App Restrictions
Overview
Restrictions allow you to block or limit specific device features and applications. They are enforced through configuration profiles and cannot be bypassed by the end user. Use restrictions to enforce security policies, reduce distractions, and prevent data leakage.
Restrictions are available on iOS, iPadOS, and macOS. Some restrictions are platform-specific and may require supervision.
Feature Restrictions
Control access to built-in device features and system apps.
| Key | Label | Description |
|---|---|---|
allowCamera | Disable Camera | Disable the camera and remove its icon from the Home Screen. |
allowSafari | Disable Safari | Disable Safari and prevent opening web clips. |
allowScreenShot | Disable Screenshots and Screen Recording | Prevent screenshots, screen recordings, and remote screen observation. |
allowAppInstallation | Disable Installing Apps | Prevent installing or updating apps from the App Store. |
allowUIAppInstallation | Disable Installing Apps with App Store UI | Hide the App Store UI while still allowing other install methods that Apple permits. |
allowAppRemoval | Disable Deleting Apps | Prevent users from removing installed apps from the device. |
allowSystemAppRemoval | Disable Deleting System Apps | Prevent users from removing built-in system apps. |
allowAutomaticAppDownloads | Disable Automatic App Downloads | Prevent apps purchased on other devices from downloading automatically. |
allowMarketplaceAppInstallation | Disable Marketplace App Installation | Prevent installing apps through alternative marketplace distribution. |
allowWebDistributionAppInstallation | Disable Web App Distribution | Prevent direct installation of apps from the web. |
allowAppClips | Disable Adding App Clips | Prevent users from adding App Clips and remove existing ones. |
allowInAppPurchases | Disable In-App Purchases | Prevent purchases made from inside apps. |
allowFaceTime | Disable FaceTime | Disable FaceTime video/audio calls. |
allowAirDrop | Disable AirDrop | Disable peer-to-peer sharing through AirDrop. |
allowAirPrint | Disable AirPrint | Disable AirPrint on supported devices. |
allowBookstore | Disable Book Store | Remove the Book Store tab from Books. |
allowNews | Disable News | Disable the News app where supported. |
allowPodcasts | Disable Podcasts | Disable the Podcasts app. |
allowMusicService | Disable Apple Music | Disable Apple Music service access. |
allowRadioService | Disable Apple Music Radio | Disable Apple Music Radio service access. |
allowiTunes | Disable iTunes Store | Disable access to the iTunes Store. |
allowExplicitContent | Disable Explicit Content | Prevent explicit media content from being accessed. |
allowGameCenter | Disable Game Center | Disable Game Center for managed devices. |
allowAssistant | Disable Siri | Disable Siri on supported devices. |
allowAssistantWhileLocked | Disable Siri While Locked | Prevent Siri from being available when the device is locked. |
allowAssistantUserGeneratedContent | Disable Siri User Generated Content | Prevent Siri from querying user-generated content from the web. |
allowDiagnosticSubmission | Disable Diagnostic Submission | Prevent automatic submission of diagnostic reports to Apple. |
allowNotificationsModification | Disable Notification Settings Changes | Prevent users from changing notification settings. |
allowLockScreenNotificationsView | Disable Notification History on Lock Screen | Prevent viewing past notifications on the Lock Screen. |
allowLockScreenControlCenter | Disable Control Center on Lock Screen | Prevent Control Center from appearing on the Lock Screen. |
allowLockScreenTodayView | Disable Today View on Lock Screen | Prevent Today view from appearing on the Lock Screen. |
allowWallpaperModification | Prevent Changes to Wallpaper | Prevent users from changing the wallpaper. |
allowDeviceNameModification | Disable Device Name Modification | Prevent users from changing the device name. |
allowPasscodeModification | Disable Passcode Modification | Prevent users from changing or removing the device passcode. |
allowAccountModification | Disable Account Modification | Prevent changes to Apple Account and internet account settings. |
allowBluetoothModification | Disable Bluetooth Modification | Prevent users from changing Bluetooth settings. |
allowVPNCreation | Disable VPN Creation | Allow only managed apps to create VPN configurations. |
allowEnablingRestrictions | Disable Screen Time Changes | Prevent enabling or changing Screen Time restrictions on the device. |
allowEraseContentAndSettings | Disable Erase All Content and Settings | Remove the Erase All Content and Settings option from device reset UI. |
allowFingerprintForUnlock | Disable Touch ID / Face ID Unlock | Prevent biometric authentication from unlocking the device. |
allowPairedWatch | Disable Pairing with Apple Watch | Prevent the iPhone from pairing with Apple Watch. |
forceWatchWristDetection | Require Apple Watch Wrist Detection | Require wrist detection for paired Apple Watch devices. |
allowUIConfigurationProfileInstallation | Disable Profile Installation | Prevent users from installing configuration profiles manually. |
allowUntrustedTLSPrompt | Auto-Reject Untrusted TLS Certificates | Reject untrusted HTTPS certificates without prompting the user. |
allowFilesUSBDriveAccess | Disable Files Access to USB Drives | Prevent the Files app from accessing USB drives. |
allowFilesNetworkDriveAccess | Disable Files Access to Network Drives | Prevent the Files app from accessing network drives. |
allowHostPairing | Disable Connecting with Computers | Prevent devices from pairing with computers through Finder or iTunes. |
allowUSBRestrictedMode | Allow USB Accessories when Locked | Allow locked devices to connect to USB accessories without USB Restricted Mode blocking them. |
forceEncryptedBackup | Require Encrypted Backup | Force local device backups to be encrypted. |
allowPassbookWhileLocked | Hide Apple Wallet on Lock Screen | Prevent Wallet from being available on the Lock Screen. |
allowSpotlightInternetResults | Disable Spotlight Internet Results | Disable internet search results in Spotlight and Siri Suggestions. |
forceWiFiToAllowedNetworksOnly | Enable Wi-Fi Safelist | Limit the device to Wi-Fi networks provided through configuration profiles. |
allowAppCellularDataModification | Disable App Cellular Data Changes | Prevent users from changing per-app cellular data settings. |
allowGlobalBackgroundFetchWhenRoaming | Disable Background App Refresh while Roaming | Prevent background app refresh when roaming. |
forceWiFiPowerOn | Force Wi-Fi On | Prevent users from turning off Wi-Fi in Settings or Control Center. |
forceAutomaticDateAndTime | Force Automatic Date and Time | Require automatic date and time and prevent users from turning it off. |
allowPersonalHotspotModification | Disable Personal Hotspot Changes | Prevent changes to the Personal Hotspot setting. |
App Usage Mode
Control which apps can run on the device. This is configured through a single enum field rather than separate allow/block lists.
| Value | Behavior |
|---|---|
allow-all | All apps are allowed to run (default). |
hidden | Selected apps are hidden from the Home Screen. |
allowedOnly | Only selected apps are allowed to run; all others are hidden. |
Use the Configure Allowed or Hidden Apps setting in the Restrictions blueprint editor to choose the mode and select apps.
iCloud Restrictions
Control iCloud services independently of the general feature flags above.
| Key | Label | Description |
|---|---|---|
allowCloudBackup | Disable iCloud Backup | Prevent the device from backing up to iCloud. |
allowCloudDocumentSync | Disable iCloud Document Sync | Disable document and key-value syncing to iCloud. |
allowCloudPhotoLibrary | Disable iCloud Photos | Disable iCloud Photo Library on the device. |
allowCloudKeychainSync | Disable iCloud Keychain | Disable iCloud Keychain synchronization. |
allowCloudDesktopAndDocuments | Disable Desktop and Documents in iCloud | Disable iCloud Desktop and Documents services. |
allowCloudMail | Disable Mail | Disable iCloud Mail services. |
allowCloudCalendar | Disable Calendar | Disable iCloud Calendar services. |
allowCloudReminders | Disable Reminders | Disable iCloud Reminders services. |
allowCloudBookmarks | Disable Bookmarks | Disable iCloud Bookmark sync. |
allowCloudAddressBook | Disable Contacts | Disable iCloud Contacts services. |
allowCloudNotes | Disable Notes | Disable iCloud Notes services. |
allowManagedAppsCloudSync | Disable Managed Apps from Storing Data in iCloud | Prevent managed apps from syncing data to iCloud. |
Managed App Data Restrictions
| Key | Label | Description |
|---|---|---|
allowOpenFromManagedToUnmanaged | Prevent Managed Apps from Opening Data in Unmanaged Apps | Keep managed app data from being opened in unmanaged destinations. |
allowOpenFromUnmanagedToManaged | Prevent Unmanaged Apps from Opening Data in Managed Apps | Keep unmanaged app data from being opened in managed destinations. |
forceAirDropUnmanaged | Force AirDrop as Unmanaged Destination | Treat AirDrop as an unmanaged destination for managed app data. |
Best Practices
- Start with a small blocklist. Block the few features that violate policy (camera, AirDrop, Game Center) rather than trying to enumerate every allowed app. Switch to an allowlist only when the device is strictly single-purpose (kiosk, dedicated device).
- Test on a small group first. Restrictions like blocking the camera or disabling screenshots can break workflows you did not anticipate. Deploy to a pilot group before rolling out broadly.
- Combine with other Blueprint settings. Pair restrictions with passcode policy and security configurations for defense in depth.