Safari Extensions

The “Safari Extensions” configuration lets you centrally control the behavior of individual Safari extensions on managed iOS devices. For each extension, its unique identifier determines whether it is generally allowed, always enabled, or always disabled, whether it may also be used in private browsing, and which domains it may or may not access. Multiple extensions can be configured per policy.

Note: This configuration is only available for supervised iOS devices from iOS 18 that were enrolled through Device Enrollment; it cannot be used for devices in User Enrollment (BYOD).

Safari Extensions #

Settings per Safari extension #

• Extension identifier
  • The identifier of the Safari extension, or “*” to apply settings to all extensions. To manage the extension, the app it belongs to must be installed on the device. This identifier can be determined via codesign -dv <path to the extension (in the app's PlugIns directory)> on a macOS device, if the extension is available on macOS. Otherwise, this information must be provided by the extension’s developer.
• State
  • Controls whether the extension is allowed. Options: Allowed / Always On / Always Off.
• Private Browsing
  • Allow the extension in Private Browsing mode as well. Options: Allowed / Always On / Always Off.
• Allowed Domains
  • Controls the (sub)domains the Safari extension has access to. Domains without a prefix take precedence over those with a prefix; denied domains take precedence over allowed domains. Any domains not configured through either list can be configured by users on the device.
• Denied Domains
  • Controls the (sub)domains the Safari extension does not have access to. Domains without a prefix take precedence over those with a prefix; denied domains take precedence over allowed domains. Any domains not configured through either list can be configured by users on the device.