Restrictions for iOS
Restrictions help administrators manage devices according to their organization's policies.
The Restrictions configuration profile allows you to control certain applications or features of your users' iPhone and iPad devices. See Restrictions for a generic overview of the Restrictions configuration profile.
Some restrictions may require that your iOS devices are supervised. These are indicated by the 
icon in LogMeIn Resolve MDM's configuration profile wizard.
Create a Restrictions configuration profile for iOS devices
What to do next: You can monitor the progress of the configuration profile deployment either on the
page or on the individual devices'
Device page available under
.
Configuration profile settings
The tables below show the settings available on the specific tabs of the Restrictions configuration profile creation wizard.
| Setting | Description | Required iOS version | Requires supervision |
|---|---|---|---|
| Deny call recording | Call recording is disabled. | iOS 18 or later | Yes |
| Deny camera | The camera is completely disabled and its icon is removed from the Home Screen. Users are unable to take photos and videos. | iOS 5 or later | Requires supervision in iOS 13 or later.
Note: This restriction is deprecated on unsupervised devices.
|
| Deny FaceTime | FaceTime and video conferencing are disabled. | iOS 5 or later | Requires supervision in iOS 13 or later. |
| Deny default browser modification | Changing the default browser is denied. | iOS 18.2 or later | Yes |
| Deny Dictation | Using the dictation input method is denied. | iOS 10.13 or later | Yes |
| Deny Game Center | Game Center is disabled and its icon is removed from the Home Screen. | iOS 6 or later | Yes |
| Game Center: Deny adding friends | Adding friends to Game Center is denied. | iOS 5 or later | Requires supervision in iOS 13 or later. |
| Game Center: Deny multiplayer gaming | Multiplayer gaming is denied. | iOS 5 or later | Yes |
| Deny iBookstore | The Book Store functionality of Apple Books is disabled and the tab is removed from the app. Users will not be able to purchase books but they can read and open the books they already own. | iOS 6 or later | Yes |
| iBookstore: Deny adult content | Users are prevented from downloading Apple Books media tagged as erotica. | iOS 6 or later | No |
| Deny iTunes Store | The iTunes Store is disabled and its icon is removed from the Home Screen. If this setting is enabled, users cannot preview, purchase, or download content. | iOS 5 or later | Requires supervision in iOS 13 or later. |
| Deny iTunes Radio | Apple Music Radio is disabled and its icon is removed. | iOS 9.3 or later | Yes |
| Deny iMessages | The sending and receiving of iMessages are denied. Provided the device allows text messaging, users can still send and receive text messages. If the device does not support text messaging, the icon of the Messages app is removed from the Home Screen. | iOS 6 or later | Yes |
| Deny News | The use of Apple News is denied. | iOS 9 or later | Yes |
| Deny RCS messaging | RCS messaging is denied. | iOS 18.1 or later | Yes |
| Deny Safari | The Safari browser is disabled and its icon is removed from the Home Screen. Enabling this setting also prevents users from opening web clips. | iOS 5 or later | Requires supervision in iOS 13 or later. |
| Safari: Disable autofill | Using AutoFill for passwords, contact information, and credit card information is disabled in Safari. If enabled, this option also prevents the use of Keychain for autofilling information. Third-party password managers are allowed and other apps can use autofill. | iOS 5 or later | Requires supervision in iOS 13 or later. |
| Safari: Force fraud warning | Safari fraud warnings are enabled. | iOS 5 or later | No |
| Safari: Disable JavaScript | The execution of JavaScript is disabled in Safari. | iOS 5 or later | No |
| Safari: Block popups | Popups are blocked in Safari. | iOS 5 or later | No |
| Safari: Accept cookies | Controls when Safari accepts cookies. The following values can be set:
|
iOS 5 or later | No |
| Deny Siri | Siri is disabled. | iOS 5 or later | No |
| Siri: Deny external intelligence integrations | The use of external, cloud-based intelligence services with Siri is denied. | iOS 18.2 | No |
| Siri: Deny signing in to external intelligence integrations | External intelligence providers are forced into anonymous mode. If users are already signed in to an external intelligence provider, they are signed out at the next request attempt. | iOS 18.2 | No |
| Siri: Deny Notes transcription summary | Transcription summary in the Notes app is denied. | iOS 18.2 or later | Yes |
| Siri: Deny user generated content | Siri is prevented from querying user-generated content from the internet. | iOS 7 or later | Yes |
| Siri: Deny visual intelligence summary | Visual intelligence summary is denied. | iOS 18.3 or later | Yes |
| Siri: Deny while locked | Users cannot use Siri when the device is locked. This restriction is ignored if the device does not have a passcode set. | iOS 5.1 or later | No |
| Siri: Force profanity filter | The profanity filter for dictation and Siri is forced by the system. | iOS 11 or later | Yes |
| Deny System app removal | The removal of system apps from the device is denied. | iOS 11 or later | Yes |
| Deny YouTube | The YouTube app is disabled and its icon is removed from the Home Screen. | iOS 5.1.1 or earlier
Note: This setting is ignored in iOS 6 and later versions due to the YouTube app no longer being built into the OS.
|
No |
| Setting | Description | Required iOS version | Requires supervision |
|---|---|---|---|
| Deny AirDrop | Using AirDrop is denied. | iOS 7 or later | Yes |
| AirDrop: Force unmanaged drop target | AirDrop is forced to be considered an unmanaged drop target. | iOS 9 or later | No |
| Deny AirPrint | Using AirPrint is denied. | iOS 11 or later | Yes |
| AirPrint: Deny iBeacon discovery | The iBeacon discovery of AirPrint printers is disabled. | iOS 11 or later | Yes |
| AirPrint: Deny credentials storage | Storing the username and password in the Keychain for AirPrint is denied. | iOS 11 or later | Yes |
| AirPrint: Force TLS requirement | The device requires trusted certificates for TLS printing communication. | iOS 11 or later | Yes |
| Deny application installation | The App Store is disabled and its icon is removed from the Home Screen. With this option enabled, users are unable to install or update applications. | iOS 5 or later | Requires supervision in iOS 13 or later. |
| Deny application installation from App Store | The App Store is disabled and its icon is removed from the Home Screen. Users may continue to use Host apps (for example iTunes and Apple Configurator) to install or update apps. | iOS 9 or later | Yes |
| Deny application removal | Application removal is denied. | iOS 5 or later | Yes |
| Deny apps to be hidden | Hiding apps is denied. Users can still leave the app in the App Library while removing it from the Home Screen. | iOS 18 or later | Yes |
| Deny apps to be locked | Locking apps is denied. Users are also prevented from hiding apps. | iOS 18 or later | Yes |
| Deny automatic app downloads | The automatic downloading of apps purchased on other devices is denied. This does not affect updates to existing apps. | iOS 9 or later | Yes |
| Deny automatic sync while roaming | Automatic data synchronization and global background fetch activity when an iPhone is roaming are denied. | iOS 5 or later | No |
| Deny cellular data usage changes for apps | Changing the cellular data usage of apps is denied. | iOS 7 or later | Yes |
| Deny cellular plan modification | Making any changes to the cellular plan is denied. | iOS 11 or later | Yes |
| Deny definition lookup | Definition lookup is denied. Users cannot double-tap to search for a word’s definition. | iOS 8.1.3 or later | Yes |
| Deny eSIM outgoing transfers | Transferring an eSIM from the device on which the restriction is disabled to a different device is denied. | iOS 18 or later | Yes |
| Deny Handoff | Using Handoff is denied. | iOS 8 or later | No |
| Deny host pairing | Host pairing is disabled with the exception of the supervision host. If no supervision host certificate has been configured, all pairing is disabled. Users cannot pair their iOS device with anything but the host Mac with Apple Configurator installed, where the device was first supervised. | iOS 7 or later | Yes |
| Deny in-app purchase | In-app purchases are denied. | iOS 5 or later | No |
| Deny installing configuration profiles | Installing configuration profiles and certificates is denied. | iOS 6 or later | Yes |
| Deny Internet search results in Spotlight | Spotlight internet search results are disabled in Siri suggestions. | iOS 8 or later | Yes |
| Deny iPhone mirroring | Using iPhone Mirroring with any Mac device is denied. | iOS 18 or later | Yes |
| Deny keyboard auto-correction | Keyboard auto-correction is disabled. | iOS 8.1.3 or later | Yes |
| Deny keyboard prediction | Keyboard prediction is disabled. | iOS 8.1.3 or later | Yes |
| Deny keyboard shortcuts | The use of keyboard shortcuts is disabled. | iOS 9 or later | Yes |
| Deny keyboard spellcheck | Keyboard spellcheck is disabled. | iOS 8.1.3 or later | Yes |
| Deny lock screen Control Center | Prevents Control Center from appearing on the Lock Screen. Users cannot swipe up to view Control Center. | iOS 7 or later | No |
| Deny lock screen Notifications history view | The Notifications history view on the Lock Screen is disabled. Users cannot view past notifications. | iOS 7 or later | No |
| Deny lock screen Passbook notifications | Showing Wallet notifications on the Lock Screen is disabled. | iOS 6 or later | No |
| Deny lock screen Today View | The Today View in the Notification Center is disabled. Users cannot swipe down to see the Notification Center using the Today View on the Lock Screen. | iOS 7 or later | No |
| Deny marketplace app installation | The system prevents the installation of alternative marketplace apps from the internet, and prevents any installed marketplace app from installing apps. | iOS 17.4 or later | Yes |
| Deny web distribution app installation | The system prevents the installation of apps directly from the internet. | iOS 17.5 or later | Yes |
| Deny modifications to the eSIM setting | Modifications to the eSIM setting are denied. | iOS 12.1 or later | Yes |
| Deny music service | The Music service is disabled and the Music app reverts to classic mode. | iOS 9.3 or later | Yes |
| Deny NFC | Users are prevented from using the built-in NFC hardware in compatible iPhone devices. | iOS 14.2 or later | No |
| Deny paired Apple Watch | Pairing the device with an Apple Watch is denied. Any currently paired Apple Watch is unpaired and its content is erased. | iOS 9 or later | Yes |
| Deny podcasts | Podcasts are disabled. Users cannot download podcasts. | iOS 8 or later | Yes |
| Deny QuickPath keyboard | QuickPath keyboard is disabled. | iOS 13 or later | Yes |
| Deny restriction configuration | The use of the Enable Restrictions option in the Restrictions UI in the Settings app is disabled. | iOS 8 or later | Yes |
| Deny satellite connection | Connecting to or using satellite services is denied. | iOS 18.2 or later | Yes |
| Deny screen capture | Saving a screenshot or screen recording of the display is denied. This also disables the Classroom app for observing remote screens. | iOS 4 or later | No |
| Deny remote screen observation | Remote screen observation by the Classroom app is disabled. | iOS 12 or later | Does not require supervision in iOS 13 or later. |
| Deny voice dialing | Denies voice dialing if the device is locked with a passcode. | iOS 5 or later | No |
| Force automatic date and time | The Set automatically option in the Date & Time menu is enabled and cannot be disabled by the user. The device's time zone is updated when the device can determine its location using a cellular connection or Wi-Fi with location services enabled. | iOS 12 or later | Yes |
| Force device only dictation | Sending dictated content to Siri servers for processing is denied. | iOS 14.5 or later | No |
| Force device only translation | Denies the device's connection to Siri servers for translation. Only offline translation is available. | iOS 15 or later | No |
| Force delayed system updates | The visibility of an iOS version update to the user is delayed. If enabled, the System update delay time (1-90 days) option becomes available, which can be used to specify the number of days that must pass after an application update is released before it appears on the user's device. The number of days can be set from 1 to 90. | iOS 11.3 or later | Yes |
| Force no permission prompt to Classroom teacher's requests | Permission is automatically given to the Classroom teacher's request without prompting the student. | iOS 11 or later | Yes |
| Force no prompting when Classroom teacher locks apps or the device | The teacher is allowed to lock apps or the device without prompting the student. | iOS 11 or later | Yes |
| Force requesting permission to leave Classroom course | Forces students enrolled in unmanaged Classroom courses to get the teacher's approval to leave the course. | iOS 11.3 or later | Yes |
| Force unprompted Classroom screen observation | The student's device automatically gives permission to the course teacher's request to observe their screen without prompting the student. | iOS 11 or later | Yes |
| Force WiFi power on | Prevents Wi-Fi from being turned off through the Settings app or Control Center even by turning Airplane Mode on or off. The restriction does not prevent the device user from selecting which Wi-Fi network to use. | iOS 13 or later | Yes |
| Setting | Description | Required iOS version | Requires supervision |
|---|---|---|---|
| Deny personalized advertising from Apple | The use of user data to deliver personalized advertisements from Apple is denied. | iOS 14 or later | No |
| Deny account modification | Account modification is denied. | iOS 7 or later | Yes |
| Deny automatic updates to certificate trust settings | Automatic updates to certificate trust settings are denied. Over-the-air PKI updates are disabled. Configuring this setting does not disable CRL and OCSP checks. | iOS 7 or later | No |
| Deny Bluetooth modification | Any modifications to Bluetooth settings are denied. | iOS 11 or later | Yes |
| Deny USB restricted mode | The device is always allowed to connect to USB accessories while locked. | iOS 11.4.1 or later | Yes |
| Deny device name modification | Changes to the device name are denied. | iOS 9 or later | Yes |
| Deny diagnostic data upload | The device is prevented from automatically submitting diagnostic reports to Apple. | iOS 6 or later | No |
| Deny diagnostic data setting modification | Users are unable to modify the diagnostic data upload and app analytics settings in the Diagnostics & Usage UI in the Settings app. | iOS 9.3.2 or later | Yes |
| Deny documents from managed sources in unmanaged destination | Opening documents created or downloaded from managed sources (apps and accounts) in unmanaged destinations is denied. Documents can still be opened in other managed apps and accounts. | iOS 7 or later | No |
| Deny documents from unmanaged sources in managed destination | Documents created or downloaded from unmanaged sources (apps and accounts) can’t be opened in managed destinations. Documents from unmanaged sources can still be opened in other unmanaged apps and accounts. | iOS 7 or later | No |
| Deny enterprise app trust | Trusting enterprise applications is denied. If this option is enabled, the Trust Enterprise Developer option in is removed, preventing apps from being provisioned by universal provisioning profiles. | iOS 9 or later | Yes |
| Deny erase all content and settings | The Erase All Content And Settings option in the Reset UI is disabled. Users are unable to erase their device and reset it to factory default settings. | iOS 8 or later | Yes |
| Deny Files app network drive access | Accessing network files is disabled in the Files app. | iOS 13.1 or later | Yes |
| Deny Find My Device | The use of Find My Device in the Find My app is denied. | iOS 13 or later | Yes |
| Deny Find My Friends in the Find My app | The use of Find My Friends in the Find My app is denied. | iOS 13 or later | Yes |
| Deny Find My Friends setting modification | Users cannot make changes to Find My Friends settings. | iOS 7 or later | Yes |
| Deny fingerprint unlock | Using Touch ID or Face ID for unlocking the device is denied. | iOS 7 or later | No |
| Deny notification modification | Changes to the notification settings are denied. | iOS 9.3 or later | Yes |
| Deny passcode modification | Adding, changing, or removing the device passcode is denied. | iOS 9 or later | Yes |
| Deny password auto-fill | The use of the AutoFill Passwords feature using keychain or a third-party password manager is disabled. When denied, the user is not prompted to use a saved password in Safari or other apps. Additionally, strong password suggestion and automatic strong passwords are disabled. | iOS 12 or later | Yes |
| Deny proximity setup to new device | The prompt to set up nearby new devices is disabled. | iOS 11 or later | Yes |
| Deny password sharing | Sharing passwords with AirDrop is denied. | iOS 12 or later | Yes |
| Deny modifications of the personal hotspot setting | Modifications to the personal hotspot settings are denied. | iOS 12.2 or later | Yes |
| Deny Touch ID or Face ID modification | Users cannot modify Touch ID or Face ID. | iOS 8.3 or later | Yes |
| Deny unpaired recovery boot | Prevents an unpaired host computer from restarting the device in Recovery Mode and restoring it without local physical interaction. | iOS 14.5 or later | Yes |
| Deny untrusted TLS certificates | Untrusted TLS certificates are denied. The device automatically rejects untrusted TLS certificates without prompting the user. | iOS 5 or later | No |
| Deny USB devices in the Files app | Accessing any connected USB devices in the Files app is denied. | iOS 13.1 or later | No |
| Deny temporary sessions | Temporary sessions on a Shared iPad are disabled. | iOS 13.4 or later | No |
| Deny VPN creation | The creation of VPN configurations is denied. | iOS 11 or later | Yes |
| Deny wallpaper modification | Changing the device's wallpaper is denied. | iOS 9 or later | Yes |
| Force AirPlay pairing password | Users must use a password for AirPlay pairing. | iOS 7.1 or later | No |
| Force Apple Watch wrist detection | Forces a paired Apple Watch to use Wrist Detection. Apple Watch locks automatically when it is removed from the user’s wrist. It can be unlocked with its passcode or the paired iPhone. | iOS 8.2 or later | No |
| Force authentication before autofill | Users must authenticate before passwords or credit card information can be autofilled in Safari and other apps. | iOS 11 or later | Yes |
| Force encrypted backups | Forces all backups to be encrypted. | iOS 5 or later | No |
| Force user to enter iTunes Store password for all purchases | Forces users to enter their iTunes Store password for each transaction. | iOS 6 or later | No |
| Force limited ad tracking | The system uses limited ad tracking. App tracking in the Allow Apps to Request to Track setting is disabled. | iOS 7 or later | No |
| Force Wi-Fi allowlisting | The device can only connect to Wi-Fi networks that are set up through a configuration profile. | iOS 10.3 or later | Yes |
| Require managed copy and paste | Users cannot copying and pasting data between managed and unmanaged destinations. | iOS 15 or later | No |
| Allowed Single App Mode apps | Allows apps identified by bundle identifiers listed in the array to autonomously enter Single App Mode. Enter the desired bundle identifier, for example, com.company.app and select Add to add the application to the allowlist. | iOS 7 or later | Yes |
| Setting | Description | Required iOS version | Requires supervision |
|---|---|---|---|
| Deny backup | Backing up the device to iCloud is denied. | iOS 5 or later | No |
| Deny document sync | Document and key-value syncing to iCloud is disabled. | iOS 5 or later | Yes |
| Deny enterprise book backup | Users are unable to back up books distributed by their organization to iCloud or iTunes. | iOS 8 or later | No |
| Deny enterprise book metadata sync | Metadata synchronization to iCloud is denied for Enterprise books. Users cannot sync notes or highlights to other devices using iCloud. | iOS 8 or later | No |
| Deny keychain sync | Denies keychain synchronization to iCloud. | iOS 7 or later | No |
| Deny managed apps sync | Managed apps are prevented from using iCloud synchronization. | iOS 8 or later | No |
| Deny Photo Library | Using iCloud Photo Library is denied. Any photos not fully downloaded from iCloud Photo Library to the device are removed from local storage. | iOS 9 or later | No |
| Deny Photo Stream | Using iCloud My Photo Stream is disabled.
Note: Disallowing My Photo Stream can cause data loss.
|
iOS 5 or later | No |
| Deny Private Relay | Using iCloud's Private Relay is disabled. | iOS 15 or later | No |
| Deny shared Photo Stream | Using My Photo Stream is denied. Users cannot subscribe to or publish Photo Streams. | iOS 6 or later | No |
| Setting | Description | Required iOS version | Requires supervision |
|---|---|---|---|
| Rating region | Defines the rating region for media content restrictions.
The following values can be set:
|
iOS 5 or later | No |
| Allowed app rating | Defines the maximum rating level of app content allowed on the device. This applies to all regions.
The following values can be set:
|
iOS 5 or later | No |
| Allowed movie rating | Defines the maximum rating level of movie content allowed on the device. The possible values depend on the chosen Rating region. | iOS 5 or later | Yes
Note: This option is deprecated on unsupervised devices.
|
| Allowed TV show rating | Defines the maximum rating level of TV content allowed on the device. The possible values depend on the chosen Rating region. | iOS 5 or later | Yes
Note: This option is deprecated on unsupervised devices.
|
| Deny explicit content | Denies explicit music or video content purchased from the iTunes Store. Explicit content is marked as such by content providers, such as record labels, when sold through the iTunes Store. | iOS 5 or later | Yes |
| Setting | Description | Required iOS version | Requires supervision |
|---|---|---|---|
| Deny Genmoji | Creating Genmoji is denied. | iOS 18 or later | Yes |
| Deny Image Playground | Using Image Playground is denied. | iOS 18 or later | Yes |
| Deny Image Wand | Using Image Wand is denied. | iOS 18 or later | Yes |
| Deny Mail summary | The manual creation of summaries and email messages is denied. This does not affect automatic summary generation. | iOS 18.1 or later | Yes |
| Deny personalized handwriting results | Generating text in the user's handwriting is denied. | iOS 18 or later | Yes |
| Deny writing tools | Apple Intelligence writing tools are disabled. | iOS 18 or later | Yes |
Article last updated: 4 August, 2025