wand to create images from sketches or descriptions.
    • Requires iOS 18 or later and only effective on supervised devices; marked as deprecated in the portal (iOS 18+, Supervised, Deprecated).
  • Allow live voicemail
    • If disabled, Live Voicemail is not available on the device.
    • Requires iOS 17.2 or later and only effective on supervised devices (iOS 17.2+, Supervised).
  • Allow the system to generate text in the user’s handwriting
    • If disabled, the system cannot generate text in the user’s handwriting.
    • Requires iOS 18 or later and only effective on supervised devices; marked as deprecated in the portal (iOS 18+, Supervised, Deprecated).
  • Allow using external, cloud-based intelligence services
    • Enables the use of external, cloud-based intelligence services with Siri.
    • Requires iOS 18.2 or later; also effective with user enrollment; marked as deprecated in the portal (iOS 18.2+, Supports user enrollment, Deprecated).
  • Allow signing in to external intelligence providers
    • If disabled, external intelligence providers are always used in anonymous mode. If a user is already signed in to an external intelligence provider, applying this restriction signs them out.
    • Requires iOS 18.2 or later; also effective with user enrollment; marked as deprecated in the portal (iOS 18.2+, Supports user enrollment, Deprecated).
  • Allow Apple Intelligence reports
    • If disabled, Apple Intelligence reports are not available.
    • Requires iOS 18.4 or later and only effective on supervised devices; marked as deprecated in the portal (iOS 18.4+, Supervised, Deprecated).
  • Allow visual intelligence summarization
    • If disabled, Visual Intelligence cannot create summaries.
    • Requires iOS 18.3 or later and only effective on supervised devices; marked as deprecated in the portal (iOS 18.3+, Supervised, Deprecated).
  • Allowed external integration workspace IDs
    • Currently limited by Apple to a single entry; the list is empty by default. If specified, Apple Intelligence only allows this workspace ID to be used for the external integration and requires a sign-in. If several configurations apply to a device, only the intersection of the specified IDs is allowed; with conflicting values, no workspace ID is allowed at all.
    • Requires iOS 18.3 or later and only effective on supervised devices; marked as deprecated in the portal (iOS 18.3+, Supervised, Deprecated).