Web content filter plugin declarative configuration for Apple devices
Use the Web content filter configuration to filter web content on a device using a third-party filtering app. You can control browser, socket, packet, and URL filtering, and provide the app with server and authentication details.
The Web content filter configuration supports the following:
Minimum supported operating system versions and channels: iOS 27, iPadOS 27, Shared iPad device, macOS 27 device, visionOS 27.
Requires supervision: No.
Supported enrollment methods: User Enrollment, Device Enrollment, Automated Device Enrollment.
Web content filter settings
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Visible name | The name of the web content filter that the operating system displays on the device. | Yes | |||||||||
Plugin bundle ID | The bundle ID of the plug-in that provides filtering service. Consult your filtering solution vendor to determine what to specify for this value. | Yes | |||||||||
Content filter UUID | A globally unique identifier for this content filter configuration. The content filter processes network traffic for managed apps with the same Content filter UUID in their app attributes. | For unsupervised devices and User Enrollment. | |||||||||
Server address | The server address, which may be the IP address, hostname, or URL. | No | |||||||||
Organization | The organization string to pass to the third-party plug-in. | No | |||||||||
Vendor config | The custom dictionary that the filtering service plug-in needs. | No | |||||||||
Authentication details | Settings that control authentication. See the Authentication details settings. | No | |||||||||
Filter details | Settings that control authentication. See the Filter details settings. | No | |||||||||
Authentication details settings
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Credentials asset reference | The identifier of an asset declaration that contains the credentials to authenticate with the service. | No | |||||||||
Identity asset reference | The identifier of a credential asset declaration that contains the identity that this account requires to authenticate with the service. | No | |||||||||
Filter details settings
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Filter grade | macOS uses this value to derive the relative order of content filters. Filters configured as firewall see network traffic before filters configured as inspectors. The operating system doesn’t define the order of filters within a grade. | No | |||||||||
Browser filter details | Settings that control the browser filter on iOS, iPadOS, and visionOS. If not present, the operating system doesn’t use browser filtering. See the Browser filter details settings. | No | |||||||||
Socket filter details | Settings that control the socket filter. If not present, the operating system doesn’t use socket filtering. See the Socket filter details settings. | No | |||||||||
Packet filter details | Settings that control the packet filter on macOS. If not present, the operating system doesn’t use packet filtering. See the Packet filter details settings. | No | |||||||||
URL filter details | Settings that control the URL filter on iOS, iPadOS, and macOS. If not present, the operating system doesn’t use URL filtering. See the URL filter details settings. | No | |||||||||
Browser filter details settings
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Enable browser filter | Turns on filtering WebKit traffic. | Yes | |||||||||
Socket filter details settings
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Enable socket filter | Turns on the filtering of socket traffic. | Yes | |||||||||
Data provider composed identifier | The data provider identifier. In iOS and visionOS, the identifier is a bundle ID, for example, “ In macOS, the identifier is a composed identifier. The format of the composed identifier is “ | No | |||||||||
Packet filter details settings
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Enable packet filter | Turns on filtering network packets. | Yes | |||||||||
Packet provider composed identifier | The packet provider identifier. The format of the composed identifier is “ | No | |||||||||
URL filter details settings
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Enable URL filter | If turned on, the operating system filters URL requests. | Yes | |||||||||
URL filter parameters | A dictionary containing URL filter parameters. See the URL filter parameters settings. | No | |||||||||
URL filter parameters settings
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Control provider composed identifier | The URL filter control provider identifier. In iOS and iPadOS, the identifier is a bundle ID, for example, “ In macOS, the identifier is a composed identifier. The format of the composed identifier is “ | Yes | |||||||||
Private information retrieval server settings | A dictionary containing Private Information Retrieval server settings. See the Private information retrieval server settings. | Yes | |||||||||
URL filter fail closed | If turned on, the operating system blocks URLs if the filter is turned on, but it fails to make any filtering decision; for example, if there’s a communication failure with the private information retrieval (PIR) server. If turned off, the operating system allows URLs if the filter is turned on, but it fails to make any filtering decision. | No | |||||||||
Prefilter fetch frequency | The time interval in seconds that the operating system uses to periodically run the web filter app extension. The default value is | No | |||||||||
Private information retrieval server settings
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Private information retrieval server URL | The URL containing the domain name of the private information retrieval server. | Yes | |||||||||
Privacy pass issuer URL | The URL containing the domain name of Privacy Pass Issuer. | Yes | |||||||||
Authentication token asset reference | The identifier of an asset declaration containing the HTTP bearer token required to authenticate with the service. | No | |||||||||
Note: Not all configurations and their settings are available in all device management services. Each device management service developer implements these settings differently. To learn which settings are available for your devices, consult your developer’s device management service documentation.