Relution Signet Customer Hub

Restrictions

The Restrictions policy configuration restricts or permits functions on managed macOS devices. The configuration corresponds to the Apple restrictions payload; which settings a device actually applies depends on the macOS version and on whether the device is managed in supervised mode.

The overview below follows the structure of the form in the portal. Many restrictions require a specific macOS version; the minimum version is shown as a hint on the restriction in the form (e.g. macOS 14+) and is stated in the overview. Restrictions marked Supervised only take effect on supervised devices, while restrictions marked Supports user enrollment also take effect on devices with user enrollment. Restrictions marked Deprecated have been deprecated by Apple; restrictions marked Deprecated on unsupervised devices are deprecated only on unsupervised devices.

By default, all options are enabled except Force on device only dictation, the three Force delay of … visibility switches, Enable Siri profanity filter, Allow the presentation of a screen capture alert and the four Classroom restrictions. The age ratings are set to All, and the Allowed external integration workspace IDs list is empty. A new configuration therefore does not restrict any function unless it is adjusted.

The download icon at the top of the form (Export restrictions as CSV file) downloads the configured values, including unsaved changes, as a CSV file.

Of the Recommended restrictions for iOS/iPadOS →, only the notes on Erase All Content and Settings and on delaying operating system updates also apply to macOS.

Device

The device restrictions are divided into three sections.

Device restrictions

Show all restrictions
  • Enable Activity Continuation
    • When disabled, other devices cannot hand off actions to this device via Handoff.
  • Allow AirDrop
    • When disabled, AirDrop cannot be used.
  • Allow user to install configuration profiles
    • When disabled, configuration profiles and certificates cannot be installed interactively.
    • Requires macOS 13 or later (macOS 13+).
  • Allow USB connection while locked
    • Controls USB restricted mode. Contrary to its label, disabling this option allows new USB accessories to connect without authorization; when it is enabled (default), the standard macOS behavior applies.
    • Requires macOS 13 or later (macOS 13+).
  • Allow Universal Control
    • When disabled, Universal Control is not available.
    • Requires macOS 13 or later (macOS 13+).
  • Allow iPhone mirroring
    • When disabled, the Mac cannot mirror an iPhone.
    • Requires macOS 15 or later and only effective on supervised devices (macOS 15+, Supervised).
  • Force on device only dictation
    • When enabled, connections to Siri servers for dictation are disabled.
    • Requires macOS 14 or later; also effective with user enrollment; marked as deprecated in the portal (macOS 14+, Supports user enrollment, Deprecated).
  • Allow Call Recording
    • When disabled, call recording is not available.
    • Requires macOS 26 or later (macOS 26+).
  • Allow live voicemail
    • When disabled, Live Voicemail is not available on the device.
    • Requires macOS 26 or later and only effective on supervised devices (macOS 26+, Supervised).
  • Allow Rosetta usage awareness
    • When disabled, no Rosetta usage notifications are shown when apps that use Rosetta translation are launched.
    • Requires macOS 26.4 or later (macOS 26.4+).

Authentication Restrictions

Show all restrictions
  • Allow auto unlock
    • When disabled, automatic unlocking of the Mac is not available.
  • Allow Touch ID for unlock
    • When disabled, the device cannot be unlocked using Touch ID.
    • Only effective on supervised devices (Supervised).
  • Allow passcode modification
    • When disabled, the device passcode cannot be added, changed or removed.
    • Only effective on supervised devices (Supervised).
  • Allow Password Proximity Requests
    • When disabled, the device does not request passwords from nearby devices.
    • Requires macOS 10.14 or later (macOS 10.14+).
  • Allow Password Sharing
    • When disabled, passwords cannot be shared via AirDrop.
    • Requires macOS 10.14 or later (macOS 10.14+).
  • Allow Password AutoFill
    • When disabled, the AutoFill Passwords feature is not available, and Safari and other apps do not offer to use a saved password. Strong passwords are no longer suggested either.
    • Requires macOS 10.14 or later (macOS 10.14+).
  • Delay of a fingerprint timeout in seconds
    • Time in seconds after which unlocking with Touch ID requires the password again. Default value: 172800 seconds (48 hours).
    • Requires macOS 12 or later (macOS 12+).
  • Allow modification of Touch ID or Face ID
    • When disabled, Touch ID cannot be modified.
    • Requires macOS 14 or later and only effective on supervised devices (macOS 14+, Supervised).

Update Restrictions

The fields for the delay in days can only be edited, and are only sent to the device, when the corresponding Force … switch is enabled. Values from 1 to 90 days are allowed.

Show all restrictions
  • Delay of a software update in days
    • Number of days after the release date until a software update is displayed. Required field with a default value of 30; takes effect as soon as Force delay of operating system update visibility or Force delay of app software update visibility is enabled.
  • Force delay of operating system update visibility
    • When enabled, operating system updates are only displayed after the configured delay. Seed build updates (beta versions) are allowed without delay.
  • Delay of a minor operating system update in days
    • Number of days until a minor operating system update is displayed. Optional, no default value.
    • Requires macOS 11.3 or later (macOS 11.3+).
  • Force delay of app software update visibility
    • When enabled, software updates that do not concern the operating system are only displayed after the configured delay.
    • Only effective on supervised devices (Supervised).
  • Delay of an app software update in days
    • Number of days until a software update that does not concern the operating system is displayed. Optional, no default value.
    • Requires macOS 11.3 or later (macOS 11.3+).
  • Force delay of major operating system update visibility
    • When enabled, major operating system upgrades are only displayed after the configured delay.
    • Requires macOS 11.3 or later (macOS 11.3+).
  • Delay of a major operating system update in days
    • Number of days until a major operating system upgrade is displayed. Default value: 30.
    • Requires macOS 11.3 or later (macOS 11.3+).
  • Allow Rapid Security Response Installation
    • When disabled, Rapid Security Responses cannot be installed.
    • Requires macOS 13 or later (macOS 13+).
  • Allow Rapid Security Response Removal
    • When disabled, installed Rapid Security Responses cannot be removed.
    • Requires macOS 13 or later (macOS 13+).

Apps

The following restrictions apply to individual apps and services.

Apps restrictions

Show all restrictions
  • Allow spotlight to return internet search results
    • When disabled, Spotlight does not show search results from the internet.
  • Allow Music Service
    • When disabled, the Music service is disabled and the Music app reverts to classic mode.
  • Allow iTunes application file sharing services
    • When disabled, file sharing services for apps are not available.
  • Allow Dictation
    • When disabled, dictation is not available.
    • Only effective on supervised devices; marked as deprecated in the portal (Supervised, Deprecated).
  • Allow Find my device in the Find my app
    • When disabled, the Find my device option is not available in the Find My app.
    • Only effective on supervised devices (Supervised).
  • Allow Find my friends in the Find my app
    • When disabled, the Find my friends option is not available in the Find My app.
    • Only effective on supervised devices (Supervised).
  • Enable safari autofill
    • When disabled, Safari does not automatically fill in passwords, contact information and credit cards, and the keychain is not used for AutoFill. Third-party password managers remain allowed.
    • Requires macOS 10.13 or later (macOS 10.13+).
  • Allow Safari content summarization
    • When disabled, Apple Intelligence cannot create summaries of content in Safari.
    • Requires macOS 15.4 or later (macOS 15.4+).
  • Allow clearing browsing history in Safari
    • When disabled, the browsing history in Safari cannot be cleared.
    • Requires macOS 26 or later (macOS 26+).
  • Allow private browsing in Safari
    • When disabled, private browsing is not available in Safari.
    • Requires macOS 26 or later (macOS 26+).
  • Allow Mail Summary
    • When disabled, email summaries cannot be created manually. Automatically generated summaries are not affected.
    • Requires macOS 15.1 or later (macOS 15.1+).
  • Allow transcription in Notes
    • When disabled, transcription is not available in the Notes app.
    • Requires macOS 15.4 or later (macOS 15.4+).
  • Allow transcription summarization
    • Sub-option of Allow transcription in Notes; can only be set when transcription is allowed. When disabled, transcriptions in Notes cannot be summarized.
    • Requires macOS 15.3 or later (macOS 15.3+).
  • Allow smart replies in Mail
    • When disabled, Apple Intelligence cannot create smart reply suggestions in Mail.
    • Requires macOS 15.4 or later (macOS 15.4+).

Relution does not offer Safari options for JavaScript, pop-ups or the fraud warning for macOS. Clearing the history, private browsing, content summarization and the start page for new tabs can additionally be controlled from macOS 26 using the Safari Settings → configuration.

Settings

The following restrictions apply to the system settings of the device and to the Classroom app.

Settings restrictions

Show all restrictions
  • Allow use of camera
    • When disabled, the camera cannot be used.
  • Allow content caching
    • When disabled, content caching is not available on the Mac.
  • Allow definition lookup
    • When disabled, the definition lookup feature is not available.
    • Marked as deprecated in the portal (Deprecated).
  • Send diagnostic and usage data to Apple
    • When disabled, the device is prevented from automatically sending diagnostic and usage data to Apple.
    • Also effective with user enrollment (Supports user enrollment).
  • Allow use of Gamecenter
    • When disabled, Game Center is not available. The two following sub-options can only be set when Game Center is allowed.
    • Only effective on supervised devices (Supervised).
  • Allow Multiplayer gaming
    • Sub-option of Allow use of Gamecenter. When disabled, multiplayer games are not possible.
  • Allow adding friends to the Game Center
    • Sub-option of Allow use of Gamecenter. When disabled, friends cannot be added in Game Center.
  • Allow personalized advertising from Apple
    • When disabled, personalized advertising from Apple is limited.
    • Requires macOS 12 or later (macOS 12+).
  • Allow creating new users
    • When disabled, new users cannot be created in System Settings.
    • Requires macOS 14 or later (macOS 14+).
  • Enable Siri profanity filter
    • When enabled, Siri filters offensive language.
    • Requires macOS 10.13 or later and only effective on supervised devices; marked as deprecated in the portal (macOS 10.13+, Supervised, Deprecated).
  • Enable Erase All Content and Settings
    • When disabled, the Erase All Content and Settings option is not available.
    • Requires macOS 12 or later and only effective on supervised devices (macOS 12+, Supervised).
  • Allow incoming AirPlay requests
    • When disabled, the Mac does not accept incoming AirPlay requests.
    • Requires macOS 12.3 or later and only effective on supervised devices (macOS 12.3+, Supervised).
  • Allow screen shots and screen recordings
    • When disabled, screenshots and screen recordings cannot be taken. The Classroom app also cannot observe the screen remotely.
    • Requires macOS 10.14.4 or later; also effective with user enrollment (macOS 10.14.4+, Supports user enrollment).
  • Allow remote screen observation by Classroom App
    • Sub-option of Allow screen shots and screen recordings; can only be set when screenshots are allowed. When disabled, the Classroom app cannot observe the screen remotely.
    • Requires macOS 10.14.4 or later (macOS 10.14.4+).
  • Allow the presentation of a screen capture alert
    • Contrary to its label, enabling this option suppresses the screen capture alert; when it is disabled (default), macOS shows the alert as usual.
    • Requires macOS 15.1 or later (macOS 15.1+).
  • Allow Siri
    • When disabled, Siri is not available.
    • Requires macOS 14 or later; also effective with user enrollment; marked as deprecated in the portal (macOS 14+, Supports user enrollment, Deprecated).

Classroom restrictions

Show all restrictions
  • Allow teachers to observe devices via the Apple Classroom without prompting
    • When enabled, the teacher of a managed class is given permission to observe the screen without the student having to confirm. The option only takes effect if Allow screen shots and screen recordings and Allow remote screen observation by Classroom App are enabled; otherwise the form shows a corresponding note.
    • Requires macOS 10.14.4 or later and only effective on supervised devices (macOS 10.14.4+, Supervised).
  • Force automatic accession to a Classroom-course
    • When enabled, the teacher’s requests in the Classroom app are automatically granted without prompting the student.
    • Requires macOS 10.14.4 or later and only effective on supervised devices (macOS 10.14.4+, Supervised).
  • Request permission on leaving Classroom-class
    • When enabled, a student enrolled in an unmanaged class must request the teacher’s permission to leave it.
    • Requires macOS 10.14.4 or later and only effective on supervised devices (macOS 10.14.4+, Supervised).
  • Allow teachers to lock apps and devices via Apple Classroom without prompting
    • When enabled, the teacher can lock apps or the device without the student having to confirm.
    • Requires macOS 10.14.4 or later and only effective on supervised devices (macOS 10.14.4+, Supervised).

Media

The following restrictions apply to media content. All options in this section require macOS 15 or later (macOS 15+).

Media restrictions

Show all restrictions
  • Enable iBookstore
    • When disabled, the Book Store is not available in the Books app.
    • Only effective on supervised devices (Supervised).
  • Allow downloads of media tagged as Erotica
    • When disabled, books tagged as erotica cannot be downloaded.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • Allow explicit music, podcasts & iTunes U
    • When disabled, explicit music and video content from the iTunes Store is hidden. Content counts as explicit if the provider, such as a record label, has marked it as such.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • The maximum age restriction level of app content allowed
    • Highest age rating for apps that can be installed: None, 4+, 9+, 12+, 17+ or All (default). Apps preinstalled by Apple are exempt.
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • The maximum age restriction level of movie content
    • Highest age rating for movies based on the US rating system: None, G, PG, PG-13, R, NC-17 or All (default).
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).
  • The maximum age restriction of TV content allowed on the device
    • Highest age rating for TV shows based on the US rating system: None, TV-Y, TV-Y7, TV-G, TV-PG, TV-14, TV-MA or All (default).
    • Deprecated on unsupervised devices (Deprecated on unsupervised devices).

Modifications

These restrictions determine which settings may be modified on the device.

Modifications restrictions

Show all restrictions
  • Allow wallpaper modification
    • When disabled, the wallpaper cannot be changed.
    • Only effective on supervised devices (Supervised).
  • Allow modification of Bluetooth settings
    • When disabled, the Bluetooth settings cannot be changed.
    • Only effective on supervised devices (Supervised).
  • Allow modification of Remote Management Sharing setting
    • When disabled, the Remote Management sharing setting cannot be changed in System Settings.
    • Requires macOS 14 or later (macOS 14+).
  • Allow modification of Bluetooth Sharing setting
    • When disabled, the Bluetooth Sharing setting cannot be changed in System Settings.
    • Requires macOS 14 or later (macOS 14+).
  • Allow modification of File Sharing setting
    • When disabled, the File Sharing setting cannot be changed in System Settings.
    • Requires macOS 14 or later (macOS 14+).
  • Allow modification of Startup Disk setting
    • When disabled, the startup disk cannot be changed in System Settings.
    • Requires macOS 14 or later (macOS 14+).
  • Allow modification of Remote Apple Events Sharing setting
    • When disabled, the Remote Apple Events sharing setting cannot be changed in System Settings.
    • Requires macOS 14 or later (macOS 14+).
  • Allow modification of Printer Sharing setting
    • When disabled, the Printer Sharing setting cannot be changed in System Settings.
    • Requires macOS 14 or later (macOS 14+).
  • Allow modification of Internet Sharing setting
    • When disabled, the Internet Sharing setting cannot be changed in System Settings.
    • Requires macOS 14 or later (macOS 14+).
  • Allow modification of Time Machine setting
    • When disabled, the Time Machine settings cannot be changed in System Settings.
    • Requires macOS 14 or later (macOS 14+).
  • Allow Account modification
    • When disabled, accounts cannot be modified.
    • Requires macOS 14 or later and only effective on supervised devices (macOS 14+, Supervised).
  • Allow device name modification
    • When disabled, the device name cannot be changed.
    • Requires macOS 14 or later and only effective on supervised devices (macOS 14+, Supervised).
  • Allow Media Sharing Modification
    • When disabled, the Media Sharing settings cannot be changed.
    • Requires macOS 15.1 or later (macOS 15.1+).

iCloud

The following restrictions apply to the iCloud services on the device.

iCloud restrictions

Show all restrictions
  • Allow iCloud documents & data
    • When disabled, syncing of iCloud documents and data is not possible.
  • Allow iCloud Photo Library
    • When disabled, iCloud Photo Library is not available. Photos that have not been fully downloaded yet are removed from local storage.
  • Allow iCloud keychain synchronisation
    • When disabled, the iCloud keychain cannot be synchronized.
  • Allows iCloud bookmark sync
    • When disabled, bookmarks are not synchronized via iCloud.
  • Allow iCloud mail services
    • When disabled, iCloud Mail is not available.
  • Allow iCloud calendar services
    • When disabled, the iCloud calendar is not available.
  • Allow iCloud reminder services
    • When disabled, iCloud reminders are not available.
  • Allow iCloud addressbook services
    • When disabled, iCloud contacts are not available.
  • Allow iCloud notes services
    • When disabled, iCloud notes are not available.
  • Allow iCloud desktop and document services
    • When disabled, the Desktop and Documents folders are not synchronized with iCloud.
  • Allow iCloud private relay
    • When disabled, internet traffic is not routed through iCloud Private Relay.
    • Requires macOS 12 or later (macOS 12+).
  • Allow iCloud Freeform services
    • When disabled, Freeform is not available via iCloud.
    • Requires macOS 14 or later (macOS 14+).

AI feature restrictions

These restrictions control the Apple Intelligence features.

General

Show all restrictions
  • Allow Genmoji creation
    • When disabled, Apple Intelligence cannot create Genmoji.
    • Requires macOS 15 or later and only effective on supervised devices (macOS 15+, Supervised, Deprecated).
  • Allow image generation
    • When disabled, Apple Intelligence cannot generate images.
    • Requires macOS 15 or later and only effective on supervised devices (macOS 15+, Supervised, Deprecated).
  • Allow Apple Intelligence writing tools
    • When disabled, Apple Intelligence’s writing features (e.g. rewriting, proofreading or summarizing text) are not available.
    • Requires macOS 15 or later and only effective on supervised devices (macOS 15+, Supervised, Deprecated).
  • Allow using external, cloud-based intelligence services
    • Enables the use of external, cloud-based intelligence services with Siri.
    • Requires macOS 15.2 or later (macOS 15.2+, Deprecated).
  • Allow signing in to external intelligence providers
    • Disabling this option always puts external intelligence providers into anonymous mode. If a user is already signed in to an external intelligence provider, they are signed out.
    • Requires macOS 15.2 or later (macOS 15.2+, Deprecated).
  • Allow Apple Intelligence reports
    • When disabled, Apple Intelligence reports are disabled.
    • Requires macOS 15.4 or later (macOS 15.4+, Deprecated).
  • Allowed external integration workspace IDs
    • Currently limited by Apple to a single entry. If specified, Apple Intelligence only allows this workspace ID for the external integration and requires sign-in. Empty by default; an empty list is not sent to the device.
    • Requires macOS 15 or later (macOS 15+, Deprecated).