Browse docs

Restrictions

Below is an overview of the available visionOS restrictions in Relution. Note the additional hints on individual configuration items in Relution, such as supervised, User Enrollment supported, as well as the minimum OS version, such as visionOS 1.1+.

Recommended restrictions →

Device

  • Allow Touch ID / Face ID for unlock
    • When disabled, the device cannot be unlocked using Touch ID or Face ID. If unlocking is re-enabled, the feature must be set up again in the settings.
  • Enable Activity Continuation
    • When disabled, other devices cannot hand off actions to this device via Handoff.
  • Allow AirDrop
    • When disabled, AirDrop cannot be used.
  • Process dictation only on the device itself, do not establish a connection to Siri servers
    • When enabled, connections to Siri servers for dictation are disabled.
  • Allow password sharing
    • When disabled, users may not share their passwords via AirDrop.
  • Allow access to network devices in the Files app
    • When not allowed, the system prevents connections to network drives in the Files app.

Apps

General

  • Allow trusting enterprise apps
    • When disabled, the “Trust Enterprise Developer” button under “Settings -> General -> Profiles & Device Management” disappears; this protects apps from being deployed via Universal Provisioning Profiles. This restriction applies to Free Developer Accounts, but not to trusted Enterprise App Developers, since their apps are pushed via MDM. Likewise, revoking trust that has already been granted is not possible.
  • Allow app installation
    • When disabled, the App Store cannot be used and its icon is removed from the home screen. Users are not able to install or update applications.
  • Allow App Store
    • When the App Store is prohibited, its icon is removed from the home screen. Users can still install and update apps via iTunes or Configurator.
  • Allow removal of system apps
    • When disabled, removing system apps is not permitted.
  • Force authentication before autofill
    • When disabled, the user does not need to authenticate before passwords or credit card information are automatically filled in Safari or other apps. If this restriction is disabled, the user can toggle this feature in the settings. Only supported on devices with Face ID or Touch ID.
  • Allow autofill passwords
    • When this setting is disabled, users cannot use the autofill passwords feature and are not prompted in Safari and other apps to use a saved password. In addition, strong passwords are no longer generated automatically or suggested to users.
  • Allow modification of Touch ID or FaceID
    • When this option is disabled, the system prevents the user from changing Touch ID or Face ID.

Safari

  • Allow AutoFill
    • Disables AutoFill in the Safari browser.
  • Allow Safari content summarization
    • When disabled, Apple Intelligence cannot generate summaries of content.
  • Allow clearing the Safari browsing history
    • When not allowed, the system disables the ability to clear the Safari browsing history.
  • Allow private browsing in Safari
    • When not allowed, the system disables the ability to use private browsing in Safari.

Siri

  • Allow Siri
    • When disabled, Siri is not available.

Other apps

  • Allow Mail summarization
    • Allow manual composition of email messages. This does not affect the automatic generation of summaries.
  • Allow Smart Replies in Mail
    • When disabled, Apple Intelligence cannot generate Smart Reply suggestions in Mail.

Managed apps and documents

Restrictions for managed apps and documents

  • Allow opening managed documents in unmanaged apps
    • When disabled, documents from managed apps and accounts cannot be opened in unmanaged apps and accounts.
  • Allow unmanaged apps to access managed contacts
    • When enabled, unmanaged apps are allowed to read managed contacts. If “Allow opening managed documents in unmanaged apps” is enabled, this restriction has no effect.
  • Allow managed apps to write unmanaged contacts
    • When enabled, managed apps are allowed to create unmanaged contacts. If “Allow opening managed documents in unmanaged apps” is enabled, this restriction has no effect.
  • Allow opening unmanaged documents in managed apps
    • When disabled, documents from unmanaged apps and accounts cannot be opened in managed apps and accounts.
  • Apply “Open in” settings to copy and paste as well
    • When enabled, the restrictions “Allow opening managed documents in unmanaged apps” and “Allow opening unmanaged documents in managed apps” also control whether information copied from managed applications can be pasted into unmanaged applications and/or vice versa.
  • Allow managed apps to sync with iCloud
    • When disabled, managed apps are prevented from using iCloud synchronization.
  • Treat AirDrop destinations as unmanaged
    • When enabled, all AirDrop destinations are always treated as unmanaged.

Settings

Settings restrictions

  • Allow sending diagnostic and usage data to Apple
    • When disabled, the device is prevented from automatically sending diagnostic and usage data to Apple.
  • Allow Apple personalized advertising
    • When disabled, personalized advertising from Apple is not shown.
  • Allow users to accept untrusted TLS certificates
    • When disabled, untrusted HTTPS certificates are automatically rejected without prompting the user first.
  • Allow screenshots and screen recordings
    • When disabled, screenshots and screen recordings cannot be taken. In addition, screen mirroring is not available in the Classroom app.
  • Allow the user to install configuration profiles
    • When disabled, no configuration profiles or certificates can be installed.
  • Allow restrictions and screen time settings
    • When disabled, the “Enable Restrictions” option in Settings is not available. In addition, enabling Screen Time is not available, and if already active, the feature is disabled.
  • Allow “Erase All Content and Settings”
    • When disabled, the “Erase All Content and Settings” option is hidden from the reset menu.
  • Force automatic date and time settings
    • When this setting is enabled, the date and time settings are set to “automatic” and cannot be changed by the user. Note: the device’s time zone can only be updated if the device can determine its location (Wi-Fi connection with location settings required).

Media

Restrictions for media

  • Allow camera
    • When disabled, the camera icon is removed from the home screen, and it is no longer possible to take photos or videos in any app.
  • Allow FaceTime video calls
    • When disabled, FaceTime video calls cannot be made.

Changes

Change restrictions

  • Allow account modifications
    • When disabled, account modifications are not possible in the settings.
  • Allow passcode changes
    • When disabled, the device passcode cannot be added, changed, or removed.
  • Allow device name changes
    • When disabled, the device name cannot be changed.
  • Allow changes to notification settings
    • When disabled, changing notification settings is not possible.
  • Allow changing an app’s diagnostic data submission
    • When disabled, the settings for sending diagnostic data cannot be changed.
  • Enforce Wi-Fi whitelisting
    • Devices can only join Wi-Fi networks that are defined as a Wi-Fi configuration in the policy.
  • Allow creation of VPN configurations
    • When disabled, it is not possible to create VPN configurations.

iCloud

iCloud restrictions

  • Allow iCloud backup
    • When disabled, iCloud backups of the device are not possible.
  • Allow iCloud keychain sync
    • When disabled, iCloud keychain synchronization cannot be used.
  • Allow iCloud Photo Library
    • When disabled, iCloud Photo Library is not available. Photos that have not been fully downloaded yet are deleted from local storage.
  • Allow iCloud document and data sync
    • When disabled, syncing of iCloud documents and data is not possible.
  • Allow iCloud Private Relay
    • When disabled, internet traffic is not routed through iCloud Private Relay, and the device’s IP address is visible to websites and network providers.

AI feature restrictions

General

  • Allow Genmoji creation
    • When disabled, Apple Intelligence cannot create personalized Genmoji.
  • Allow image generation
    • When disabled, Apple Intelligence cannot generate images.
  • Allow Apple Intelligence writing tools
    • When disabled, Apple Intelligence’s writing features (e.g. rewriting, proofreading, or summarizing text) are not available.
  • Allow using image wand
    • When disabled, Apple Intelligence cannot create images from sketches or descriptions using Image Wand.
  • Allow use of external, cloud-based Intelligence services
    • Enables the use of external, cloud-based Intelligence services with Siri.
  • Allow sign-in to external Intelligence providers
    • Disabling this flag always puts external Intelligence providers into anonymous mode. If a user is already signed in to an external Intelligence provider, applying this restriction signs them out.
  • Allowed external integration workspace IDs
    • Currently limited by Apple to a single entry. If specified, Apple Intelligence only allows the use of this workspace ID for external integration and requires sign-in.